What Is Network Traffic?
What is it?
Network traffic is the flow of data between computers, broken into small units called packets that travel across the network and are reassembled at the other end.
Why it matters
Almost every attack crosses the network at some point — a download, a callback, an exfiltration. If you can read traffic, you can see the evidence that endpoint logs alone might miss.
Where you see it
You capture traffic from a network tap, a SPAN port, or a host, and read it from a packet capture (a .pcap file) in a packet-analysis workspace.
What normal looks like
Normal traffic is a request followed by a response: a client asks a server for something, and the server answers. Most of it is routine web, DNS and update traffic.
What suspicious looks like
Traffic to a domain nobody recognises, a download of an executable, or a host that keeps talking to the same external address on a fixed rhythm.
How analysts investigate
Start from one packet, identify who is talking to whom, then widen to the whole conversation and ask whether that exchange should be happening at all.
Common beginner mistakes
- Trying to read every packet. A capture has thousands; you filter down to the few that answer your question.
- Assuming traffic is safe because it uses a normal protocol — attackers hide inside DNS and HTTP precisely because they look normal.
When your computer loads a page, sends a message or checks for updates, it does not send one big blob of data. It splits the data into packets, sends them across the network, and the receiver puts them back together. Reading traffic means reading those packets.
Sign in to save your progress on the server.