Wireshark interface: three panels for analyzing pcap files
Installation is consciously missed - on Windows is a standard installer with Npcap, on Linux sudo apt install wireshark, on macOS — brew install wireshark. On wireshark.org everything is painted in steps. Let’s move on to what you see by opening the first file. More details in our material about creating ctf tasks.
In CTF, you almost never capture traffic live. The organizers give a ready-made file .pcap or .pcapng - a dump of network traffic. Open through File → Open. Wireshark will show three panels, and they work in a bundle.
Packet List (top panel) is a table with all network packages. Each line is one package: number, time tag, source and destination IP address, protocol, length, brief description. Starting point – here you choose a package for detailed study.
Packet Details (average panel) is a layered structure of the selected package. Wireshark lays the frame by level: channel (Ethernet), network (IP), transport (TCP/UDP), application (HTTP, DNS, FTP). Reveal the level — see specific fields: TCP flags, TTL, User-Agent. In CTF useful information is most often hidden here.
Packet Bytes (bottom panel) – the contents of the package in hex and ASCII. If the text was transmitted in the package, it is visible in the right column. Sometimes the flag is read directly from here – the line flag{...} or CTF{...} in the flow of bytes.
A typical mistake: beginners ignore the middle panel and try to disassemble the hex at the bottom. The middle panel has already disassembled everything for you - instead of counting TCP-header bytes, you see the finished field Destination Port: 80 or Content-Type: text/html. Get used to working with her first.
Pay attention to the color marking of the lines. By default, Wireshark highlights protocols in different colors: green – HTTP, blue – DNS, black with red text – TCP errors. This is not a decoration - the colors allow you to visually separate the types of tcp/ip traffic even before the use of filters. You can see and change the rules through View → Coloring Rules.
More point: the columns in the Packet List are customizable. Right click on the column header → Column Preferences. For CTF, it is useful to add a column with an application layer protocol – distinguish HTTP from DNS faster in the total flow.
Wireshark filters: how not to drown in thousands of packages
Pcap from the CTF can contain tens of thousands of records. Flipping through their hands is a waste of time. Wireshark filters are the main tool that separates the necessary network packets from noise. How to use Wireshark effectively is to be able to quickly assemble the correct filter.
In Wireshark, two types of filters, and confusing them is the second most frequent error after selecting the wrong interface.
Capture filters (capture filters) work before traffic recording begins. BPF Syntax (Berkeley Packet Filter): port 80, host 10.0.0.1, tcp. They determine which Wireshark packets will save at all. In CTF, they are almost unnecessary – you work with a ready-made pcap file, traffic is already recorded.
Display filters (display filters) are applied to the data already downloaded. They hide packages that do not meet the condition, but do not remove them from the file. Display filters have their own syntax, different from BPF. It is wireshark display filters that is your main working tool when analyzing pcap files.
Filter line – at the top of the window, the field “Apply a display filter”. Enter the expression, press Enter. The green color of the line is valid filter. Red is a syntactic error. Here Wireshark does not deceive.
Three mistakes that all come:
One sign = instead of double ==. Filter ip.addr = 10.0.0.1 will light up in red. Right: ip.addr == 10.0.0.1.
BPF syntax in the display string. Write port 80 instead of tcp.port == 80. Different languages are different fields.
The Register. Filter HTTP will not work – write http lowercase.
Filters are combined by logical operators: && (And) || (OR) ! (NOT). For example, http && ip.src == 10.0.0.5 show only HTTP traffic from a particular host. Oh dns && !ip.addr == 8.8.8.8 filters out all DNS queries except going to Google DNS.
Cheat sheet by display filters for CTF
This table should be saved – it covers the vast majority of situations in the CTF networking tacks:
Task Filter What will show
HTTP traffic only http All HTTP requests and answers
HTTP POST requests http.request.method == "POST" Sending forms, downloading files
DNS requests only dns All DNS packages
DNS by domain dns.qry.name contains "example" Requests with specified substring
IP traffic ip.addr == 10.0.0.1 Packages from and to the specified IP
Only from the source ip.src == 10.0.0.1 Outbound traffic from this IP
FTP teams ftp All FTP teams and answers
FTP Passwords ftp.request.command == "PASS" Only lines with password
ARP packs arp All ARP traffic
SYN scanning tcp.flags.syn == 1 && tcp.flags.ack == 0 SYN without ACK (scanning sign)
TCP by port tcp.port == 443 All traffic on port 443
Search for text frame contains "flag" Packages containing the "flag" line
The last filter – frame contains "flag" – it is worth trying first on any CTF. Sometimes the flag is open, and this simple technique saves minutes. It did not work - we turn to the sighting of specific protocols.
Disassembly of HTTP traffic: Follow TCP Stream and export
HTTP is the most frequent protocol in the initial CTF-drags on network traffic analysis. The data is on the open — any text sent via HTTP is visible without decryption.
The algorithm that works on every CTF with HTTP traffic:
Step 1. Open the pcap, put the filter http. Wireshark will only display HTTP packets: GET queries, POST queries, server responses.
Step 2. Watch the Info column in the top panel. Looking for suspicious URLs: /secret, /admin, /flag, /upload. GET-requests to strange endpoints are the first candidates.
Step 3. Right click on suspicious package → Follow → TCP Stream (in new versions – Follow → HTTP Stream). Wireshark will restore the entire dialog: client (red) request and server response (blue) in one text window. The flag often sits in the body of the answer or in the POST request data.
Step 4. If the flag is not visible in the body, check the headlines. The authors of the Tasks like to hide it in non-standard HTTP headlines: X-Flag, X-Secret or even Set-Cookie.
Step 5. For files transferred via HTTP: File → Export Objects → HTTP. Wireshark will show a list of all transferred files - pictures, PDF, archives. Download suspicious and check the content. In the CTF, the flag is often hidden inside a PNG image or a ZIP archive.
Follow TCP Stream is one of the most useful features for disassembling CTF traffic. It collects all network packets of a single TCP connection into a single text thread. Instead of jumping between scattered frames, you read the HTTP dialogue as a regular text. In the Follow TCP Stream window, you can switch coding (ASCII, hex, UTF-8) - try different options if the data looks unreadable.
According to the classification of MITRE ATT&CK HTTP traffic in the open form - Web Protocols technique (T1071.001, Command and Control tactics). Attackers use HTTP to communicate with C2 servers because such traffic merges with legitimate. On CTF, you learn to recognize these patterns: unusual User-Agent, suspicious parameters in URLs, non-standard headlines. In real SOC, this skill is useful daily.
Nuance: If all HTTP traffic in pcap is HTTPS (port 443), the content is encrypted. Without the decryption key it is impossible to read it. In such cases, look for other protocols: DNS, FTP, ICMP. The organizers of the CTF always leave the solution – there are no deadlocks.
DNS and FTP analysis: exfiltration and credentials
DNS-TASKS are the second most popular after HTTP. The DNS protocol transmits data in the open, and the job authors actively use it to hide information.
Classic CTF scenario with DNS: the flag is encoded in subdomains. Host sends a series of queries to domains like ZmxhZ3.evil.com, t0aGVs.evil.com, bG8gd2.evil.com. Each subdomain is a fragment of a string in base64. We collect all the fragments, decode - we get the flag.
This is not the invention of the CTF authors. In real attacks — DNS (T1071.004, Command and Control) technique on MITRE ATT&CK. DNS traffic is rarely blocked on the perimeter, making it a convenient channel for exfiltration. A beautiful fan of the legitimate protocol - and data flow inside.
Step-by-step DNS-Task:
Step 1. Filter dns – see all DNS requests and answers.
Step 2. Studying the Info column. Ordinary requests look like Standard query A google.com. Suspicious – contain long meaningless subdomains or atypical types of records (TXT, NULL, CNAME with abnormal values).
Step 3. Filter on a specific domain: dns.qry.name contains "evil.com".
Step 4. From the middle panel we extract subdomains: reveal DNS → Queries → Name.
Step 5. We collect subdomains and send to CyberChef for decoding.
Another option: the flag in the TXT record of the DNS response. Filter dns.txt will show answers with TXT data — the recording text is visible in the middle panel when the Answers field is opened.
FTP analysis is easier. The protocol transmits logins and passwords in what the mother gave birth to - without encryption. According to MITRE ATT&CK — Exfiltration Over Unencrypted Non-C2 Protocol (T1048.003, tactics Exfiltration).
Filter ftp – see text FTP commands: USER admin, PASS secret123, RETR flag.txt. For a quick search for a password: ftp.request.command == "PASS". Wireshark will show only lines with passwords - you do not need to rummage through the flow of commands with your hands.
The contents of the transferred files go through a separate channel (data connection) on a random port. Filter ftp-data show network packets with file data. Select package → Follow → TCP Stream — see the contents of the file.
ARP spoofing detection in pcap file
ARP-taski checks the ability to detect the attack Adversary-in-the-Middle. According to MITRE ATT&CK – ARP Cache Poisoning (T1557.002, tactics Credential Access and Collection). The attacker sends out fake ARP responses, replacing the MAC address of the gateway with its own. The victim's traffic begins to pass through the attacker's car - the traffic sniffer in action.
How to detect ARP spoofing when analyzing pcap:
Step 1. Filter arp – see all ARP requests and answers.
Step 2. Looking for duplicate IP addresses. If one IP (e.g., gateway 192.168.1.1) is associated with two different MAC addresses in different ARP responses, it is a spoofing. Wireshark when the option is enabled (Edit → Preferences → Protocols → ARP/RARP → Detect duplicate IP address configuration) itself will mark such packages with a warning.
Step 3. We pay attention to the Gratuituous ARP – unsolicited answers. Filter arp.opcode == 2 will show all ARP responses. Answers without a previous request are a classic attack indicator.
Step 4. Determine the attacker. Logic: find an IP with two MAC addresses, see which appeared later - it belongs to the attacker. The CTF is usually asked to specify an attacker’s MAC or victim’s IP.
A typical beginner error in ARP carts is to ignore Wireshark warnings. If the “Duplicate IP address detected” or “IP address incident detected” appears in the Info column, it is not garbage, but a ready response. Wireshark literally shouts to you, “Here it is!” – and you scroll past.
Installation is consciously missed - on Windows is a standard installer with Npcap, on Linux sudo apt install wireshark, on macOS — brew install wireshark. On wireshark.org everything is painted in steps. Let’s move on to what you see by opening the first file. More details in our material about creating ctf tasks.
In CTF, you almost never capture traffic live. The organizers give a ready-made file .pcap or .pcapng - a dump of network traffic. Open through File → Open. Wireshark will show three panels, and they work in a bundle.
Packet List (top panel) is a table with all network packages. Each line is one package: number, time tag, source and destination IP address, protocol, length, brief description. Starting point – here you choose a package for detailed study.
Packet Details (average panel) is a layered structure of the selected package. Wireshark lays the frame by level: channel (Ethernet), network (IP), transport (TCP/UDP), application (HTTP, DNS, FTP). Reveal the level — see specific fields: TCP flags, TTL, User-Agent. In CTF useful information is most often hidden here.
Packet Bytes (bottom panel) – the contents of the package in hex and ASCII. If the text was transmitted in the package, it is visible in the right column. Sometimes the flag is read directly from here – the line flag{...} or CTF{...} in the flow of bytes.
A typical mistake: beginners ignore the middle panel and try to disassemble the hex at the bottom. The middle panel has already disassembled everything for you - instead of counting TCP-header bytes, you see the finished field Destination Port: 80 or Content-Type: text/html. Get used to working with her first.
Pay attention to the color marking of the lines. By default, Wireshark highlights protocols in different colors: green – HTTP, blue – DNS, black with red text – TCP errors. This is not a decoration - the colors allow you to visually separate the types of tcp/ip traffic even before the use of filters. You can see and change the rules through View → Coloring Rules.
More point: the columns in the Packet List are customizable. Right click on the column header → Column Preferences. For CTF, it is useful to add a column with an application layer protocol – distinguish HTTP from DNS faster in the total flow.
Wireshark filters: how not to drown in thousands of packages
Pcap from the CTF can contain tens of thousands of records. Flipping through their hands is a waste of time. Wireshark filters are the main tool that separates the necessary network packets from noise. How to use Wireshark effectively is to be able to quickly assemble the correct filter.
In Wireshark, two types of filters, and confusing them is the second most frequent error after selecting the wrong interface.
Capture filters (capture filters) work before traffic recording begins. BPF Syntax (Berkeley Packet Filter): port 80, host 10.0.0.1, tcp. They determine which Wireshark packets will save at all. In CTF, they are almost unnecessary – you work with a ready-made pcap file, traffic is already recorded.
Display filters (display filters) are applied to the data already downloaded. They hide packages that do not meet the condition, but do not remove them from the file. Display filters have their own syntax, different from BPF. It is wireshark display filters that is your main working tool when analyzing pcap files.
Filter line – at the top of the window, the field “Apply a display filter”. Enter the expression, press Enter. The green color of the line is valid filter. Red is a syntactic error. Here Wireshark does not deceive.
Three mistakes that all come:
One sign = instead of double ==. Filter ip.addr = 10.0.0.1 will light up in red. Right: ip.addr == 10.0.0.1.
BPF syntax in the display string. Write port 80 instead of tcp.port == 80. Different languages are different fields.
The Register. Filter HTTP will not work – write http lowercase.
Filters are combined by logical operators: && (And) || (OR) ! (NOT). For example, http && ip.src == 10.0.0.5 show only HTTP traffic from a particular host. Oh dns && !ip.addr == 8.8.8.8 filters out all DNS queries except going to Google DNS.
Cheat sheet by display filters for CTF
This table should be saved – it covers the vast majority of situations in the CTF networking tacks:
Task Filter What will show
HTTP traffic only http All HTTP requests and answers
HTTP POST requests http.request.method == "POST" Sending forms, downloading files
DNS requests only dns All DNS packages
DNS by domain dns.qry.name contains "example" Requests with specified substring
IP traffic ip.addr == 10.0.0.1 Packages from and to the specified IP
Only from the source ip.src == 10.0.0.1 Outbound traffic from this IP
FTP teams ftp All FTP teams and answers
FTP Passwords ftp.request.command == "PASS" Only lines with password
ARP packs arp All ARP traffic
SYN scanning tcp.flags.syn == 1 && tcp.flags.ack == 0 SYN without ACK (scanning sign)
TCP by port tcp.port == 443 All traffic on port 443
Search for text frame contains "flag" Packages containing the "flag" line
The last filter – frame contains "flag" – it is worth trying first on any CTF. Sometimes the flag is open, and this simple technique saves minutes. It did not work - we turn to the sighting of specific protocols.
Disassembly of HTTP traffic: Follow TCP Stream and export
HTTP is the most frequent protocol in the initial CTF-drags on network traffic analysis. The data is on the open — any text sent via HTTP is visible without decryption.
The algorithm that works on every CTF with HTTP traffic:
Step 1. Open the pcap, put the filter http. Wireshark will only display HTTP packets: GET queries, POST queries, server responses.
Step 2. Watch the Info column in the top panel. Looking for suspicious URLs: /secret, /admin, /flag, /upload. GET-requests to strange endpoints are the first candidates.
Step 3. Right click on suspicious package → Follow → TCP Stream (in new versions – Follow → HTTP Stream). Wireshark will restore the entire dialog: client (red) request and server response (blue) in one text window. The flag often sits in the body of the answer or in the POST request data.
Step 4. If the flag is not visible in the body, check the headlines. The authors of the Tasks like to hide it in non-standard HTTP headlines: X-Flag, X-Secret or even Set-Cookie.
Step 5. For files transferred via HTTP: File → Export Objects → HTTP. Wireshark will show a list of all transferred files - pictures, PDF, archives. Download suspicious and check the content. In the CTF, the flag is often hidden inside a PNG image or a ZIP archive.
Follow TCP Stream is one of the most useful features for disassembling CTF traffic. It collects all network packets of a single TCP connection into a single text thread. Instead of jumping between scattered frames, you read the HTTP dialogue as a regular text. In the Follow TCP Stream window, you can switch coding (ASCII, hex, UTF-8) - try different options if the data looks unreadable.
According to the classification of MITRE ATT&CK HTTP traffic in the open form - Web Protocols technique (T1071.001, Command and Control tactics). Attackers use HTTP to communicate with C2 servers because such traffic merges with legitimate. On CTF, you learn to recognize these patterns: unusual User-Agent, suspicious parameters in URLs, non-standard headlines. In real SOC, this skill is useful daily.
Nuance: If all HTTP traffic in pcap is HTTPS (port 443), the content is encrypted. Without the decryption key it is impossible to read it. In such cases, look for other protocols: DNS, FTP, ICMP. The organizers of the CTF always leave the solution – there are no deadlocks.
DNS and FTP analysis: exfiltration and credentials
DNS-TASKS are the second most popular after HTTP. The DNS protocol transmits data in the open, and the job authors actively use it to hide information.
Classic CTF scenario with DNS: the flag is encoded in subdomains. Host sends a series of queries to domains like ZmxhZ3.evil.com, t0aGVs.evil.com, bG8gd2.evil.com. Each subdomain is a fragment of a string in base64. We collect all the fragments, decode - we get the flag.
This is not the invention of the CTF authors. In real attacks — DNS (T1071.004, Command and Control) technique on MITRE ATT&CK. DNS traffic is rarely blocked on the perimeter, making it a convenient channel for exfiltration. A beautiful fan of the legitimate protocol - and data flow inside.
Step-by-step DNS-Task:
Step 1. Filter dns – see all DNS requests and answers.
Step 2. Studying the Info column. Ordinary requests look like Standard query A google.com. Suspicious – contain long meaningless subdomains or atypical types of records (TXT, NULL, CNAME with abnormal values).
Step 3. Filter on a specific domain: dns.qry.name contains "evil.com".
Step 4. From the middle panel we extract subdomains: reveal DNS → Queries → Name.
Step 5. We collect subdomains and send to CyberChef for decoding.
Another option: the flag in the TXT record of the DNS response. Filter dns.txt will show answers with TXT data — the recording text is visible in the middle panel when the Answers field is opened.
FTP analysis is easier. The protocol transmits logins and passwords in what the mother gave birth to - without encryption. According to MITRE ATT&CK — Exfiltration Over Unencrypted Non-C2 Protocol (T1048.003, tactics Exfiltration).
Filter ftp – see text FTP commands: USER admin, PASS secret123, RETR flag.txt. For a quick search for a password: ftp.request.command == "PASS". Wireshark will show only lines with passwords - you do not need to rummage through the flow of commands with your hands.
The contents of the transferred files go through a separate channel (data connection) on a random port. Filter ftp-data show network packets with file data. Select package → Follow → TCP Stream — see the contents of the file.
ARP spoofing detection in pcap file
ARP-taski checks the ability to detect the attack Adversary-in-the-Middle. According to MITRE ATT&CK – ARP Cache Poisoning (T1557.002, tactics Credential Access and Collection). The attacker sends out fake ARP responses, replacing the MAC address of the gateway with its own. The victim's traffic begins to pass through the attacker's car - the traffic sniffer in action.
How to detect ARP spoofing when analyzing pcap:
Step 1. Filter arp – see all ARP requests and answers.
Step 2. Looking for duplicate IP addresses. If one IP (e.g., gateway 192.168.1.1) is associated with two different MAC addresses in different ARP responses, it is a spoofing. Wireshark when the option is enabled (Edit → Preferences → Protocols → ARP/RARP → Detect duplicate IP address configuration) itself will mark such packages with a warning.
Step 3. We pay attention to the Gratuituous ARP – unsolicited answers. Filter arp.opcode == 2 will show all ARP responses. Answers without a previous request are a classic attack indicator.
Step 4. Determine the attacker. Logic: find an IP with two MAC addresses, see which appeared later - it belongs to the attacker. The CTF is usually asked to specify an attacker’s MAC or victim’s IP.
A typical beginner error in ARP carts is to ignore Wireshark warnings. If the “Duplicate IP address detected” or “IP address incident detected” appears in the Info column, it is not garbage, but a ready response. Wireshark literally shouts to you, “Here it is!” – and you scroll past.
