> For the complete documentation index, see [llms.txt](https://picoctf2019.haydenhousen.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://picoctf2019.haydenhousen.com/forensics/shark-on-wire-1.md).

# shark on wire 1

## Problem

> We found this packet capture. Recover the flag. You can also find the file in /problems/shark-on-wire-1\_0\_13d709ec13952807e477ba1b5404e620.

* [Packet Capture](https://github.com/HHousen/PicoCTF-2019/tree/24b0981c72638c12f9a8572f81e1abbcf8de306d/Forensics/shark%20on%20wire%201/capture.pcap)

## Solution

1. Open the ".pcap" file in wireshark.
2. Filter for the UDP streams since there was a hint about streams.
3. Apply the filter `udp.stream eq 6` then right-click a packet, select follow, then follow udp.

   ![Follow UDP stream results](/files/-MZKDJw7lTwO3sYA0QIC)

### Flag

`picoCTF{StaT31355_636f6e6e}`