Packet Capture the Flag
summary
Debriefs a live capture taken from a virtual BIG‑IP using TCB dump and analyzed in Wireshark, showing how to filter by TCP stream, extract TLS premaster secrets and use the F5 SSL flag to embed key material into pcaps for decryption. Concrete answers from the sample capture: ARP requests = 5, ICMP echo requests = 7, mDNS queries matching “Elgato key light air” = 13, and 77.1% handled by TMM0 (502 of 651 packets). Practical tips on capture scope, TMM-specific filters and risks of logging reset causes.
AI-written summary · about
chapters (7)
- 0:00Start
- 22:49A - Total arp requests for 10.0.3.100
- 25:44Task 1B - Total ping requests
- 26:40Task 1C - Total MDNS packets with queries for Elgato Key Light Air
- 31:01B - What's the dump capture syntax?
- 35:46Task 9 - How do you decrypt the https traffic to www.nerdlife.local?
- 36:2410.28 - TLS Report
related talks
44mCapture the Flag Wrap Up & Summary
23mCapture The Flag Summary + Wrap UpVirtual
33mWhose Packet Is It Anyway? Life of a Packet Through a Service Mesh
26mNetwork monitoring with FOSS
30mLessons From Defending The Indefensible
04mPcapy and dpkt - tcpdump on steroids
53mWhat is eating my traffic? Packet thieves revealed
33mThe Black Hat Europe NOC Report