PICOCTF 2019 • FORENSICS • NETWORK UDP STREAMS

Shark on Wire 1: UDP Stream Reassembly & Decoy Trap Filtering

By Abdo•Aug 31, 2026
Shark on Wire 1 Analysis
Official Challenge Prompt

“We found this packet capture. Recover the flag.”

● Category: Network Forensics / PCAP● Points: 150 PTS● Flag Format: picoCTF{...}
Provided File (Download & Practice)Download capture.pcapSize: 239 KB • Packet Capture
Dissector: Wireshark UDP Stream Follow

Network Forensics: UDP Stream Reassembly & Decoy Filtering

In unencrypted UDP traffic captures, individual packet payloads often look like isolated fragments. Using Wireshark's Follow UDP Stream feature reconstructs complete conversations between specific endpoints. In this capture, Stream 0 to 5 contain decoy strings and deceptive flags, while inspecting higher stream indices (specifically UDP Stream 6 between 10.0.0.2 and 10.0.0.12) reconstructs the actual plaintext flag.

METHOD A: HANDS-ON WIRESHARK INVESTIGATION

1. Wireshark UDP Stream Follow

Stream #Destination SocketStream ContentVerdict
Stream 410.0.0.11:9999picopicopicopicoNoise
Stream 510.0.0.12:8888picoCTF{StaT31355_636f6e6e}Real Flag
Stream 610.0.0.13:8888picoCTF{N0t_a_fLag}Decoy Trap
METHOD B: AUTOMATED PYTHON PARSER & ONELINER

2. Automated Extraction Script (`solve.py`)

import scapy.all as scapy
from collections import defaultdict

# Read the PCAP file
packets = scapy.rdpcap('capture.pcap')
streams = defaultdict(bytearray)

# Reassemble UDP stream payloads
for pkt in packets:
    if pkt.haslayer(scapy.UDP) and pkt.haslayer(scapy.Raw):
        ip = pkt[scapy.IP] if pkt.haslayer(scapy.IP) else None
        udp = pkt[scapy.UDP]
        if ip:
            key = (ip.src, ip.dst, udp.sport, udp.dport)
            streams[key] += pkt[scapy.Raw].load

# Search for the real flag
for (src, dst, sport, dport), data in streams.items():
    if b'picoCTF' in data:
        print(f"[{src}:{sport} -> {dst}:{dport}] {data.decode('utf-8', errors='ignore')}")
Terminal One-Liner (PowerShell / Bash):
tshark -r capture.pcap -Y "udp contains "picoCTF"" -T fields -e text -e data.text | python -c "import sys; print([l.strip() for l in sys.stdin if 'picoCTF' in l])"

3. Decoded Flag

Extracted Secret Flag:

picoCTF{StaT31355_636f6e6e}

4. The Complete Investigation Path & Mental Roadmap

STEP 1
PCAP Traffic Triage

Filtered out broadcast SSDP traffic on port 1900 to focus on UDP streams between private endpoints.

STEP 2
Following UDP Streams & Spotting the Trap

Cycled through UDP streams. Rejected Stream 6 (ico{N0t_a_fLag}) as an intentional decoy.

STEP 3
Flag Capture

Recovered the real flag from Stream 5: picoCTF{StaT31355_636f6e6e}.