competition-pcap-protocol

Name: competition-pcap-protocol
Availability: InStock
Author: xjtu-wang

Reconstruct TCP/UDP sessions from PCAP captures and decode HTTP, WebSocket, and DNS protocols.

4|Updated Apr 9, 2026

Search Tags:#forensics #pcap #network-analysis #session-reconstruction #artifact-extraction #protocol-decoding

Ready to run

npx skills add https://github.com/xjtu-wang/DigAgent --skill competition-pcap-protocol

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: competition-pcap-protocol
Source: https://github.com/xjtu-wang/DigAgent/tree/main/.agents/skills/competition-pcap-protocol
Command: npx skills add https://github.com/xjtu-wang/DigAgent --skill competition-pcap-protocol

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This skill helps analysts reconstruct network sessions from PCAP captures, decode application-layer protocols, and tie observed packet sequences to host or malware behavior, enabling precise challenge-solving and evidence linking.

Core Features & Use Cases

Reconstruct TCP/UDP sessions from PCAP files and align related streams for coherent analysis.
Decode common protocols (HTTP, WebSocket, DNS, and custom C2) and map payloads to behavior or artifacts.
Correlate packet-level evidence with host activity and challenge paths after sandbox context is established.
Support downstream orchestration via $ctf-sandbox-orchestrator to ensure environment consistency.

Quick Start

Run this skill after the $ctf-sandbox-orchestrator is active to reconstruct PCAP sessions, decode application protocols, and link packet evidence to the challenge behavior.

Frequently Asked Questions about competition-pcap-protocol

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I reconstruct network sessions from a PCAP file for forensic analysis?▼

You can decode application-layer protocols like HTTP, WebSocket, DNS, and custom C2 streams from PCAP captures by extracting payloads and mapping them to artifact behavior or challenge paths.

Do I need a sandbox environment to analyze packet captures and extract artifacts?▼

Yes, analyzing packet captures requires a sandboxed orchestration context like $ctf-sandbox-orchestrator to establish environment consistency before correlating packet-level evidence with host activity.

How do I decode custom C2 protocols and binary streams in a PCAP capture?▼

To decode custom C2 protocols and binary streams in a PCAP capture, the skill maps application-layer payloads to observed malware behavior and extracts linked artifacts for evidence packaging.

What is the best way to map packet traces to malware behavior during a CTF challenge?▼

The best way to map packet traces to malware behavior is reconstructing session boundaries and timing from PCAP captures, then correlating the decoded protocol evidence with established sandbox host activity.

Can I extract and package evidence from network protocol captures for forensic challenges?▼

Yes, you can extract and package evidence from network protocol captures by decoding application-layer streams, identifying artifacts within the payloads, and linking them to specific challenge behaviors.