BSidesCTF easycap challenge
Can you get the flag from the packet capture?
easycap.pcap
Opened the pcap file in Wireshark, noticed that the source IP address 172.31.98.199 was sending data. I applied a filter of that source Ip address and all packets that contained data.
Each packet had an extra byte of data, highlighted above. After combining, these bytes the flag was revealed.