# Protocol-Level Investigation

> Deep-dive into core network protocols (DNS, HTTP, SMB) to uncover hidden attacks, lateral movement, and data exfiltration directly from packet captures.

Canonical: https://codelivly.com/rooms/protocol-level-investigation
Last updated: 2026-09-16

| | |
|---|---|
| Level | Intermediate |
| Category | Forensics |
| Lessons | 4 |
| Estimated time | 30 min |
| XP | 100 |

This module transitions from basic packet analysis to deep protocol-level investigation. You will learn to dissect the forensic artifacts hidden within specific application and transport protocols. Key topics include analyzing DNS for tunneling and C2 communications, inspecting HTTP for web shell activity and data exfiltration, and decoding SMB/NTLM for lateral movement and credential theft. By understanding the normal behavior and RFC standards of these protocols, you will be able to identify subtle deviations and protocol violations that indicate a compromise, making protocol analysis a critical skill for advanced threat hunting and incident response.

## Lessons

1. What Is Protocol-Level Analysis and Why Does It Matter (30 min)
2. Investigating HTTP, DNS & FTP Traffic (30 min)
3. Identifying C2 Traffic Patterns (30 min)
4. Guided Lab: Tracing C2 Communication in a Capture (30 min)

## Related

- [Learning path: Network Forensics](https://codelivly.com/learning-paths/network-forensics)
- [All rooms](https://codelivly.com/rooms)