Rating:

I automated the search for the faulty sensor:

```python
from scapy.all import *
import struct

machines = []
current = {}

for packet in rdpcap('bacnet.pcap'):
if packet["IP"].src == "10.159.40.200":
continue
if bytes(packet)[56:58] == b"\x19\x4d":
if "name" in current:
machines.append(current)
current = {}
current["name"] = bytes(packet)[62:len(bytes(packet))-1]
elif bytes(packet)[56:58] == b"\x19\x75":
current["units"] = bytes(packet)[59:61]
elif bytes(packet)[56:58] == b"\x19\x55":
current["value"] = struct.unpack('>f', bytes(packet)[60:64])[0]

lists = {}
for m in machines:
if "units" not in m:
continue
if m["units"] not in lists:
lists[m["units"]] = []
lists[m["units"]].append(m)

for x in lists:
print(lists[x][0]["units"], end=" ")
all_values = [m["value"] for m in lists[x]]
print(min(all_values), max(all_values))

print(lists[b"\x91\x13"])
for m in lists[b"\x91\x13"]:
if m["value"] >= 80000:
print(m)
```

Original writeup (https://github.com/apoirrier/CTFs-writeups/blob/master/CSAWQual2021/ics/APainInTheBacnet.md).