Protocol Analysis

The TCP/IP stack for CTF

You don’t need to memorise RFCs. You need to recognise which layer a piece of data lives on and how to extract it:

Layer	Protocol	What CTF uses it for
Network	IP	Identifying hosts, TTL anomalies
Transport	TCP / UDP	Port-based filtering, stream reassembly
Application	HTTP, DNS, FTP, SMTP	Credential leaks, data exfiltration, flag transfer

What to look for immediately

Open a PCAP in Wireshark and check:

1. Statistics → Protocol Hierarchy — what protocols are present? Anything unusual?
2. Statistics → Conversations — is one pair of hosts doing most of the traffic?
3. Follow → TCP Stream on the largest conversation — is there readable data?

DNS as a covert channel

DNS exfiltration encodes data in subdomain labels. A request for ZmxhZ3sxMjM0NX0.evil.com carries base64 data before the domain.

tshark -r cap.pcap -Y "dns" -T fields -e dns.qry.name | sort -u
# Look for long, random-looking subdomains

Decode each subdomain:

echo "ZmxhZ3sxMjM0NX0" | base64 -d
# flag{12345}

ICMP covert channels

Large ICMP packets carrying data beyond the normal 32-byte ping payload:

icmp and frame.len > 100

Right-click → Follow → ICMP Stream to reassemble.

FTP and SMTP in the clear

FTP and SMTP transmit credentials and data in plaintext.

# FTP credentials
tshark -r cap.pcap -Y "ftp.request.command == USER or ftp.request.command == PASS" \
  -T fields -e ftp.request.arg

# SMTP email body
tshark -r cap.pcap -Y smtp -T fields -e smtp.req.parameter

Useful Wireshark column tips

Right-click the column header → Column Preferences → add:

• tcp.stream — which stream a packet belongs to
• http.response.code — HTTP status code
• http.request.uri — full URL

These let you sort packets meaningfully without writing display filters.