Networking Fundamentals & Traffic Analysis
BeginnerLearn networking the way security analysts use it: follow a web visit packet by packet in Wireshark, reading TCP, DNS, HTTP and TLS from real captures. Then place addresses and prefixes, read connections, correlate Zeek logs and alerts, and spot scanning, beaconing-like timing and large uploads before writing a network finding someone can verify. Built for beginners heading for SOC, CTI and malware analysis, with hands-on missions in Wireshark and a free first section.
The first 2 modules are free. Premium unlocks the rest of the path and the certificate.
Curriculum
50 steps across 6 sections. Sections unlock in order as you complete them.
- From a Click to a ConversationModule
- Observation Before SuspicionModule
- Two Tabs, One WorkstationMission
- Addresses in ContextPremiumModule
- The Local NetworkPremiumModule
- Crossing BoundariesPremiumModule
- Put the Sensors on One ClockPremiumMission
- TCP as an Evidence TrailPremiumModule
- UDP and ICMPPremiumModule
- Recover the Last InstructionPremiumMission
- DNS as a Live ConversationPremiumModule
- Web Traffic and EncryptionPremiumModule
- Enterprise Services Behind Everyday AlertsPremiumModule
- Open the Sealed ReceiptPremiumMission
- Correlating RecordsPremiumModule
- Patterns Worth InvestigatingPremiumModule
- Visibility and a Useful HandoffPremiumModule
- Recover the LabelPremiumMission
Ready to start Networking Fundamentals & Traffic Analysis?
Create a free account to open the remaining 11 steps and track every step you finish. The first 2 modules are free. Premium unlocks the rest of the path and the certificate.
- First 2 modules free
- Progress saved on every step
- Certificate with Premium
About this path
Every alert a SOC handles, every indicator a CTI analyst shares and every callback a malware analyst finds is, underneath, a network record: a packet, a log line, a flow. Reading those records well is the skill this path builds, starting from zero. You do not need to know what a header, a port or a subnet is when you begin.
The path is built on real traffic. We generated harmless traffic between real software in a closed lab (a browser fetching pages, a DNS resolver, mail, file sharing and remote access servers, scheduled jobs and a few patterns that only look suspicious) and captured it. Every packet list, Zeek log and Suricata alert you read comes from those captures, and every lesson asks you to read, compute or decide something from them.
The first section is free. It follows one web visit through DNS, a TCP handshake and an HTTP request in Wireshark, shows why a capture, a firewall log and an alert describe the same event differently, and ends with a real triage decision between two unfamiliar connections. The rest of the path builds the mechanics an analyst uses every day: addresses and prefixes, local delivery and DHCP leases, routes, NAT and proxies, TCP, UDP and ICMP, DNS, web traffic and encryption, and the mail, file-sharing and remote-access traffic behind everyday alerts. Then you learn to join records across logs, and only then look at the patterns worth investigating, from scanning to large uploads, before writing a network finding another analyst can verify.
Five sections end with a hands-on mission: a short investigation you run in Wireshark on a capture from the lab. You untangle two overlapping connections, put two sensors on one clock and trace a connection through NAT, reassemble a split TCP stream, decrypt a TLS session with a supplied key log, and finally carve a file out of a busy capture and verify it by its hash.
Throughout, you keep three things apart: what a record shows, what it proves, and what you conclude from it.
What you will learn
Read a capture in Wireshark. Follow a web visit packet by packet and find who talked to whom, on which port, and what was asked.
Tell what a record proves. Keep what a packet, a log line or an alert shows apart from what it establishes and what you infer.
Place an address. Read IPv4 prefixes and IPv6 addresses, match an internal address to a device and a time, and see through NAT and proxies.
Read connections. Tell how far a TCP exchange got, judge UDP and ICMP traffic, and follow a stream that arrived in pieces.
Read the services behind alerts. Follow DNS, HTTP and TLS, and tell connection, negotiation, authentication and a completed action apart in mail, SMB and remote access.
Correlate network records. Triage a whole capture, join Zeek logs by identifier, read flow records, and trace an alert back to the bytes that caused it.
Investigate patterns without jumping to conclusions. Measure scanning, timing regularity, internal connections and upload size, and keep the benign explanations alive until the evidence rules them out.
Hand over a finding. State your visibility limits and write a network finding the SOC can act on and CTI can reuse.
Who this path is for
Beginners heading for a SOC analyst role who need to read packets and network logs with confidence.
CTI analysts who work with network indicators and want to know what they really prove.
Aspiring malware analysts who need to understand the traffic a sample produces.
IT staff moving into security who know networks from the operations side.
Frequently asked questions
No. The path starts from a single web visit and defines every term the first time it appears. If you finished Cybersecurity Foundations you will recognise some tools, but it is not required.
For the lessons, no: every lesson shows the real output and screenshots, so you can read them in your browser. The five missions are different: you open a real capture and work in Wireshark, which is a free download from wireshark.org and the standard tool this path teaches. Experienced learners can use tshark instead.
Yes. It was generated by real software in a closed lab and captured, then analysed with Wireshark, Zeek and Suricata. The addresses and names are documentation ranges and fictional organisations, so nothing points at a real company.
You will read the network shapes that matter for malware analysis, such as lookups, check-ins with regular timing and large uploads, from harmless lab traffic. You never download or run malware. The Malware Triage & Intelligence path goes further.
No. There are no subnetting drills or router configuration. It teaches the networking a security analyst needs to read evidence and make decisions.
The first section is free: six lessons from a web visit and a first look at Wireshark to a first triage decision, and its mission, where you untangle two overlapping connections in a capture. The rest of the path, including the other four missions, is part of the premium plan.
Yes, five, one at the end of five sections. Each gives you a case and a capture to open in Wireshark, and a different job: navigate overlapping connections, measure a clock offset across two sensors, reassemble a TCP stream, decrypt a TLS session with a supplied key log, and carve a file out of the traffic and hash it. You answer with values you find in the capture, such as a port, a byte count or a hash.