Lesson pack 9 · Advanced · 90 minutes
Network forensics
Triage a packet capture: find the one conversation that matters, extract transferred files, and spot exfiltration over DNS.
Print this page for a paper plan - the navigation and links drop out.Student-facing version
Before the session
- Nothing to install. Students need a browser and https://ctfpal.com. Confirm the room can reach it once; after that it works offline.
- Read the lesson yourself first - about 6 minutes.
- Have one worked example ready to paste. The classroom link builder on the instructor page turns it into a URL that opens preloaded.
Objectives
Written as things a student can do afterwards, so they can be assessed rather than asserted.
- Use a protocol breakdown to decide where to look first
- Reassemble a TCP stream and read a plaintext protocol
- Extract files transferred over HTTP, FTP, or SMB
- Recognise DNS tunnelling and decode the exfiltrated payload
Running order (90 min)
| Time | What happens |
|---|---|
| 0:00-0:09 | Frame the problemWhat the category looks like when you meet it cold, and why the naive approach fails. |
| 0:09-0:27 | Teach the methodThe technique itself, on the board or from the lesson. No tools open yet. |
| 0:27-0:50 | Demonstrate liveSame technique, in the workspace, on your worked example. Narrate every choice. |
| 0:50-1:21 | Practice setStudents work the challenges. Circulate rather than present. |
| 1:21-1:30 | Checkpoint and wrapCollect the artefact, name what comes next. |
Tools used
- PCAP analyzer for CTF network forensics - Drop a packet capture and extract HTTP objects, DNS queries, credentials, transferred files, and flags - with TLS decryption when you have the keys.https://ctfpal.com/?tool=pcap-analyzer
- Base32 decoder and encoder - Decode Base32 (RFC 4648) to text or bytes, with padding repair. Distinguishes Base32 from Base64 and hex automatically.https://ctfpal.com/?tool=base32-decoder
- Timestamp converter (Unix, ISO, FILETIME, HFS+) - Convert between Unix seconds and milliseconds, ISO 8601, local time, and the non-standard epochs used by Windows, macOS, and Flask.https://ctfpal.com/?tool=timestamp-converter
- Strings extractor for binaries and blobs - Pull printable ASCII and UTF-16 strings out of any file, filtered by length, with flag-pattern highlighting.https://ctfpal.com/?tool=strings-extractor
Reading
- PCAP triage: finding the flag in a hundred thousand packets - 6 min. Network forensics challenges hand you a capture and no question. The triage order that finds the answer fast - protocol hierarchy, conversations, streams - plus the exfiltration channels people actually hide flags in: DNS, ICMP, USB, and TLS you can decrypt.
Practice set
Real picoCTF challenges tagged with this module’s techniques, easiest first. Assign the first three in class and the rest as homework.
- Printer Shares - picoCTF 2026, easy
- Eavesdrop - picoCTF 2022, medium
- FindAndOpen - picoCTF 2023, medium
- Packets Primer - picoCTF 2022, medium
- PcapPoisoning - picoCTF 2023, medium
- Rogue Tower - picoCTF 2026, medium
- shark on wire 1 - picoCTF 2019, medium
- shark on wire 2 - picoCTF 2019, medium
- Silent Stream - picoCTF 2026, medium
- Torrent Analyze - picoCTF 2022, medium
- Trivial Flag Transfer Protocol - picoCTF 2021, medium
- Wireshark doo dooo do doo... - picoCTF 2021, medium
Checkpoint (gradeable)
From a capture, produce the exfiltrated payload and the exact query sequence that carried it.
Deliberately a produced artefact rather than a quiz question: it is either there or it is not, which makes it fast to mark and hard to bluff. Every tool in ctfpal is deterministic, so two students who did the work correctly hand in the same value.
Where the room gets stuck
The habit to build is looking for the anomaly rather than reading the traffic. Ask students what is unusual before asking what it says - the answer is almost always in the outlier.
If you finish early
- Hand out a challenge from the cross-CTF index in this category - each one has published solutions to compare afterwards.
- Run the same input through Identify and let the class argue with the ranking. Disagreeing with a confidence score is where the technique actually lands.
- Ask a student to break their own example - construct an input that defeats the tool, and explain why.