Introduction to Traffic Packet Analysis¶

In CTF competitions, forensic analysis of traffic packets is another important area of examination.

Typically, a PCAP file containing traffic data is provided in competitions. Sometimes contestants are first required to repair or reconstruct the transmitted file before performing analysis.

PCAP is a key area of examination. The complexity lies in the fact that the data packets are filled with a large amount of irrelevant traffic information, so classifying and filtering data is the work that contestants need to complete.

In general, the following steps are involved:

• Overall understanding
  • Protocol hierarchy
  • Endpoint statistics
• Filtering
  • Filter syntax
  • Host, Protocol, contains, characteristic values
• Discovering anomalies
  • Special strings
  • Specific protocol fields
  • Flag located on the server
• Data extraction
  • String extraction
  • File extraction

In general, traffic analysis in competitions can be summarized into the following three directions:

• Traffic packet repair
• Protocol analysis
• Data extraction