Network SecurityLevel 2★★☆☆☆35 pts
Network Analysis - ICMP Data Exfiltration
MissionData was exfiltrated from the internal host 10.20.0.15 to the external host 203.0.113.66 disguised as ping (ICMP echo requests). Download traffic.pcap from the top page and concatenate the data of the echo requests sent to the external host in ICMP sequence-number order to recover the flag.
Hints
Hint 1Show
Use the display filter icmp.type == 8 && ip.dst == 203.0.113.66 to show only the echo requests sent outside
Hint 2Show
Pings to the gateway 10.20.0.1 (data abcdefg...) and the echo replies are decoys
Hint 3Show
The packets are out of order. Concatenate the data fields (up to 6 bytes each; the last one is shorter) in ascending ICMP sequence number
