Network forensics CTF challenges almost always start the same way: you're handed a .pcap file — a raw recording of network traffic — and told a flag passed through it somewhere. Wireshark is the tool for reading that recording back: it decodes every packet into its protocol layers and lets you filter, search, and reconstruct the actual data that was sent.
1. Open the capture and get oriented
Open the .pcap in Wireshark and check Statistics → Protocol Hierarchy first — it breaks down what's actually in the capture (HTTP, DNS, FTP, raw TCP) before you start digging packet by packet. A capture that's mostly HTTP points you toward a different technique than one that's mostly DNS.
2. Filter out the noise
Real captures are full of irrelevant traffic — ARP broadcasts, TCP handshakes, background chatter. Wireshark's display filter bar cuts straight to what matters:
http
dns
tcp.port == 21
ip.addr == 10.0.0.5Start broad (filter to just the protocol you saw in Protocol Hierarchy) and narrow from there. If you already know the flag format, filtering directly for it across the whole capture is often the fastest path of all:
frame contains "flag{"3. Follow the stream
Right-click any packet and choose Follow → TCP Stream (or HTTP/UDP Stream, as appropriate) to reassemble the full back-and-forth conversation that packet belongs to, rather than reading it one fragment at a time. This is where credentials sent in the clear, a flag sent over plain HTTP, or a full file transfer usually becomes readable as one continuous block instead of scattered packets.
4. Export embedded files
When the capture includes a file transfer — an image over HTTP, a document over FTP — File → Export Objects (choose the matching protocol) lists every file Wireshark reconstructed from the stream and lets you save it directly, skipping manual reassembly entirely:
File → Export Objects → HTTP…Wrapping up
Get oriented with Protocol Hierarchy, filter down to the relevant traffic, follow the full stream instead of reading isolated packets, and use Export Objects when a whole file is what you're after. That covers the large majority of CTF network forensics challenges. See the Getting Started with CTF guide for where this fits alongside other forensics tools, and check writeups for full walkthroughs.