You can think of tshark as the command-line version of the Wireshark program. Retransmissions / duplicate ACKs / zero windows - & !_update.Some of the below might be a good starting point: For example, we can search for the string flag in all TCP traffic with the following filter:Ībnormal TCP parameters can also be something worth looking into. We can also just try searching different raw traffic for flag-related text. Note that this technique is not a 100% surefire method of extracting every file, as some files may have been transferred in non-standard ways that Wireshark is not innately privy to. The same can be done for SMB-transferred files via the File -> Export Objects -> SMB option. Files transferred via HTTP can be extracted from a PCAP in Wireshark via the File -> Export Objects -> HTTP option. Occasionally, a PCAP challenge is only meant to involve pulling out a transferred file (via a protocol like HTTP or SMB) from the PCAP and doing some further analysis on that file. Sometimes you do not need to do much work to find a flag, and can take some shortcuts to save time. You can also exclude other traffic that isn't super interesting at first glance (like ARP) via the Apply as Filter -> Not Selected option.

To start looking at a specific category of traffic identified in the protocol hierarchy, richt click the desired category and click Apply as Filter -> Selected.

For example, if you have a PCAP full of HTTPS traffic, but see a few packets of FTP data, you should probably start by looking at the FTP data. This will show you a distribution of the different protocols present within the PCAP.įollowing our goal of finding the needle in the hay stack, this is a great way to identify some low-frequency protocols for examination. You first step should be to look at the protocol hierarchy analysis, which can be done by selecting Statistics -> Protocol Hierarchy from the toolbar menu. Sudo apt-get install -y wireshark tshark Scoping out a PCAP Sudo yum install -y wireshark wireshark-gnome

Pcap analysis tools