Skip to main content
Log in

Network Traffic Analysis & Intrusion Detection

Learn to read packets and flows, apply Wireshark and tshark filters, recognise scanning, beaconing, DNS tunnelling and cleartext credentials, and write and review Suricata/Snort-style IDS rules. Network evidence is often the only ground truth when hosts are compromised.

Defensive Security & Incident Response
Level
Intermediate
Study time
9 hours
Lessons
6
Practice labs
5
Assessments
2
Format
Self-paced, online

What you will learn

By the end of this course you will be able to:

  • Explain packets, flows and the capture points that determine what you can see
  • Write correct Wireshark display filters and tshark commands to isolate traffic
  • Identify port scans, beaconing, DNS tunnelling and cleartext credentials in packet summaries
  • Read and write simple Suricata rules (header, options, sid) and explain their limits
  • Review firewall and IDS rules for over-permissive entries, shadowing and logic errors
  • Build a baseline of normal traffic and use it to prioritise anomalies

Before you start

TCP/IP basics (IP, TCP, UDP, DNS, HTTP) and comfort at a command line

Tools you will use

  • Wireshark
  • tshark
  • Suricata (rule syntax)
  • Firewall rule review
  • tshark/Wireshark console (simulated)

Course outline

6 lessons in 2 modules.

Module 1: Reading Network Traffic

  • Packets, flows and where to capture
  • Reading TCP, DNS and HTTP in Wireshark
  • Wireshark display filters you will use daily

Module 2: Detection and Defence

  • Spotting scans, beaconing, DNS tunnelling and cleartext credentials
  • IDS/IPS concepts and Suricata rule anatomy
  • Writing, testing and tuning rules; baselining normal traffic

Practice labs and assessments

Labs run in the browser as simulations. They never touch a real system.

5 practice labs

  • Spot the port scan in a packet summary Beginner, 25 min
  • tshark filter workbench Intermediate, 30 min
  • Beacon, DNS tunnel and exfiltration triage Intermediate, 35 min
  • Firewall and IDS rule review Intermediate, 30 min
  • Case: beacon detection and rule writing Advanced, 40 min, final lab

2 assessments

  • Knowledge check: reading traffic
  • Final quiz: traffic analysis and intrusion detection

The pass mark is 70%. You can retake an assessment.

Previous courseSecurity Monitoring, Log Analysis & Threat Intelligence

Take Network Traffic Analysis & Intrusion Detection

Request access and your instructor will set up your account.

Log in