Tags: pcap wireshark

Rating: 3.8

Open the file in Wireshark.

All you can see is a bunch of SSH connections to and from localhost, nothing strange going on there. There are a total of 248 TCP connections, which would fit 8 bit per ASCII character.

In the "Conversations" tab in Wireshark you can see all TCP connections. Some connections have around ~16 packets from A->B and some have ~44.

![TCP](https://i.imgur.com/YLh2jMy.png)

So after exporting those as a CSV and treating the lower number as "0" and the higher one as "1" we get the following string:


01000001010100110100100101010011011110110110110000110011011101000011010101011111011001110011001101110100010111110
10100110110001101101000011101100111011000110001011001100011011101111001010111110011010001100111011000010011000101
0011100010000101111101

ASIS{l3t5_g3t_Schvv1f7y_4ga1N!}