Notes on a 2011 network-forensics CTF challenge style
Network-forensics challenges were a fixture of early 2010s CTF competitions, including DEF CON's qualifying rounds, and this note sketches the general shape of that challenge type rather than claiming any specific solution details for a given contest year.
The starting point: a packet capture
A typical network-forensics challenge hands competitors a single .pcap file and asks them to reconstruct some fact about what happened on the wire: which file was transferred, what credential was used, or what a particular protocol exchange actually did. Unlike a binary or web challenge, there is no running target to probe; every answer has to come out of the capture itself.
The standard toolkit
Wireshark remains the default starting tool for inspecting a capture, letting a competitor filter by protocol, follow a TCP or UDP stream as reassembled data, and export any file that was transferred in the clear. Challenges that layered in an extra step, such as a custom protocol, basic obfuscation, or a file hidden inside another file's data, typically still rewarded the same first move: isolate the relevant stream, then work outward from there with a hex editor or scripting rather than guessing.
Why this skill outlasted the competitions
The habits network-forensics challenges built, methodically separating protocol layers, reassembling application data from TCP streams, and treating a capture as the single source of truth rather than relying on assumptions about what should be happening, map directly onto real incident response work, where an analyst often has nothing but a capture or a set of logs and has to reconstruct an intrusion from them.
Takeaway
Whatever the exact puzzle a given year's organisers built, the underlying discipline is the same: read the capture literally, follow the protocol correctly, and resist the temptation to assume content that is not actually present in the bytes.
Key takeaways
- Network-forensics CTF challenges are solved entirely from a packet capture, with no live target to probe.
- Wireshark's stream-following and export features are the standard first move for recovering transferred files.
- Challenges often layer a custom protocol or hidden file on top of an otherwise ordinary capture.
- The analytical habits involved transfer directly to real-world network incident response.
This note has been rewritten and checked for this edition; it is not a copy of the original post.