On the wire: TCP segments with payload size 24 or 32 bytes, repeating with millisecond precision. Normal background noise doesn’t do that. | Layer | Tool | What to look for | |-------|------|------------------| | Flow | ntopng, ElastiFlow | Asymmetric byte ratio >100:1 + constant packet gap | | Packet | tshark | tcp.payload_length == 24 and frame.time_delta between 5–15 sec | | IDS | Suricata | Custom rule matching TLS JA3S hash (ask me for the hash list) | | Logs | Zeek | ssl log with server_name containing unusual subdomains + cipher suite 0x1301 | Pro tip: FileCatalyst often coexists with Aspera or Signiant in media networks. Don’t confuse the two — Aspera uses FASP‑UDP with a different initial window and congestion signature. 4. Two Real‑World Detection Scenarios Scenario 1 – Unauthorized server in R&D Your NDR platform alerts on a workstation sending 800 Mbps to an unknown cloud IP on UDP/443. Standard inspection shows “QUIC” — but the packet size distribution doesn’t match QUIC. You pull a PCAP and see the 24‑byte control probe. It’s FileCatalyst Direct tunneling over port 443.
Monitor for UDP flows with a stable packet‑per‑second rate above 5,000 pps for more than 10 seconds and a matching low‑rate reverse UDP flow (the control channel). Very few legitimate apps behave that way. Final thought FileCatalyst is not malicious. But undetected FileCatalyst is a policy problem, a data governance risk, and occasionally a security gap (exfiltration tools love fast UDP). filecatalyst detection
Let’s move past the blinking lights on the server and talk about real detection. Most people think: FileCatalyst uses port 33000 or 33001 (TCP/UDP) — case closed. Wrong. On the wire: TCP segments with payload size
Have you found FileCatalyst hiding on non‑standard ports in your environment? Let me know below. Don’t confuse the two — Aspera uses FASP‑UDP
Start detecting it today — not by port, but by behavior. Your network visibility will thank you. Drop a comment or ping me directly — I’m happy to share the rule templates.