Keep in mind the more traffic and the longer time you capture traffic, the less easy it may be to analyze the data.A must is of course to understand HTTP, DNS, FTP, and other protocols too since you do not know what kind of protocols the malware may use in case there is any, except that it may be using DNS to resolve the C&C servers.I hope you have a good hint on how to do this, good luck I am an Int