What problem does it solve? CTF and forensic challenges often hide decisive evidence inside packet order, protocol framing, or stream reassembly rather than a single IOC. This Skill provides a repeatable workflow for turning raw packet captures into reconstructed sessions, decoded protocol messages, and behavior-linked evidence. ## Core Features & Use Cases - Session Mapping: Groups traffic into sessions by endpoints, ports, TLS handshakes, DNS lookups, and long-lived streams while flagging missing coverage or retransmits. - Protocol Decoding: Reassembles TCP streams and UDP conversations, then recovers framing, message order, custom headers, compression, and transferred objects for HTTP, WebSocket, DNS, custom C2, or binary protocols. - Behavior Correlation: Ties decoded packet sequences to host events, malware branches, login flows, uploads, exfiltration steps, or command channels. - Use Case: Given a CTF capture containing a custom C2 channel, rebuild the stream, decode the command messages, extract the transferred artifact, and prove which packet sequence triggered the malware behavior. ## Quick Start After $ctf-sandbox-orchestrator is active, use $competition-pcap-protocol to reconstruct the sessions in this PCAP, decode the application protocol, and tie the packet evidence to the challenge behavior.
