What problem does it solve? Analyzing packet captures in CTF and sandbox scenarios often stalls when evidence is scattered across individual packets, fragmented streams, or undecoded custom protocols. This Skill provides a structured workflow for rebuilding sessions, decoding protocol framing, and tying packet sequences to concrete host or malware behavior. ## Core Features & Use Cases - Session Reconstruction: Group traffic into TCP/UDP sessions, identify endpoints, TLS handshakes, DNS lookups, WebSocket upgrades, and long-lived streams before decoding payloads. - Protocol Decoding: Reassemble streams to recover framing, message order, custom headers, binary fields, compression, and transferred artifacts for HTTP, DNS, WebSocket, custom C2, or binary protocols. - Behavior Correlation: Map decoded packet sequences to host events, malware branches, login flows, uploads, exfiltration steps, or command channels. - Use Case: During a CTF challenge, you receive a PCAP containing a covert C2 channel. Use this Skill to rebuild the session, decode the custom framing, extract the transferred payload, and prove which packet sequence triggered the malware's exfiltration branch. ## Quick Start After $ctf-sandbox-orchestrator is active, use $competition-pcap-protocol to reconstruct the sessions in this PCAP, decode the application protocol, and tie the packet evidence to the challenge behavior.
