# What is C2 beaconing?

Command-and-control (C2) beaconing is malware checking in with the attacker's server at regular intervals to ask for instructions. On the network it looks like small connections to the same destination every few minutes, day and night, often with a little random jitter added so that it looks less regular. Because it is a pattern in time, it stays visible when the traffic is encrypted. Legitimate software beacons too, such as update agents, monitoring tools and chat applications, so what matters is a new destination, a device that has no reason to need it, or a rhythm that never stops, even at night. NetSenX flags beaconing on every plan, Free included, and explains on the alert which features of the timing and destination drove it.

FAQ: [Attack techniques explained](https://netsenx.com/en/faq/attacks) · https://netsenx.com/en/faq/what-is-c2-beaconing

## Read next

- https://netsenx.com/en/detect-lateral-movement-c2-beaconing
- https://netsenx.com/en/is-someone-inside-your-network

## Related questions

- [What is data exfiltration, and how is it detected?](https://netsenx.com/en/faq/what-is-data-exfiltration)
- [What does living off the land mean?](https://netsenx.com/en/faq/what-is-living-off-the-land)
- [Can a rogue device plugged into our network be detected?](https://netsenx.com/en/faq/can-a-rogue-device-on-our-network-be-detected)
- [What is MITRE ATT&CK?](https://netsenx.com/en/faq/what-is-mitre-attack)
- [What is the difference between a tactic, a technique and a procedure (TTP)?](https://netsenx.com/en/faq/difference-between-a-tactic-a-technique-and-a-procedure)