# Packets Primer

## Description
Download the packet capture file and use packet analysis software to find the flag.
- [Download packet capture](https://artifacts.picoctf.net/c/204/network-dump.flag.pcap)

## Solving

1. We got a pcap file... lets look into it...
1. First lets check for low hanging fruits... with `strings` - ah there is the flag :-)
1. The flag is in plainsight!
1. Just remove the whitespaces
1. You can use `tr -d ' '` to remove the whitespaces

```bash
#!/bin/bash

echo "Getting flag from pcap file..."

strings network-dump.flag.pcap | grep "p i c o"| tr -d ' '
```

Original writeup (https://www.it-sec.fail/picoctf-2022-forensics-packets-primer/).