NEW350+ rooms now have a live terminal, so you can learn by typing the commands, right in your browser.Learn in a live terminal. 350+ rooms.Try a lab♥ Codelivly is 100% free, no paywall. If it helped you, chip in to keep it running.100% free. Help keep it so.Support us
[>_] ROOM · Forensics
Protocol-Level Investigation
Deep-dive into core network protocols (DNS, HTTP, SMB) to uncover hidden attacks, lateral movement, and data exfiltration directly from packet captures.
Room tasks
1What Is Protocol-Level Analysis and Why Does It Matter
2Investigating HTTP, DNS & FTP Traffic
3Identifying C2 Traffic Patterns
4Guided Lab: Tracing C2 Communication in a Capture
Frequently Asked Questions
Why investigate network protocols like DNS, HTTP and SMB?
Attackers rely on these protocols for command and control, lateral movement and data theft. Understanding normal behaviour makes malicious use stand out in captured traffic.
How can SMB traffic reveal lateral movement?
SMB shows file shares, remote service creation and authentication attempts between hosts. Unusual connections, admin share access or NTLM exchanges can point to an attacker moving through the network.
Is this protocol analysis room free?
Yes. The Protocol-Level Investigation room on Codelivly is free and intermediate, using guided exercises to dig into DNS, HTTP and SMB traffic.