Statistics > Protocol Hierarchy – Content Map
Opening Statistics > Protocol Hierarchy. Wireshark will show the tree of all protocols in capture with percentage traffic distribution. In five seconds, you can see whether there is HTTP (it is possible to transfer files or credentials), whether there are many DNS (hint on DNS tunneling), whether FTP, Telnet, SMTP are found - protocols that drive data in plain text.
Wireshark works with .pcap (packet capture) files, the main format for recording network traffic in CTF. As pointed out by ctf101.org, Protocol Hierarchy helps to quickly detect atypical protocols containing clues or a flag. A protocol with a minimum number of packages, non-standard for the context of the task, is the first candidate for study.
Statistics > Conversations – who is in touch with whom
The second step is Statistics > Conversations. The tab shows all pairs of IP addresses that have exchanged data. Sort by the volume of transmitted bytes: the most “heavy” conversations often contain transmitted files. Sort by number of packages will reveal the scanning of ports or brute-force.
The TCP and UDP tabs show specific ports – this narrows the search. Two hosts sharing data on a non-standard port like 4444 or 8888 are almost certainly what you’re looking for.
Statistics > Endpoints – inventory in 10 seconds
Statistics > Endpoints will show all the unique addresses in the pcap. In CTF forensic tasks usually include 2-5 hosts. If there are hundreds of addresses, you’re more likely to look at a network crawl task, and the approach will be different.
Three instruments together give a full picture in 30-60 seconds. Only then go to the filters.
Wireshark filters for CTF: from basic to murderous
Wireshark filters are the main tool for analyzing traffic when working with ready-made pcap files. For CTF, display filters are used - they are applied to an already recorded dump.
Filters on protocol
The simplest way is to enter the name of the protocol in the filter line:
Filter What shows
http All HTTP traffic
dns DNS Queries and Answers
ftp FTP teams (USER, PASS, RETR)
ftp-data Content of files transferred through FTP
icmp ICMP – ping, traceroute
telnet Telnet sessions (credentials in plain text)
smtp Postal traffic
tcp All TCP
udp All UDP
Filters by addresses and ports
Filter What does
ip.addr == 192.168.1.10 Packages from/to specific IP
ip.src == 10.0.0.1 Only coming from the specified IP
ip.dst == 10.0.0.2 Only included in the specified IP
tcp.port == 80 TCP Port 80 (HTTP)
tcp.port == 443 TCP port 443 (HTTPS)
udp.port == 53 UDP Port 53 (DNS)
Search filters for content – solve 80% of CTF tasks
It is these display filters that separate the one who closes the tack in minutes from the one who leafs out the packages for hours:
Filter Appointment
tcp contains "flag" Search for the “flag” line in TCP payload
frame contains "CTF" Search for “CTF” anywhere in any package
http contains "password" Search “password” in HTTP traffic
dns.qry.name contains "secret" DNS requests with the word “secret” in the name
http.request.method == "POST" Post requests only (forms, file uploads)
http.request.uri contains "upload" Requests with “upload” in URI
data.data contains "50:4b:03:04" Search for ZIP file signatures in payload
Filters are combined through logical operators: && (And) || (OR) ! (NOT). Example: http.request.method == "POST" && frame contains "flag" – will show POST requests containing the line “flag”.
If the flag format is known (e.g. flag{...} or picoCTF{...}), start with frame contains "flag{". Sometimes it grabs the eyes - 10 seconds, and the next tack.
Follow Stream is the main method of analyzing pcap files
Follow Stream is a feature that beginners ignore for some reason, but in vain. It collects all the packages of one TCP/UDP session and shows the dialog in its entirety: the client’s requests are highlighted in red, the server responses are blue. Without it, you see individual fragments of ~1400 bytes, from which to collect a meaningful picture by hand is an activity for masochists.
How to use: choose the package you are interested in, right-click → Follow → TCP Stream (or UDP Stream, HTTP Stream). Wireshark will open the full session content in a separate window.
What to look for in TCP Stream:
Credentials. In unencrypted protocols (HTTP, FTP, Telnet, SMTP), logins and passwords go public. Filter ftp + Follow TCP Stream will show commands USER and PASS – CTF-task classics for network traffic analysis.
Flags in the open. Sometimes the task is trivial – the flag is directly in the HTTP response or in the teach of the text message. Don't make it complicated.
Coded data. Lines in Base64, hex, URL-encoding are frequent reception. See something like ZmxhZ3t... – this is Base64, decode via CyberChef or echo "ZmxhZ3t..." | base64 -d in the terminal.
HTTP headlines. Custom headlines (X-Flag, X-Secret, X-Hidden) is another popular place for hiding data. The authors of the tasks expect that the participants look only at the body of the answer and miss the headlines. Don't get caught.
At the bottom of the Follow Stream window, there is a drop-down list of “Show data as” – switch between ASCII, Hex Dump, Raw for different data types. Flow navigation buttons (right/left arrows) allow you to go through all sessions in pcap one after another – it’s convenient when there are few streams and you want to view each.
In my experience, seven out of ten CTFs of digital traffic tasks are solved through Follow Stream in combination with the correct filter.
Extracting files from pcap: Export Objects and manual method
In CTF, it is often required to pull out a transferred file from the traffic dump - a picture, an archive, a PDF, an executable file. Wireshark can do it out of the box, but not always automatically.
Export Objects – automatically extract files from pcap
Let's move into File > Export Objects and choose the protocol:
Protocol What extracts
HTTP Files via HTTP: images, HTML, JS, archives
SMB Files by SMB/CIFS (Windows network balls)
TFTP Files by TFTP
FTP-DATA FTP files (data, non-teams)
IMF The Internet Message Format
A list of all files with names, MIME types and sizes will appear in the window. Choose the desired one - "Save" or "Save All" for mass export. Works for unencrypted traffic. If in pcap HTTPS - without a decryption key, the files do not extract (sometimes the key is given in the condition of the task - do not miss).
Manual recovery of files from traffic
It happens that the file is transmitted non-standardly - through raw TCP, through a custom protocol or fragments. Then:
Find the flow with the file through Follow TCP Stream.
Switch “Show data as” to “Raw”.
Click "Save as..." and keep raw bytes.
Define the file type by command file exported_data or by signature (magic bytes): 89 50 4E 47 - PNG, 50 4B 03 04 – ZIP, FF D8 FF – JPEG, 25 50 44 46 - PDF.
If there is extra data in the stream (HTTP headers in front of the file body), open the saved file in the hex editor and trim everything before the signature starts.
This technique is directly related to the real practice of DFIR. In MITRE ATT&CK, the transfer of tools over the network is described by Ingress Tool Transfer (T1105, Command and Control) technology – the attackers upload utilities to the compromised host. Data Exfiltration through Unencrypted Protocols – Exfiltration Over Unencrypted Non-C2 Protocol (T1048.003). The skill honed on the CTF will be directly useful in the SOC.
Typical CTF forensics tasks: step-by-step analysis
Four scenarios that are most commonly found in CTF competitions. Each mapping on real-world technique from MITRE ATT&CK is not learning abstractions, but models of real attacks.
HTTP Exfiltration: Flag in POST Request
The script. Pcap contains mixed traffic – DNS, HTTP, a little ICMP. The flag is hidden in the data sent to the attacker's server.
Solution:
Statistics > Protocol Hierarchy – evaluate the share of HTTP.
Filter http.request.method == "POST" – narrow to outgoing data. GET queries usually receive content, POSTs send. If someone leaked the data, it's POST.
Select POST Query → Follow TCP Stream — see the query body. Data in Base64 – decode. Format application/x-www-form-urlencoded – read parameters.
Check the headlines: Content-Type, User-Agent (the atypical UA can be a clue), custom headlines.
In real attacks, the picture is the same: the malware sends stolen data via HTTP POST to the C2 server. In MITRE ATT&CK, it is Web Protocols (T1071.001, Command and Control). Filter http.request.method == "POST" – one of the first reflexes of analytics in the analysis of network incidents.
DNS tunneling: data in subdomains
The script. Pcap looks boring – almost all DNS traffic. But the volume is suspiciously large for ordinary resolves.
Solution:
Filter dns – look at requests.
Pay attention to the subdomains. Instead of normal names like mail.google.com see long lines: dGhpcyBpcyBhIGZsYWc=.evil.com – these are data encoded in Base64 and transmitted through DNS requests.
Filter dns.qry.name contains ".evil.com" (set up a domain from pcap).
We extract the subdomains, glue, decode.
For automation it is more convenient than tshark:
tshark -r capture.pcap -Y "dns.qry.name contains \".evil.com\"" \
-T fields -e dns.qry.name | \
sed 's/\.evil\.com//' | tr -d '\n' | base64 -d
DNS tunneling is a real exfiltration technique: DNS (T1071.004, Command and Control). Attackers use it to bypass firewalls - DNS traffic is rarely blocked completely. Data coding in subdomains corresponds to the Standard Encoding (T1132.001) technique. OWASP attributes the inability to detect such activity as A09:2021 – Security Logging and Monitoring Failures.
FTP: file recovery from traffic dump
The script. The pcap shows an FTP session. You need to recover the transferred file and/or extract credentials.
Solution:
Filter ftp - watch the teams. USER and PASS show the login and password in plain text (yes, in 2025, FTP is still used — and yes, passwords are still flying in their pure form). RETR – downloading the file from the server, STOR – loading to the server.
Filter ftp-data – contents of files (separate flow from commands).
File > Export Objects > FTP-DATA – if Wireshark recognized the transmission.
If the automatic export did not work, Follow TCP Stream on the stream ftp-data, save as Raw and check the file type by magic bytes.
The interception of such data in the real world is Network Sniffing (T1040, Credential Access / Discovery). OWASP classifies transfer without encryption to category A02:2021 — Cryptographic Failures.
ICMP-steganography: data in ping packages
The script. Pcap is full of ICMP Echo Request/Reply. At first glance, it's an ordinary ping, nothing interesting. But take your time with the conclusions.
Solution:
Filter icmp – isolate ICMP packets.
Watch the payload in the Packet Bytes panel. Standard ping contains a pattern abcdefghij... or zeros. ASCII-text, hex-lines or binary data of a non-standard structure is steganography.
We open the level of “Internet Control Message Protocol” in Packet Details, see the “Data” field.
Glue the data from all ICMP packets sequentially.
Automation via tshark:
tshark -r capture.pcap -Y "icmp.type == 8" \
-T fields -e data.data | tr -d ':' | xxd -r -p
The team will pull payload from all ICMP Echo Request (type 8) and convert hex into binary data. Sometimes the data is hidden only in the Request, sometimes only in Reply (type 0), sometimes alternate. Check both options.
Data hiding in legitimate protocols is an Obfuscated Files or Information (T1027, Defense Evasion) technique for MITRE ATT&CK. ICMP tunnels are used by APT groups to bypass DLP systems that do not normally inspect the contents of ping packets. Who's gonna dig into the pings, right?
tshark and NetworkMiner: Automation of Traffic Analysis
tshark – Wireshark without GUI
tshark is a console version of Wireshark with the same protocol disassembly engine. It is irreplaceable when you need to process pcap on SSH without graphics, automate the extraction of data by a script or quickly unload specific fields from thousands of packages.
Key flags: -r файл.pcap (reading the file), -Y "фильтр" (display filter is the same syntax as in GUI) -T fields -e имя.поля (withdrawal of a specific field in text form).
An example is to extract all unique HTTP hosts from pcap:
tshark -r capture.pcap -Y "http.request" \
-T fields -e http.host | sort -u
All wireshark display filters work in tshark one to one. Mastered filters in the graphical interface - tshark gives speed and scripture.
NetworkMiner – an alternative view of pcap
When useful: you got a pcap and want to instantly see all the transferred files and credentials without manually parsing the streams. NetworkMiner will open the pcap and spread the artifacts in seconds. This is not a Wireshark replacement – rather a tool for a quick primary pass.
NetworkMiner is available for Windows (portable version, without installation) and for Linux through Mono: sudo apt install mono-complete, download from netresec.com and launch mono NetworkMiner.exe. The interface is intuitive: open the file, go to the tabs Files, Credentials, Images.
Checklist: Disassembly of traffic dump in Wireshark in 10 minutes
The algorithm that works for most CTFs tasks with pcap files:
Intelligence. Statistics > Protocol Hierarchy What protocols, what dominates, what is atypical.
Participants. Statistics > Conversations Who is with whom, who gave the most data.
Quick search. frame contains "flag" or frame contains "CTF" – sometimes the task closes in 10 seconds.
Filtering on protocol. Start with HTTP, then DNS, then FTP/Telnet/SMTP.
Follow Stream. For each suspicious connection, look for credentials, text, coded strings.
Export Objects. File > Export Objects > HTTP/FTP-DATA – save all files, check each.
Untypical. Big ICMP traffic? Long DNS requests? Non-standard ports? Signal to a detailed analysis.
Decoding. Base64, hex, URL-encoding — CyberChef to help.
NetworkMiner. If found nothing, open the pcap in NetworkMiner for an alternative representation of artifacts.
tshark + grep. If the packages are too many for manual analysis, automate.
Opening Statistics > Protocol Hierarchy. Wireshark will show the tree of all protocols in capture with percentage traffic distribution. In five seconds, you can see whether there is HTTP (it is possible to transfer files or credentials), whether there are many DNS (hint on DNS tunneling), whether FTP, Telnet, SMTP are found - protocols that drive data in plain text.
Wireshark works with .pcap (packet capture) files, the main format for recording network traffic in CTF. As pointed out by ctf101.org, Protocol Hierarchy helps to quickly detect atypical protocols containing clues or a flag. A protocol with a minimum number of packages, non-standard for the context of the task, is the first candidate for study.
Statistics > Conversations – who is in touch with whom
The second step is Statistics > Conversations. The tab shows all pairs of IP addresses that have exchanged data. Sort by the volume of transmitted bytes: the most “heavy” conversations often contain transmitted files. Sort by number of packages will reveal the scanning of ports or brute-force.
The TCP and UDP tabs show specific ports – this narrows the search. Two hosts sharing data on a non-standard port like 4444 or 8888 are almost certainly what you’re looking for.
Statistics > Endpoints – inventory in 10 seconds
Statistics > Endpoints will show all the unique addresses in the pcap. In CTF forensic tasks usually include 2-5 hosts. If there are hundreds of addresses, you’re more likely to look at a network crawl task, and the approach will be different.
Three instruments together give a full picture in 30-60 seconds. Only then go to the filters.
Wireshark filters for CTF: from basic to murderous
Wireshark filters are the main tool for analyzing traffic when working with ready-made pcap files. For CTF, display filters are used - they are applied to an already recorded dump.
Filters on protocol
The simplest way is to enter the name of the protocol in the filter line:
Filter What shows
http All HTTP traffic
dns DNS Queries and Answers
ftp FTP teams (USER, PASS, RETR)
ftp-data Content of files transferred through FTP
icmp ICMP – ping, traceroute
telnet Telnet sessions (credentials in plain text)
smtp Postal traffic
tcp All TCP
udp All UDP
Filters by addresses and ports
Filter What does
ip.addr == 192.168.1.10 Packages from/to specific IP
ip.src == 10.0.0.1 Only coming from the specified IP
ip.dst == 10.0.0.2 Only included in the specified IP
tcp.port == 80 TCP Port 80 (HTTP)
tcp.port == 443 TCP port 443 (HTTPS)
udp.port == 53 UDP Port 53 (DNS)
Search filters for content – solve 80% of CTF tasks
It is these display filters that separate the one who closes the tack in minutes from the one who leafs out the packages for hours:
Filter Appointment
tcp contains "flag" Search for the “flag” line in TCP payload
frame contains "CTF" Search for “CTF” anywhere in any package
http contains "password" Search “password” in HTTP traffic
dns.qry.name contains "secret" DNS requests with the word “secret” in the name
http.request.method == "POST" Post requests only (forms, file uploads)
http.request.uri contains "upload" Requests with “upload” in URI
data.data contains "50:4b:03:04" Search for ZIP file signatures in payload
Filters are combined through logical operators: && (And) || (OR) ! (NOT). Example: http.request.method == "POST" && frame contains "flag" – will show POST requests containing the line “flag”.
If the flag format is known (e.g. flag{...} or picoCTF{...}), start with frame contains "flag{". Sometimes it grabs the eyes - 10 seconds, and the next tack.
Follow Stream is the main method of analyzing pcap files
Follow Stream is a feature that beginners ignore for some reason, but in vain. It collects all the packages of one TCP/UDP session and shows the dialog in its entirety: the client’s requests are highlighted in red, the server responses are blue. Without it, you see individual fragments of ~1400 bytes, from which to collect a meaningful picture by hand is an activity for masochists.
How to use: choose the package you are interested in, right-click → Follow → TCP Stream (or UDP Stream, HTTP Stream). Wireshark will open the full session content in a separate window.
What to look for in TCP Stream:
Credentials. In unencrypted protocols (HTTP, FTP, Telnet, SMTP), logins and passwords go public. Filter ftp + Follow TCP Stream will show commands USER and PASS – CTF-task classics for network traffic analysis.
Flags in the open. Sometimes the task is trivial – the flag is directly in the HTTP response or in the teach of the text message. Don't make it complicated.
Coded data. Lines in Base64, hex, URL-encoding are frequent reception. See something like ZmxhZ3t... – this is Base64, decode via CyberChef or echo "ZmxhZ3t..." | base64 -d in the terminal.
HTTP headlines. Custom headlines (X-Flag, X-Secret, X-Hidden) is another popular place for hiding data. The authors of the tasks expect that the participants look only at the body of the answer and miss the headlines. Don't get caught.
At the bottom of the Follow Stream window, there is a drop-down list of “Show data as” – switch between ASCII, Hex Dump, Raw for different data types. Flow navigation buttons (right/left arrows) allow you to go through all sessions in pcap one after another – it’s convenient when there are few streams and you want to view each.
In my experience, seven out of ten CTFs of digital traffic tasks are solved through Follow Stream in combination with the correct filter.
Extracting files from pcap: Export Objects and manual method
In CTF, it is often required to pull out a transferred file from the traffic dump - a picture, an archive, a PDF, an executable file. Wireshark can do it out of the box, but not always automatically.
Export Objects – automatically extract files from pcap
Let's move into File > Export Objects and choose the protocol:
Protocol What extracts
HTTP Files via HTTP: images, HTML, JS, archives
SMB Files by SMB/CIFS (Windows network balls)
TFTP Files by TFTP
FTP-DATA FTP files (data, non-teams)
IMF The Internet Message Format
A list of all files with names, MIME types and sizes will appear in the window. Choose the desired one - "Save" or "Save All" for mass export. Works for unencrypted traffic. If in pcap HTTPS - without a decryption key, the files do not extract (sometimes the key is given in the condition of the task - do not miss).
Manual recovery of files from traffic
It happens that the file is transmitted non-standardly - through raw TCP, through a custom protocol or fragments. Then:
Find the flow with the file through Follow TCP Stream.
Switch “Show data as” to “Raw”.
Click "Save as..." and keep raw bytes.
Define the file type by command file exported_data or by signature (magic bytes): 89 50 4E 47 - PNG, 50 4B 03 04 – ZIP, FF D8 FF – JPEG, 25 50 44 46 - PDF.
If there is extra data in the stream (HTTP headers in front of the file body), open the saved file in the hex editor and trim everything before the signature starts.
This technique is directly related to the real practice of DFIR. In MITRE ATT&CK, the transfer of tools over the network is described by Ingress Tool Transfer (T1105, Command and Control) technology – the attackers upload utilities to the compromised host. Data Exfiltration through Unencrypted Protocols – Exfiltration Over Unencrypted Non-C2 Protocol (T1048.003). The skill honed on the CTF will be directly useful in the SOC.
Typical CTF forensics tasks: step-by-step analysis
Four scenarios that are most commonly found in CTF competitions. Each mapping on real-world technique from MITRE ATT&CK is not learning abstractions, but models of real attacks.
HTTP Exfiltration: Flag in POST Request
The script. Pcap contains mixed traffic – DNS, HTTP, a little ICMP. The flag is hidden in the data sent to the attacker's server.
Solution:
Statistics > Protocol Hierarchy – evaluate the share of HTTP.
Filter http.request.method == "POST" – narrow to outgoing data. GET queries usually receive content, POSTs send. If someone leaked the data, it's POST.
Select POST Query → Follow TCP Stream — see the query body. Data in Base64 – decode. Format application/x-www-form-urlencoded – read parameters.
Check the headlines: Content-Type, User-Agent (the atypical UA can be a clue), custom headlines.
In real attacks, the picture is the same: the malware sends stolen data via HTTP POST to the C2 server. In MITRE ATT&CK, it is Web Protocols (T1071.001, Command and Control). Filter http.request.method == "POST" – one of the first reflexes of analytics in the analysis of network incidents.
DNS tunneling: data in subdomains
The script. Pcap looks boring – almost all DNS traffic. But the volume is suspiciously large for ordinary resolves.
Solution:
Filter dns – look at requests.
Pay attention to the subdomains. Instead of normal names like mail.google.com see long lines: dGhpcyBpcyBhIGZsYWc=.evil.com – these are data encoded in Base64 and transmitted through DNS requests.
Filter dns.qry.name contains ".evil.com" (set up a domain from pcap).
We extract the subdomains, glue, decode.
For automation it is more convenient than tshark:
tshark -r capture.pcap -Y "dns.qry.name contains \".evil.com\"" \
-T fields -e dns.qry.name | \
sed 's/\.evil\.com//' | tr -d '\n' | base64 -d
DNS tunneling is a real exfiltration technique: DNS (T1071.004, Command and Control). Attackers use it to bypass firewalls - DNS traffic is rarely blocked completely. Data coding in subdomains corresponds to the Standard Encoding (T1132.001) technique. OWASP attributes the inability to detect such activity as A09:2021 – Security Logging and Monitoring Failures.
FTP: file recovery from traffic dump
The script. The pcap shows an FTP session. You need to recover the transferred file and/or extract credentials.
Solution:
Filter ftp - watch the teams. USER and PASS show the login and password in plain text (yes, in 2025, FTP is still used — and yes, passwords are still flying in their pure form). RETR – downloading the file from the server, STOR – loading to the server.
Filter ftp-data – contents of files (separate flow from commands).
File > Export Objects > FTP-DATA – if Wireshark recognized the transmission.
If the automatic export did not work, Follow TCP Stream on the stream ftp-data, save as Raw and check the file type by magic bytes.
The interception of such data in the real world is Network Sniffing (T1040, Credential Access / Discovery). OWASP classifies transfer without encryption to category A02:2021 — Cryptographic Failures.
ICMP-steganography: data in ping packages
The script. Pcap is full of ICMP Echo Request/Reply. At first glance, it's an ordinary ping, nothing interesting. But take your time with the conclusions.
Solution:
Filter icmp – isolate ICMP packets.
Watch the payload in the Packet Bytes panel. Standard ping contains a pattern abcdefghij... or zeros. ASCII-text, hex-lines or binary data of a non-standard structure is steganography.
We open the level of “Internet Control Message Protocol” in Packet Details, see the “Data” field.
Glue the data from all ICMP packets sequentially.
Automation via tshark:
tshark -r capture.pcap -Y "icmp.type == 8" \
-T fields -e data.data | tr -d ':' | xxd -r -p
The team will pull payload from all ICMP Echo Request (type 8) and convert hex into binary data. Sometimes the data is hidden only in the Request, sometimes only in Reply (type 0), sometimes alternate. Check both options.
Data hiding in legitimate protocols is an Obfuscated Files or Information (T1027, Defense Evasion) technique for MITRE ATT&CK. ICMP tunnels are used by APT groups to bypass DLP systems that do not normally inspect the contents of ping packets. Who's gonna dig into the pings, right?
tshark and NetworkMiner: Automation of Traffic Analysis
tshark – Wireshark without GUI
tshark is a console version of Wireshark with the same protocol disassembly engine. It is irreplaceable when you need to process pcap on SSH without graphics, automate the extraction of data by a script or quickly unload specific fields from thousands of packages.
Key flags: -r файл.pcap (reading the file), -Y "фильтр" (display filter is the same syntax as in GUI) -T fields -e имя.поля (withdrawal of a specific field in text form).
An example is to extract all unique HTTP hosts from pcap:
tshark -r capture.pcap -Y "http.request" \
-T fields -e http.host | sort -u
All wireshark display filters work in tshark one to one. Mastered filters in the graphical interface - tshark gives speed and scripture.
NetworkMiner – an alternative view of pcap
When useful: you got a pcap and want to instantly see all the transferred files and credentials without manually parsing the streams. NetworkMiner will open the pcap and spread the artifacts in seconds. This is not a Wireshark replacement – rather a tool for a quick primary pass.
NetworkMiner is available for Windows (portable version, without installation) and for Linux through Mono: sudo apt install mono-complete, download from netresec.com and launch mono NetworkMiner.exe. The interface is intuitive: open the file, go to the tabs Files, Credentials, Images.
Checklist: Disassembly of traffic dump in Wireshark in 10 minutes
The algorithm that works for most CTFs tasks with pcap files:
Intelligence. Statistics > Protocol Hierarchy What protocols, what dominates, what is atypical.
Participants. Statistics > Conversations Who is with whom, who gave the most data.
Quick search. frame contains "flag" or frame contains "CTF" – sometimes the task closes in 10 seconds.
Filtering on protocol. Start with HTTP, then DNS, then FTP/Telnet/SMTP.
Follow Stream. For each suspicious connection, look for credentials, text, coded strings.
Export Objects. File > Export Objects > HTTP/FTP-DATA – save all files, check each.
Untypical. Big ICMP traffic? Long DNS requests? Non-standard ports? Signal to a detailed analysis.
Decoding. Base64, hex, URL-encoding — CyberChef to help.
NetworkMiner. If found nothing, open the pcap in NetworkMiner for an alternative representation of artifacts.
tshark + grep. If the packages are too many for manual analysis, automate.
