Wireshark interface: what a beginner sees when opening PCAP
Before you understand the techniques, you need to understand what to look at. Opening a PCAP file (File → Open or just drag and drop into the program window) - there are three panels in front of you. More information in our material about creating ctf tasks.
Packet List is the top of the window. Each line is a separate network package. Default columns: package number, time tag, source IP address (Source), destination IP address (Destination), protocol, length and short description (Info). On this panel you navigate first – you are looking for the necessary protocols, suspicious addresses, unusual descriptions in the Info column.
Packet Details is the middle part. The selected package is divided into network model levels: Ethernet-header (channel level), IP-header (network), TCP or UDP (transport), application protocol (HTTP, FTP, DNS). Open each level with an arrow click – inside are specific fields: TCP flags, HTTP header values, DNS query contents. On the CTF, there are often hiding credentials and flag fragments.
Packet Bytes is the bottom. Raw packet data in hex and text (ASCII) view. Sometimes the flag is hidden in a non-standard package location, where Wireshark does not disassemble the structure automatically – then look here directly and read the ASCII column on the right.
Critically important is the filter string at the top of the window - it allows you to cut off noise among thousands of packets. The green color of the line background is the correct filter, the red is a syntactic error. Another detail that beginners miss: color marking of lines in Packet List. By default, Wireshark highlights protocols in different colors – green strings for HTTP, dark blue for DNS, black with red text for packets with errors. Colors help to quickly navigate the traffic even before using the filter.
Wireshark Filters for CTF: a working set for beginners
Without filters, the pcap file analysis turns into a meaningless scroll of the list. There are a dozen filters on the CTF-tass to close the vast majority of tasks:
Filter What does When to need on CTF
http All HTTP traffic The first step on any dump with web traffic
http.request.method == "POST" Only POST requests Search for sent forms with logins
ftp All FTP traffic Logins and passwords fly in open text
ftp.request.command == "PASS" Only commands with FTP password Point search for password
ftp.request.command == "USER" Only commands with FTP login Username
dns All DNS traffic Suspicious domains, exfiltration
tcp.port == 23 Traffic on the port of Telnet Telnet transmits data without encryption
ip.addr == 192.168.1.100 Packages from/to specific IP Insulation of traffic of one host
frame contains "flag" Packages with line "flag" A rough but working flag search
tcp.stream eq 3 Specific TCP-stream Isolation of one session
Display filters are entered into the filter bar at the top of the window - they are needed when working with the finished PCAP. Capture filters are used to record real-time traffic and have a different syntax – they will not be needed on CTFs.
Filters are combined through logical operators: && (And) || (OR) ! (NOT). Example: http && ip.src == 10.0.0.5 show HTTP traffic only from a specific address. Combination dns && !dns.qry.type == 1 filters out DNS queries of all types except standard A-records — useful for finding DNS tunneling, where data is transmitted via TXT or CNAME queries.
Search for strings in packages: frame cetas and alternatives
Filter frame contains deserves a separate analysis. He searches for an arbitrary string in the raw packet data — headlines and payloads at the same time. On CTF this is often the fastest way to find the answer:
frame contains "flag{" – typical CTF flag format
frame contains "password" – password line anywhere in the package
frame contains "secret" – similar for secrets
tcp contains "login" – search only in TCP-payload, without lower level headers
Filter registered. If the flag format is unknown, try options: frame contains "FLAG", frame contains "ctf", frame contains "key". As the authors of PacketSafari, filter frame contains "flag" – starting point for tasks to find hidden data in network traffic.
Alternative path – Edit menu → Find Packet (Ctrl+F). Here you can choose a search by line, hex-value or regular expression. The "Case in sensitive" checkmark solves the problem of an unknown register. This method is more convenient than a filter when you do not know the exact writing of the desired.
Before you understand the techniques, you need to understand what to look at. Opening a PCAP file (File → Open or just drag and drop into the program window) - there are three panels in front of you. More information in our material about creating ctf tasks.
Packet List is the top of the window. Each line is a separate network package. Default columns: package number, time tag, source IP address (Source), destination IP address (Destination), protocol, length and short description (Info). On this panel you navigate first – you are looking for the necessary protocols, suspicious addresses, unusual descriptions in the Info column.
Packet Details is the middle part. The selected package is divided into network model levels: Ethernet-header (channel level), IP-header (network), TCP or UDP (transport), application protocol (HTTP, FTP, DNS). Open each level with an arrow click – inside are specific fields: TCP flags, HTTP header values, DNS query contents. On the CTF, there are often hiding credentials and flag fragments.
Packet Bytes is the bottom. Raw packet data in hex and text (ASCII) view. Sometimes the flag is hidden in a non-standard package location, where Wireshark does not disassemble the structure automatically – then look here directly and read the ASCII column on the right.
Critically important is the filter string at the top of the window - it allows you to cut off noise among thousands of packets. The green color of the line background is the correct filter, the red is a syntactic error. Another detail that beginners miss: color marking of lines in Packet List. By default, Wireshark highlights protocols in different colors – green strings for HTTP, dark blue for DNS, black with red text for packets with errors. Colors help to quickly navigate the traffic even before using the filter.
Wireshark Filters for CTF: a working set for beginners
Without filters, the pcap file analysis turns into a meaningless scroll of the list. There are a dozen filters on the CTF-tass to close the vast majority of tasks:
Filter What does When to need on CTF
http All HTTP traffic The first step on any dump with web traffic
http.request.method == "POST" Only POST requests Search for sent forms with logins
ftp All FTP traffic Logins and passwords fly in open text
ftp.request.command == "PASS" Only commands with FTP password Point search for password
ftp.request.command == "USER" Only commands with FTP login Username
dns All DNS traffic Suspicious domains, exfiltration
tcp.port == 23 Traffic on the port of Telnet Telnet transmits data without encryption
ip.addr == 192.168.1.100 Packages from/to specific IP Insulation of traffic of one host
frame contains "flag" Packages with line "flag" A rough but working flag search
tcp.stream eq 3 Specific TCP-stream Isolation of one session
Display filters are entered into the filter bar at the top of the window - they are needed when working with the finished PCAP. Capture filters are used to record real-time traffic and have a different syntax – they will not be needed on CTFs.
Filters are combined through logical operators: && (And) || (OR) ! (NOT). Example: http && ip.src == 10.0.0.5 show HTTP traffic only from a specific address. Combination dns && !dns.qry.type == 1 filters out DNS queries of all types except standard A-records — useful for finding DNS tunneling, where data is transmitted via TXT or CNAME queries.
Search for strings in packages: frame cetas and alternatives
Filter frame contains deserves a separate analysis. He searches for an arbitrary string in the raw packet data — headlines and payloads at the same time. On CTF this is often the fastest way to find the answer:
frame contains "flag{" – typical CTF flag format
frame contains "password" – password line anywhere in the package
frame contains "secret" – similar for secrets
tcp contains "login" – search only in TCP-payload, without lower level headers
Filter registered. If the flag format is unknown, try options: frame contains "FLAG", frame contains "ctf", frame contains "key". As the authors of PacketSafari, filter frame contains "flag" – starting point for tasks to find hidden data in network traffic.
Alternative path – Edit menu → Find Packet (Ctrl+F). Here you can choose a search by line, hex-value or regular expression. The "Case in sensitive" checkmark solves the problem of an unknown register. This method is more convenient than a filter when you do not know the exact writing of the desired.
