Containment Through Network Isolation at the Packet Layer

Containment decisions get made under time pressure with incomplete information, and the most common error is choosing a control that constrains the wrong layer. Disabling an account stops the identity from authenticating; it does not stop an existing session, does not stop the process holding that session’s token, and does not stop that process from opening a socket. Killing a process stops it until a persistence mechanism restarts it. Isolating the host’s network access stops the communication, which is usually the objective that matters, and does so without destroying evidence on the box.

The reason network isolation is the default containment primitive is that almost every intrusion has a network-shaped dependency: command and control, credential use over the network, exfiltration, lateral movement. Cut the path and the intrusion stops advancing even while it remains resident. The choice within network isolation is then which mechanism, because the different mechanisms block different traffic at different places.

The three points of control

Isolation can be imposed at the switch port, in the switch’s or router’s filter logic, or on the host itself.

Port-level isolation administratively disables the port, or moves it into a quarantine VLAN whose only reachable destination is a remediation or forensic-collection server. Port-level action is fast, applies regardless of the host’s configuration, and cannot be undone by the attacker without switch credentials. Its cost is that it also cuts the traffic the investigator needs: remote acquisition, live response tooling, and the log forwarding the host performs all stop at once if the quarantine VLAN allows nothing.

Filter-based isolation uses an access control list on the switch or router. Standard ACLs match source address only; extended ACLs match source and destination addresses, protocol, and layer-4 ports. The essential property is placement: an ACL applied inbound on the port stops traffic the host originates, which is the direction command and control requires, while an ACL applied outbound stops traffic to the host. Only the inbound direction cuts the attacker’s outbound path, so applying an outbound-only filter and declaring the host contained is a common and consequential mistake.

Host-based isolation uses the host’s own packet filter. It is the only option when the switch is not administrable or when the host is a virtual machine whose traffic does not traverse a manageable port. It is also the weakest, because a host with administrative privileges, which a compromised host frequently has, can modify its own rules.

Why an address-based ACL is not enough by itself

Filtering on IP addresses assumes the addresses mean what they appear to mean. Several mechanisms break that assumption.

A host can present several addresses simultaneously: a primary from the subnet, plus link-local, plus addresses added by container runtimes or by a VPN. The blocklist covers the address the defender observed, not the set the host currently holds. Enumerating addresses from the switch’s CAM or ARP table at isolation time is more accurate than trusting the ticket.

A blocked host can also attempt to reach other hosts on the same layer-2 segment without routing. An ACL on a router never sees that traffic, because it does not cross the router. Intra-subnet movement such as SMB, RDP to a neighbour, or ARP-based poisoning is only stopped at the port or by private-VLAN configuration. This is precisely the mechanism behind much of the traffic described in lateral movement from authentication logs, and it is why quarantining at the port beats filtering at the router for a host on a flat segment.

NAT and load balancing add a second layer of indirection in the other direction: the source address the target sees is not the host’s address, so an ACL written on the observed address may not match the actual packets. Where the host is behind a NAT, isolation must happen at the port or at the NAT device’s translation table, not on the translated address.

What a quarantine VLAN must still allow

A quarantine VLAN that blocks everything creates a second problem: the host keeps generating traffic, retries indefinitely, and the attacker’s tooling may treat sustained failure as a signal. It also means the investigator loses remote access.

The useful configuration permits a small set of destinations: the forensic collection server, the logging collector, and the internal time source. Everything else is denied. Denying DNS by omission is a design decision with consequences: name resolution fails, which stops most automated outbound attempts but also stops the host’s log forwarder from resolving the collector’s name. Using a literal address for the collector avoids the dependency.

! extended ACL: deny everything except the collection server and collector,
! applied inbound on the switch port so the host cannot originate elsewhere
ip access-list extended QUARANTINE_IN
 permit tcp host 10.20.4.17 host 10.20.9.11 eq 443
 permit udp host 10.20.4.17 host 10.20.9.12 eq 514
 permit udp host 10.20.4.17 host 10.20.9.5  eq 123
 deny   ip any any log
service timestamps log datetime msec

The single log on the final deny is the difference between an isolation that produces evidence and one that produces nothing. Every dropped packet records the attempted destination and port, which is a live feed of what the resident implant is trying to reach, frequently the most informative artifact obtained during the containment phase.

Timing and the evidence interaction

Isolation necessarily severs any active connection, and the state of those connections is evidence. Before applying the control, the connection table gives the addresses and ports of everything the host was talking to, which is the starting point for identifying external infrastructure. Reading it takes seconds.

There is an ordering tension analogous to the one in disk imaging: isolating first preserves the attack’s future but loses its present, and capturing first preserves the present but allows further action. The standard resolution is to capture the volatile connectivity state and memory first where feasible, then isolate, since the resident process keeps running either way but its open sockets vanish on disconnect. For hosts where the attacker may act destructively, isolation comes first and the loss of connection state is accepted.

Failure modes that look like success

Three isolation strategies fail while appearing to work. Disabling a user account leaves active sessions alive, because authentication is a step at session start, not a continuous property. Blocking a single destination address blocks that address only, and C2 infrastructure rotates. And firing a host firewall rule on a host where the attacker has administrative privilege invites the attacker to remove it, which is why host-based controls are a supplement to switch-level enforcement rather than a substitute.

A fourth is scope creep in the other direction: isolating more hosts than the evidence supports. Each isolation costs the defender access, costs the business availability, and produces its own deny logs that must be triaged. Isolating a subnet because one host on it is compromised creates a large volume of new signals, and the attacker who is not on the isolated host learns from the change. Isolation decisions are best made per host with a documented reason, so that a later reviewer can tell which isolations were evidence-driven and which were precautionary.

The check that distinguishes real containment from the appearance of it is behavioral: after isolation, whether the host’s traffic to the outside stops, and whether the stop is recorded. A port with no counters and no deny logs may be down, or may be up and idle, and the two are indistinguishable without the switch’s own record. Verifying containment therefore means reading the enforcement point’s counters rather than reading the ticket.

Duration and reversal

Isolation is reversible, and the reversal is a decision with its own risk. Removing a quarantine restores the attacker’s network path if the intrusion was not fully eradicated, and the interval between isolation and reversal is exactly the window in which the defender has the advantage of a controlled environment. Rebuilding the host rather than reversing the isolation removes that risk at the cost of the host’s own evidence, which is why rebuilding usually follows acquisition rather than replacing it.

For hosts that cannot be rebuilt, the reversal should be staged: restore connectivity to the logging collector and management plane first, verify that the host behaves as expected under observation, then restore general connectivity. Staged reversal keeps the deny log available as a continuing check, so a resident implant that survives the eradication attempt announces itself by attempting the connections it can no longer make.