NEW350+ rooms now have a live terminal, so you can learn by typing the commands, right in your browser.Learn in a live terminal. 350+ rooms.Try a lab♥ Codelivly is 100% free, no paywall. If it helped you, chip in to keep it running.100% free. Help keep it so.Support us
[>_] ROOM · Cybersecurity
Network Traffic Analysis
Master the art of analyzing network wire data. Learn to detect C2 beaconing, DNS tunneling, lateral movement, and data exfiltration using Zeek metadata and SIEM correlation.
Room tasks
1Reading Packet Captures for Detection
2DNS-Based Detection Techniques
3HTTP/HTTPS Traffic Red Flags
4TLS Basics for Analysts
Frequently Asked Questions
What is network traffic analysis?
It is examining network data, such as packets, flows, or Zeek logs, to understand behavior and detect threats like beaconing, tunneling, and data theft.
What is Zeek used for?
Zeek is an open-source network monitor that turns traffic into rich logs for connections, DNS, HTTP, and more. Analysts search these logs in a SIEM to find suspicious activity.
How do you detect data exfiltration in network traffic?
Look for unusually large outbound transfers, odd destinations, and encoded data in protocols like DNS. This free Codelivly room teaches these detections with hands-on exercises.