After Close

You are reviewing a day of connection records. Caspiy Plaza Hotel is a hospitality business. A network engineer noticed traffic leaving the office at night, when nobody is there, and handed the export to you.

There are no packet contents here — only who, where, when and how many bytes. That is enough: regularity and volume are visible without decryption, and most traffic is encrypted anyway.

Start by looking for regularity, not size: people do not open a connection every few minutes to the second.