Ports, DNS, HTTP and TLS explained for someone who has to read traffic, not configure it. Layers without memorising them, TCP against UDP by what the evidence looks like, and the five Wireshark filters that resolve most cases. Free, three hours, no networking background assumed.
Free forever. No card, no trial, no expiry.
Preview the student experience
No login · Free interactive demo
2
Guided labs
Isolated VM environment
3h
Of content
Labs + practice + exams + simulations
3
Modules
Progressive difficulty
2–4h
Per lab session
Unlimited restarts
What's includedLab tools you will use
The course is free: every lesson, every module quiz, and the simulated lab in module 2. You need an account, but no card. Two things are paid: the final lab, which boots a real Linux VM with the full capture and the real tools, and the human review of your analysis report. That unlock is 24 €, once.
Only with the 24 € unlock. The certificate depends on an instructor grading and passing your network analysis report, and that review is the paid part. Writing and submitting the report is free — it just sits unreviewed until you unlock it.
None at all. The course assumes you have never configured anything — no router, no firewall, no switch. That is deliberate: it is written for the person who can follow "the malware connects to its C2" without being able to say what a port is.
No, and the boundary is on purpose. This course teaches you to READ traffic. The Network Security path teaches you to build detection on top of it — writing rules, engineering telemetry, defending a network. This one is the prerequisite, not a cheaper version.
3 modules · 3h of content
Each phase maps to a module in this course. Scroll to see how the curriculum builds, module by module.
Module 1
IntroductoryModule 2
IntroductoryModule 3
IntroductoryModule 2's lab hands you four prepared views to practise on. The final lab gives you the whole file: a Linux VM with a fictional organisation's full-day capture, nothing trimmed, and the tools actually used in the trade — Wireshark with its interface, plus tshark, zeek and jq on the command line for what does not fit on a screen. You work top-down rather than packet-first, follow a conversation end to end, read the rhythm off the I/O graph, and pull out what a network team could act on. The three shapes you learned to recognise — a scan, an exfiltration and a beacon — are all in there, mixed into ordinary traffic rather than isolated for you.
Said plainly here so nothing surprises you halfway through the course.
One payment, no subscription. Buying any paid HTK course includes this unlock, so you never pay for it twice.
No marketing screenshots: the three pieces, as they actually look inside.
Your own cloud VM, isolated and yours alone, with the tools already installed. You launch it from the browser whenever you want and it is destroyed when you finish.
Sample of the lab panel. The times shown are illustrative.
You submit your report and an instructor reads it, scores it out of 100 and writes back what you got right and what is missing. It is not an automated grader. The certificate depends on that grade.
Sample grading. The score and comment are illustrative.
Live capture with real traffic: you filter, follow a conversation and separate what is normal from what is not. You practise reading a network the way it is actually read — by narrowing down, not by staring at every packet.
Conversation C-07 · TLS
10.4.2.14 → 91.219.44.8:8443
0 packets
Mean
—
Std dev (σ)
—
Jitter
—
σ = 1.34s. The shaded band is ±1σ — barely a line.
σ = 120s. Bursts while they read, long silences.
It is not that 60 seconds is suspicious. It is that nothing a person does is spaced this evenly.
The real interface of the “Traffic station” simulator. Here it plays by itself; with the unlock you work it yourself.
Complete answers about this course, labs, certificates, and refunds
The course is free: every lesson, every module quiz, and the simulated lab in module 2. You need an account, but no card. Two things are paid: the final lab, which boots a real Linux VM with the full capture and the real tools, and the human review of your analysis report. That unlock is 24 €, once.
Only with the 24 € unlock. The certificate depends on an instructor grading and passing your network analysis report, and that review is the paid part. Writing and submitting the report is free — it just sits unreviewed until you unlock it.
None at all. The course assumes you have never configured anything — no router, no firewall, no switch. That is deliberate: it is written for the person who can follow "the malware connects to its C2" without being able to say what a port is.
No, and the boundary is on purpose. This course teaches you to READ traffic. The Network Security path teaches you to build detection on top of it — writing rules, engineering telemetry, defending a network. This one is the prerequisite, not a cheaper version.
No. Everything runs in the browser, including the lab, which already has Wireshark, tshark, zeek and jq set up. Any computer from the last decade will do.
If you are starting from zero, Introduction to Cybersecurity. If you want to know what the entry-level job looks like, SOC Analyst. Take this one when you notice you are nodding along to sentences about traffic without really following them — which, for most people coming from another sector, happens fairly quickly.
No. Any paid HTK course purchase includes the free courses' labs and assignment reviews.
This course exists to help you choose with some basis instead of guessing. Once you know which side of the field appeals to you, each learning path takes you from beginner to intermediate with the labs to match.
Three hours, no prior knowledge, and a real phishing email to take apart. Create an account and begin.
