competition-pcap-protocol

1# Competition PCAP Protocol
2 
3Use this skill only as a downstream specialization after `$ctf-sandbox-orchestrator` is already active and has established sandbox assumptions, node ownership, and evidence priorities. If that has not happened yet, return to `$ctf-sandbox-orchestrator` first.
4 
5Use this skill when the decisive evidence sits inside packet order, protocol framing, or stream reconstruction rather than a single IOC or host log.
6 
7Reply in Simplified Chinese unless the user explicitly requests English.
8 
9## Quick Start
10 
111. Establish the capture boundaries first: hosts, time span, interfaces, missing packets, retransmits, and stream count.
122. Group traffic into sessions before decoding payload semantics.
133. Record protocol framing, sequence, timing, and transferred artifacts together instead of as isolated packets.
144. Correlate packet evidence with host, malware, or app behavior only after the session is reconstructed.
155. Reproduce the smallest decoded stream or transferred artifact that proves the challenge path.
16 
17## Workflow
18 
19### 1. Build The Session Map
20 
21- Identify endpoints, protocols, ports, TLS handshakes, DNS lookups, websocket upgrades, and long-lived streams.
22- Note missing capture coverage, asymmetric routing, packet loss, or reassembly issues before drawing conclusions.
23- Separate control channels, bulk transfers, keepalives, and noise.
24 
25### 2. Decode The Protocol Boundary
26 
27- Reassemble TCP streams or UDP conversations before interpreting fields.
28…