Traffic analysis

29 courses, 438 lessons. A real Kali Linux lab in the browser.

Packets through an analyst’s eyes (Level 101, 18 lessons): You learn the layers, headers, ports and handshakes of a packet and how to read, step by step, what happens in recorded traffic.
First steps in traffic CTFs (Level 101, 14 lessons): You reinforce filtering, stream following and exporting habits while finding flags hidden in small PCAP puzzles.
Wireshark fundamentals (Level 101, 15 lessons): Capturing packets, filters and following a conversation.
Packet capture with tcpdump (Level 201, 16 lessons): Capturing and filtering from the command line.
Protocol analysis with tshark (Level 201, 16 lessons): Inspecting HTTP, DNS and TLS traffic on the command line.
Going deeper in Wireshark: expert info and TCP analysis (Level 201, 16 lessons): With Wireshark’s expert info, IO graphs, Decode As and TCP analysis flags you explain slowness, loss and odd behaviour with evidence.
TCP/IP in depth: IPv4, IPv6, TCP, ICMP, ARP (Level 201, 16 lessons): You learn every field of IP, TCP, ICMP and ARP and interpret fragmentation, state changes and the traces spoofed packets leave in traffic.
Reading DNS traffic in depth (Level 201, 16 lessons): You trace DNS message structure, record types, recursion and encrypted DNS in traffic and recognise abuse patterns.
Cleartext protocols: FTP, Telnet, SMTP, POP/IMAP, SNMP, syslog (Level 201, 15 lessons): You learn how old but still living cleartext protocols look in traffic, what they leak and how to move to their secure counterparts.
Zeek fundamentals: turning traffic into logs (Level 201, 17 lessons): With Zeek you turn live traffic and PCAP files into structured logs and read an incident from conn, dns, http, ssl and files logs.
Flow analysis with NetFlow and IPFIX (Level 201, 15 lessons): Without keeping full packets you see who talked to whom and how much with flow records, build baselines and catch deviations.
Intrusion detection with Snort (Level 301, 15 lessons): Writing rules, reading alerts and tuning them.
Network detection and prevention with Suricata (Level 301, 20 lessons): You install Suricata, write rules, review EVE JSON logs with jq, cut false alarms and stop suspicious traffic in inline mode.
HTTP and TLS in depth: HTTP/2, QUIC, TLS 1.3 (Level 301, 16 lessons): You decode three generations of HTTP and the TLS handshake at packet level, read certificates and decrypt your own lab traffic with a key log.
Windows network protocols: SMB, Kerberos, NTLM, LDAP, RDP (Level 301, 15 lessons): You decode the protocols of corporate Windows networks in traffic and detect the packet traces of lateral movement and credential abuse.
Zeek scripting and threat intelligence (Level 301, 15 lessons): With the Zeek scripting language you write detections that react to events, feed the intelligence framework and extend Zeek with packages.
Capture operations with tcpdump (Level 301, 15 lessons): You run long, rotating and remote captures safely, write byte-offset BPF filters and collect evidence while protecting personal data.
PCAP analysis with Python: Scapy and pyshark (Level 301, 15 lessons): With Scapy and pyshark you read captures in code, craft test packets for your own lab network and produce repeatable analysis reports.
Case file: ransomware precursors on the Harborline Freight network (Level 301, 15 lessons): In the captures of the fictional logistics company Harborline Freight you trace the attacker step by step from initial access to the moment before encryption.
Traffic CTF arena (Level 301, 15 lessons): In intermediate PCAP and Zeek puzzles you extract flags from encrypted traffic, custom protocols and fragmented files.
Advanced Suricata rule writing and performance (Level 401, 14 lessons): With datasets, flowbits, Lua scripts and rule profiling you write rules that are both accurate and fast, and put the ruleset through quality checks.
Network detection engineering (Level 401, 15 lessons): You manage network detections as code, map them to ATT&CK, test them automatically with PCAPs, wire them into CI and measure alert quality.
Analysing encrypted traffic without decrypting it (Level 401, 14 lessons): With JA3, JA4 and JA4S fingerprints, certificate anomalies, SNI, ECH and DoH metadata you single out the suspicious without seeing inside encrypted channels.
Hunting command-and-control traffic: beacons, tunnels, exfiltration (Level 401, 14 lessons): You hunt regular beacons, long connections, DNS tunnels and unusual data egress with statistics and report findings with evidence.
Threat hunting with Zeek logs (Level 401, 13 lessons): In large Zeek log archives you track activity with stack counting, rarity and correlation, and turn your hunts into repeatable queries.
Case file: insider data leak at Veloxa Pay (Level 401, 13 lessons): At the fictional fintech Veloxa Pay you verify a claim that customer data left the company using traffic, flow and Zeek logs, and prove whether it was internal or external.
Network sensor architecture and full packet capture at scale (Level 501, 14 lessons): You design where sensors go, TAP versus SPAN, packet brokers and long-term full packet retention, building privacy and legal duties into the plan.
Detection evasion and protocol anomalies: the defender’s side (Level 501, 13 lessons): In the lab you see how fragmentation, overlapping segments, TTL tricks and protocol anomalies fool sensors, and close those gaps with normalisation and anomaly detection.
Job role capstone: a SOC network analyst’s shift (Level 501, 13 lessons): In a realistic shift you triage the alert queue, investigate incidents with PCAP, Zeek and flow logs, escalate and write the shift handover report.

Projects

Explain a web visit packet by packet (Wireshark): You open the capture of a visit to Gelincik Okulları’s student portal in Wireshark and prepare a diagram explaining each step, from name lookup to page delivery, with packet numbers.
Write an identity card for an unknown device on the network: From the recorded traffic of an unidentified device that appeared on Karaçam Mobilya’s office network you extract its addresses, the servers it talks to and the ports it uses, and write a reasoned identity card saying what the device is.
SOC basics: triage the alerts: You review alerts arriving at a security operations centre (SOC), separate real threats from false alarms, and present a prioritised list.
Why the page is slow: analyse the traffic: You capture and study the network traffic of a slow-loading page, find where the delay comes from, and explain it in a short summary.
Find and stop passwords sent in clear text: You spot usernames and passwords sent over unencrypted protocols with Wireshark and prepare a plan to move those services to encrypted versions.
Build a service inventory of the network from Zeek logs: You turn a day of Saklıvadi Üniversitesi’s recorded traffic into logs with Zeek and prepare an inventory report showing which host offers which service and who moves the most data.
Explain a failed HTTPS transaction at packet level: You examine the capture of a failed HTTPS connection at packet level and explain at which step and why the connection broke.
Roll out a new detection rule without noise (Snort): You test a new Snort rule against saved traffic first, weed out false alarms and show it catches only the intended event in production.
Catch data leaving through suspicious DNS queries: You find unusually long and frequent DNS queries in saved traffic with tshark and report the suspected data leak with evidence.
Write a Python tool that summarises a capture (Scapy): For Kuzeyyıldızı Kargo’s shift analysts you write a Python tool that reads a capture and outputs the top talkers, DNS queries and unusual ports as a JSON report.
Trace file access through Windows network traffic: In a capture from Yelkovan Bankası’s branch network you study authentication and file-sharing traffic and show in a timeline which account reached which share and when.
Hunt connections that repeat at regular intervals (Zeek): In a week of Mavikaya Lojistik’s Zeek connection logs you pick out outbound connections repeating at regular intervals using statistics, rule out legitimate update traffic, and report the remaining candidates with evidence.
Find unusual TLS clients without decrypting: In Yakamoz Telekom’s encrypted traffic capture you compare client fingerprints, server names and certificate details, and identify and report clients unlike the rest of the network without decrypting content.
Profile and speed up a slow Suricata rule set: You study the rule set causing packet loss on Demirsu Enerji’s sensor using profiling output, rewrite the costliest rules so they still catch the same events, and show the gain with measurements.
Design a network sensor: full capture, Zeek and Suricata: For Lodoskaya Denizcilik’s port office you set up rotating full packet capture, Zeek and Suricata on one sensor, calculate retention, and defend placement and capacity decisions in a design document.
Close the sensor’s blind spots: protocol anomalies: In prepared captures where Turnalı Perakende’s sensor raised no alert you study fragmented and irregular protocol traffic, correct the sensor settings and rules, and show in a table that the same captures are now caught.