What would you do if a classified network showed anomalous traffic and you had to investigate without direct internet access?