PCAP Network Forensics CTF Writeup: Analyzing Traffic

Network forensics CTF walkthrough using Wireshark and tshark to extract files, follow streams, decrypt TLS, and recover flags from packet captures.

Network forensics challenges give you a packet capture and ask you to reconstruct what happened on the wire. The flag might be sitting in plaintext inside an HTTP request body, encoded across dozens of DNS queries, transferred over FTP, or locked inside a TLS session waiting for you to apply the provided key material. Your job is to approach the capture systematically: understand the traffic landscape first, then drill into the streams and protocols most likely to carry the payload.

Challenge Setup

You receive a file — typically capture.pcap or capture.pcapng — and a brief prompt that may hint at a protocol (“someone was browsing the web”) or say nothing at all. Open it in Wireshark for a visual overview, then switch to tshark for targeted filtering and bulk extraction. Both tools read the same file format, so you can move between them freely as the analysis demands.

Common Wireshark Filters Reference

Protocol Filters

# Show only HTTP traffic
http

# Show only DNS queries and responses
dns

# Show FTP control channel
ftp

# Show FTP data transfers
ftp-data

# Show all TCP traffic
tcp

# Show UDP traffic
udp

# Show ICMP (sometimes used for tunneling)
icmp

Content Search Filters

# Search for literal string in any packet
frame contains "flag{"

# Case-insensitive search (use display filter expression)
frame matches "(?i)flag"

# Search in TCP payload only
tcp contains "flag{"

# Search in HTTP body
http contains "flag{"

# Find packets with specific byte sequence (hex)
frame[0:4] == 89:50:4e:47

IP and Port Filters

# Filter by source IP
ip.src == 192.168.1.100

# Filter by destination IP
ip.dst == 10.0.0.1

# Filter by either direction
ip.addr == 192.168.1.100

# Filter by destination port
tcp.dstport == 80
tcp.dstport == 443
tcp.dstport == 21

# Filter by port in either direction
tcp.port == 4444

# Exclude noise (e.g., remove broadcast traffic)
!arp && !icmp && !dns

Stream and Session Filters

# Filter by TCP stream index (0-based)
tcp.stream eq 0

# Show only packets with data payload
tcp.len > 0

# Show TCP SYN packets (connection initiations)
tcp.flags.syn == 1 && tcp.flags.ack == 0

# Show HTTP redirects
http.response.code == 302

# Show HTTP file uploads
http.request.method == "PUT" || http.request.method == "POST"

TLS and Encryption Filters

# Show TLS handshakes
tls.handshake

# Show ClientHello (reveals SNI / hostname)
tls.handshake.type == 1

# Filter by TLS version
tls.record.version == 0x0303

# Show encrypted application data
tls.record.content_type == 23

# After applying key log: show decrypted HTTP
http && tls