Chapter 5 — Reps

The wire is the gym this week. You will baseline normal traffic, hunt anomalies in a live window, and prove you can reason about the network an AI workload actually needs. Read Chapter 5 first; the reps assume it.

Ground rules

• Type it yourself. No copy-paste of whole solutions. Your fingers learn what your eyes skim.
• Run everything. A command you didn’t run is a command you don’t know. If you have no GPU node, read the GPU reps line by line and write what each line guards against — that still counts.
• Predict before you measure. Every rep that flags or measures something asks you to write your prediction first, then compare. The gap between guess and result is the rep.
• AI policy (Phase 1, Weeks 1–8): do the traditional method first/also, then bring in AI and grade it critically. End every rep with a one-line AI usage note — what you used AI for, and what you verified by hand. The human owns the verdict.
• No real targets. Run captures and scans only against the provided sample files, your own lab hosts, or systems you are explicitly authorized to test.

The sample data lives in this chapter’s code/ directory: code/baseline_flows.csv, code/window_flows.csv, the reference detector code/flow_baseline.py, and the fabric check code/gpu_fabric_check.sh.

Reps 1–3: The Core Services, Fast and Correct

Rep 1 — Time the resolver

DNS is the service that takes everything down and looks like “the app is slow.” Resolve a name and time the resolver, then do it against a second resolver and compare.

dig +stats example.org @1.1.1.1
dig +stats example.org @8.8.8.8

Predict first: which resolver will be faster from your location, and by roughly how much? Then: record the Query time from each. Write two sentences on what a rising DNS query time would tell you about an incident in progress. AI usage: (one line)

Rep 2 — Is the clock honest?

NTP drift silently breaks TLS, Kerberos, and your logs’ ordering. Check your offset.

chronyc tracking | grep -E "System time|Last offset|Leap status"   # Linux/chrony
# macOS alternative: sntp -sS time.apple.com   (read offset; do NOT set without intent)

Write the threshold (in ms) above which you would page someone, and why that number — tie it to a specific service that breaks when the clock is wrong. AI usage: (one line)

Rep 3 — Will the cert outlive the weekend?

The reverse proxy cert that expires at 2 a.m. on a holiday is a rite of passage. Don’t earn it.

echo | openssl s_client -connect example.org:443 -servername example.org 2>/dev/null \
  | openssl x509 -noout -subject -enddate

Compute days remaining by hand from the notAfter date. Then write the one-line cron/monitor check you’d add so this never surprises you. AI usage: (one line)

Reps 4–6: Seeing the Wire

Rep 4 — Three altitudes

For each of these questions, name which collection altitude answers it best — SNMP, flow logs, or packet capture — and one sentence why:

1. “Is the uplink saturated right now?”
2. “Which internal host has been talking to this suspicious external IP over the last two weeks?”
3. “What exact bytes did that one TLS handshake exchange?”

Then explain in two sentences why you would not try to build a 30-day behavioral baseline out of full packet captures. AI usage: (one line)

Rep 5 — Read a flow, no payload

Capture (or read) flow-level records and describe a conversation without ever seeing payload.

sudo tcpdump -nn -q -c 30 'tcp port 443'   # or read code/baseline_flows.csv if no lab host

Pick one flow and write the five-tuple (src, dst, dst_port, proto, approx bytes) and what service you think it is — purely from the flow shape. State your confidence and what would raise it. AI usage: (one line)

Rep 6 — Build the baseline by hand

Open code/baseline_flows.csv. For host 10.20.4.31, compute by hand (or with awk/a spreadsheet): its mean bytes_out, its set of destination ports, and its set of distinct destinations.

awk -F, '$2=="10.20.4.31"{print $5, $4, $3}' code/baseline_flows.csv

Predict first: before you compute, guess this host’s role from §5.1’s table of services. Then: does your computed profile match the distilled baseline comment block at the bottom of the file? Reconcile any difference. AI usage: (one line)

Reps 7–9: The Behavioral Baseline and the AI Watch

Rep 7 — Hunt the three, by eye

Open code/window_flows.csv. Before running any tool, find the three anomalies by eye and write, for each: the host, the anomaly class (beaconing / port_scan / exfil), and a one-line “why” tied to the baseline.

This is the rep. Do not skip to Rep 8 until you’ve committed your three answers in writing. AI usage: (one line)

Rep 8 — Reconcile with the detector

Now run the reference detector and compare to your Rep 7 answers.

python3 code/flow_baseline.py code/baseline_flows.csv code/window_flows.csv

Where did the script agree with you? Where did it catch something you missed, or miss something you caught? Read the relevant function in code/flow_baseline.py and explain, in your own words, the exact rule that fired (e.g., the pstdev(b) < 50 jitter test for beaconing). AI usage: (one line)

Rep 9 — Make it cry wolf, then make it sleep

Edit a threshold in code/flow_baseline.py — first too tight (e.g., drop the exfil multiplier from 10 to 2), then too loose (raise it to 100). Re-run against the window each time.

Predict first: what legitimate baseline traffic will a too-tight setting falsely flag? Then: record how many findings you get at each setting. Write two sentences connecting this to the Ezekiel “silent watchman” problem from §5.5 — why a horn that always blows equals no horn. AI usage: (one line)

Reps 10–11: AI as the Workload

Rep 10 — Read the fabric

Run (or read) the GPU-fabric prerequisite check.

bash code/gpu_fabric_check.sh   # read it line by line if you have no GPU node

For each of the four checks (NVLink topology, nvidia_peermem, RDMA HCA, memlock), write one sentence: what does this guard against, and what symptom appears in a distributed training job if it’s wrong? Then state, from the chapter’s table, the headline NVLink-5 per-GPU bandwidth figure (as of 2026) and why “we added GPUs and it got slower” is usually an interconnect story. AI usage: (one line)

Rep 11 — Grade the AI’s incident narrative

Take the following AI-generated hypothesis about the window data and grade it:

“Host 10.20.4.45 sent 1.8 GB to 198.51.100.42 — this is the nightly off-site backup completing; no action needed. Host 10.20.4.62’s connections to 203.0.113.77 are routine vLLM health checks.”

Find one claim that is plausibly true, one that is unsupported, and one that is contradicted by the baseline. Write the single corroboration step you would run before accepting any of it. This is the “witness statement, not verdict” discipline from §5.5 in practice. AI usage: (one line)

Done? One Last Thing.

A miniature of this week’s project. Pick the single most dangerous finding from the window data and write a five-line incident memo a tired on-call human could act on at 3 a.m.:

1. What — host, class, evidence (the specific baseline deviation).
2. So what — likely meaning and blast radius if you’re right.
3. Confidence — and the one thing that would change it.
4. Recommended action — and explicitly: automated block, or human-gated? Justify which, per §5.8.
5. Who answers — name the human (a role is fine) who owns the decision.

If you can write those five lines defensibly, you can build Project 5. The watchman sees and warns; the named human keeps the gate.

Up next: Project 5 — Project 5: “Read the Traffic.”