# Network Traffic Analysis

> Master the art of analyzing network wire data. Learn to detect C2 beaconing, DNS tunneling, lateral movement, and data exfiltration using Zeek metadata and SIEM correlation.

Canonical: https://codelivly.com/rooms/network-traffic-analysis
Last updated: 2026-07-06

| | |
|---|---|
| Level | Advanced |
| Category | Cybersecurity |
| Lessons | 4 |
| Estimated time | 30 min |
| XP | 200 |

Dive deep into the wire. The Network Traffic Analysis module moves beyond basic IDS alerts to teach you how to hunt for stealthy adversaries using raw network metadata and packet captures.

You will learn how to identify Command and Control (C2) beaconing patterns, detect DNS tunneling and Domain Generation Algorithms (DGAs), track lateral movement via SMB/RDP anomalies, and spot data exfiltration over encrypted channels. By the end of this module, you will be able to build advanced SIEM queries that correlate endpoint and network data to catch threats hiding in plain sight.

## Lessons

1. Reading Packet Captures for Detection (30 min)
2. DNS-Based Detection Techniques (30 min)
3. HTTP/HTTPS Traffic Red Flags (30 min)
4. TLS Basics for Analysts (30 min)

## Related

- [Learning path: Endpoint & Network Security Monitoring](https://codelivly.com/learning-paths/endpoint-network-security-monitoring)
- [All rooms](https://codelivly.com/rooms)