PICOCTF 2019 • FORENSICS • NETWORK UDP STREAMS
Shark on Wire 1: UDP Stream Reassembly & Decoy Trap Filtering
By Abdo•Aug 31, 2026
Official Challenge Prompt
“We found this packet capture. Recover the flag.”
● Category: Network Forensics / PCAP● Points: 150 PTS● Flag Format:
picoCTF{...}Dissector: Wireshark UDP Stream Follow
💡 THE INTUITIVE ANALOGY (The Busy Post Office & The Decoy Letter)
Imagine thousands of letters passing through a mail sorting room. If you follow conversations between specific people (Streams), you find that one conversation has an envelope with a prank label inside saying “Not a Flag”, while another conversation contains the real confidential letter. Following full conversations instead of looking at single packets reveals the real truth!
METHOD A: HANDS-ON WIRESHARK INVESTIGATION
1. Wireshark UDP Stream Follow
| Stream # | Destination Socket | Stream Content | Verdict |
|---|---|---|---|
| Stream 4 | 10.0.0.11:9999 | picopicopicopico | Noise |
| Stream 5 | 10.0.0.12:8888 | picoCTF{StaT31355_636f6e6e} | ✅ Real Flag |
| Stream 6 | 10.0.0.13:8888 | picoCTF{N0t_a_fLag} | ❌ Decoy Trap |
METHOD B: AUTOMATED PYTHON PARSER & ONELINER
2. Automated Extraction Script (`solve.py`)
import scapy.all as scapy
from collections import defaultdict
# Read the PCAP file
packets = scapy.rdpcap('capture.pcap')
streams = defaultdict(bytearray)
# Reassemble UDP stream payloads
for pkt in packets:
if pkt.haslayer(scapy.UDP) and pkt.haslayer(scapy.Raw):
ip = pkt[scapy.IP] if pkt.haslayer(scapy.IP) else None
udp = pkt[scapy.UDP]
if ip:
key = (ip.src, ip.dst, udp.sport, udp.dport)
streams[key] += pkt[scapy.Raw].load
# Search for the real flag
for (src, dst, sport, dport), data in streams.items():
if b'picoCTF' in data:
print(f"[{src}:{sport} -> {dst}:{dport}] {data.decode('utf-8', errors='ignore')}")⚡ Terminal One-Liner (PowerShell / Bash):
tshark -r capture.pcap -Y "udp contains "picoCTF"" -T fields -e text -e data.text | python -c "import sys; print([l.strip() for l in sys.stdin if 'picoCTF' in l])"3. Decoded Flag
Extracted Secret Flag:
picoCTF{StaT31355_636f6e6e}
4. The Complete Investigation Path & Mental Roadmap
STEP 1
PCAP Traffic Triage
Filtered out broadcast SSDP traffic on port 1900 to focus on UDP streams between private endpoints.
STEP 2
Following UDP Streams & Spotting the Trap
Cycled through UDP streams. Rejected Stream 6 (ico{N0t_a_fLag}) as an intentional decoy.
STEP 3
Flag Capture
Recovered the real flag from Stream 5: picoCTF{StaT31355_636f6e6e}.