C2 traffic, short for command-and-control traffic, is the network communication used by malware to receive instructions from an operator and send back status, stolen data, or system details. It is a key part of many infections because a compromised host is often most dangerous when it can be remotely directed.
In practice, C2 traffic may look like ordinary web requests, DNS lookups, or encrypted HTTPS sessions, which makes it hard to spot by content alone. Defenders look for unusual destinations, repeated beacons, abnormal timing, and connections that do not match normal business behavior. Blocking or detecting C2 traffic can disrupt attacker control, limit lateral movement, and reveal infected devices before damage spreads.