shark on wire 1 picoCTF 2019 Solution

Description

1. Step 1Filter to the relevant UDP stream

   Observation

   The challenge is a bare packet capture with no other hints. Wireshark's Follow Stream on the UDP traffic is the way to find which conversation is hiding the flag.

   Apply the Wireshark display filter 'udp.stream eq 6' to isolate the stream carrying the flag. Then right-click any packet in that stream and select Follow > UDP Stream to view the reassembled payload as ASCII text.

   bash

   wireshark capture.pcap

   Copied!

   What didn't work first

   Tried: Follow TCP Stream instead of UDP Stream after filtering for all traffic

   The flag travels over UDP, not TCP. Following a TCP stream shows HTTP and other TCP payloads but never the flag. Use 'udp.stream eq 6' to isolate the right datagram conversation, then Follow > UDP Stream.

   Tried: Try stream numbers other than 6 (such as stream 0, 1, or 2) hoping the flag is in the first conversation

   Wireshark numbers streams in the order it first sees each IP:port 4-tuple, so in a crafted capture the first stream is rarely the interesting one. Stream 6 holds the flag conversation. When you do not know the index, stepping through 'udp.stream eq N' is the reliable way to find it.

   Learn more

   Wireshark is the industry-standard network packet analyzer. It can open .pcap (packet capture) files recorded by tools like tcpdump, Wireshark itself, or network taps. A pcap file stores every packet seen on a network interface at a given time, including all Ethernet frames, IP headers, and application payloads.

   Display filters in Wireshark let you narrow millions of packets to only what matters. The filter udp.stream eq 6 works because Wireshark automatically assigns each unique UDP "conversation" (same source IP:port and destination IP:port pair) a stream index. Stream 6 isolates one particular back-and-forth exchange. Common display filter patterns include:

   • tcp.stream eq N - isolate a single TCP connection
   • http - show only HTTP traffic
   • ip.addr == 192.168.1.1 - filter by IP address
   • dns - show only DNS queries and responses

   Follow Stream (right-click any packet in a stream) reassembles all the payload bytes in order and displays them as text or hex - exactly as the application layer saw them. For UDP this is especially useful because UDP is connectionless, so Wireshark reconstructs the conversation purely by matching IP/port tuples. In CTF challenges, the flag is often sent in plaintext across a specific stream, making this one of the most common forensics techniques used.

2. Step 2Read the flag from the stream

   Observation

   With 'udp.stream eq 6' applied, the Follow UDP Stream dialog reassembles every payload byte in order. The flag is plaintext, so it should appear in that output with no decoding.

   The Follow UDP Stream dialog displays the raw payload as text. The flag appears directly in the stream output.

   Learn more

   UDP (User Datagram Protocol) is a connectionless transport protocol - unlike TCP, there is no handshake, no guaranteed delivery, and no ordering. Each UDP datagram is independent. Despite this, Wireshark can still group related datagrams into a "stream" by tracking which packets share the same 4-tuple (source IP, source port, destination IP, destination port).

   Because UDP has no built-in encryption or authentication, any data sent over it is fully visible in a packet capture. This is why protocols like DNS (historically), TFTP, and many game network protocols have historically been vulnerable to eavesdropping - all traffic is readable by anyone on the same network segment or with access to a tap.

   In real-world forensics and incident response, analysts use pcap analysis to reconstruct what happened during an attack or data exfiltration. Tools like tshark (the command-line version of Wireshark) allow scripted analysis: tshark -r capture.pcap -Y "udp.stream eq 6" -T fields -e data.text extracts payload text without opening a GUI.

Flag

UDP streams in Wireshark can be followed just like TCP streams - filtering to a specific stream number isolates one conversation's data.