QA Pro AcademyCybersecurity A-Z
Join free
← Back to catalogue
An analyst at the Tidewater sensor reads the wire: frames flow off a network tap into a capture file, and one frame is peeled layer by layer like nested boxes — the capture record with timestamp and length, the 14-byte Ethernet header with MAC addresses, the 20-byte IPv4 header with addresses and TTL, the 20-byte TCP header with ports, flags and sequence numbers, and the application payload such as HTTP, DNS and the TLS server name. Beside it, spotting the abnormal: irregular human browsing against a beacon calling one destination on a timer, display filters narrowing hundreds of thousands of frames to the handful that answer the question, and a reproducible read-out.
CY-MID-036Mid Level · Network Security

Network Traffic Analysis — Reading the Wire

A deeply technical, hands-on mid-level course that reads network traffic at the byte and protocol level. Peel each frame apart on the packet dissector — Ethernet, IP, TCP/UDP, and the application payload — and learn to find, follow, and interpret the packets that matter, from real capture files with real tcpdump and tshark syntax. Four hands-on activities in every lesson.

16 hours8 chapters40 lessons265 activities8 labs

What you'll learn

  • Open a capture and peel a frame apart by encapsulation, reading each layer's fields from the bytes.
  • Read Ethernet, IP, ARP, and a full TCP conversation by sequence and acknowledgment numbers.
  • Read UDP services (DNS, DHCP), HTTP in the clear, and what TLS hides and reveals.
  • Write precise tcpdump/tshark filters and recognise scan, beacon, exfiltration, and spoofing signatures.
Price:৳8,000
Sign in to get access

Sign in to enrol — you can pay by bKash or Nagad, or apply a promo code.