# ============================================================
# CTF Challenge: tcpdump Capture Output
# Network: 192.168.1.0/24 (corporate LAN)
# Duration: ~5 minutes of traffic
# Interface: eth0 (promiscuous mode)
# ============================================================
# Capture started: 2026-04-09 09:14:22 UTC
# Command: sudo tcpdump -i eth0 -nn -tttt -v

2026-04-09 09:14:22.103411 IP 192.168.1.50.49812 > 8.8.8.8.53: 12345+ A? www.google.com. (32)
2026-04-09 09:14:22.118903 IP 8.8.8.8.53 > 192.168.1.50.49812: 12345 1/0/0 A 142.250.80.4 (48)
2026-04-09 09:14:22.220187 IP 192.168.1.50.55214 > 142.250.80.4.443: Flags [S], seq 2918374650, win 64240, length 0
2026-04-09 09:14:22.241003 IP 142.250.80.4.443 > 192.168.1.50.55214: Flags [S.], seq 1087263455, ack 2918374651, win 65535, length 0
2026-04-09 09:14:22.241189 IP 192.168.1.50.55214 > 142.250.80.4.443: Flags [.], ack 1, win 64240, length 0
2026-04-09 09:14:23.501772 IP 192.168.1.50.49813 > 8.8.8.8.53: 12346+ A? mail.company-internal.com. (43)
2026-04-09 09:14:23.518201 IP 8.8.8.8.53 > 192.168.1.50.49813: 12346 1/0/0 A 10.0.5.20 (59)
2026-04-09 09:14:24.007311 ARP, Request who-has 192.168.1.1 tell 192.168.1.50, length 28
2026-04-09 09:14:24.008102 ARP, Reply 192.168.1.1 is-at aa:bb:cc:dd:ee:01, length 28

# --- Normal web browsing ---
2026-04-09 09:14:25.112344 IP 192.168.1.105.52100 > 93.184.216.34.80: Flags [S], seq 482917365, win 64240, length 0
2026-04-09 09:14:25.143201 IP 93.184.216.34.80 > 192.168.1.105.52100: Flags [S.], seq 738291045, ack 482917366, win 65535, length 0
2026-04-09 09:14:25.143400 IP 192.168.1.105.52100 > 93.184.216.34.80: Flags [.], ack 1, win 64240, length 0
2026-04-09 09:14:25.144500 IP 192.168.1.105.52100 > 93.184.216.34.80: Flags [P.], seq 1:412, ack 1, win 64240, length 411: HTTP: GET / HTTP/1.1

# --- SUSPICIOUS: DNS query to C2 domain ---
2026-04-09 09:14:30.887201 IP 192.168.1.200.51002 > 8.8.8.8.53: 44781+ A? c2.evil-domain.xyz. (36)
2026-04-09 09:14:30.910445 IP 8.8.8.8.53 > 192.168.1.200.51002: 44781 1/0/0 A 45.33.92.157 (52)
2026-04-09 09:14:31.003211 IP 192.168.1.200.48901 > 45.33.92.157.443: Flags [S], seq 3819274650, win 64240, length 0
2026-04-09 09:14:31.045102 IP 45.33.92.157.443 > 192.168.1.200.48901: Flags [S.], seq 998172635, ack 3819274651, win 65535, length 0

# --- SUSPICIOUS: HTTP credentials in GET parameters ---
2026-04-09 09:14:35.220100 IP 192.168.1.75.60100 > 10.0.5.20.80: Flags [P.], seq 1:287, ack 1, win 64240, length 286: HTTP: GET /login?user=admin&password=Winter2026!&redirect=/dashboard HTTP/1.1
2026-04-09 09:14:35.253001 IP 10.0.5.20.80 > 192.168.1.75.60100: Flags [P.], seq 1:534, ack 287, win 65535, length 533: HTTP: HTTP/1.1 302 Found

# --- Normal DNS traffic ---
2026-04-09 09:14:37.100211 IP 192.168.1.105.49900 > 8.8.8.8.53: 22110+ A? cdn.jsdelivr.net. (34)
2026-04-09 09:14:37.121803 IP 8.8.8.8.53 > 192.168.1.105.49900: 22110 2/0/0 CNAME cdn.jsdelivr.net.cdn.cloudflare.net., A 104.16.88.20 (82)
2026-04-09 09:14:38.500102 IP 192.168.1.105.49901 > 8.8.8.8.53: 22111+ A? fonts.googleapis.com. (38)
2026-04-09 09:14:38.519834 IP 8.8.8.8.53 > 192.168.1.105.49901: 22111 1/0/0 A 216.58.214.10 (54)

# --- ARP SPOOFING ATTEMPT ---
2026-04-09 09:14:40.001200 ARP, Reply 192.168.1.1 is-at de:ad:be:ef:ca:fe, length 28
2026-04-09 09:14:40.001450 ARP, Reply 192.168.1.1 is-at de:ad:be:ef:ca:fe, length 28
2026-04-09 09:14:40.001700 ARP, Reply 192.168.1.1 is-at de:ad:be:ef:ca:fe, length 28
2026-04-09 09:14:40.501300 ARP, Reply 192.168.1.1 is-at de:ad:be:ef:ca:fe, length 28
# NOTE: Gateway MAC changed from aa:bb:cc:dd:ee:01 to de:ad:be:ef:ca:fe — classic ARP poisoning

# --- More normal browsing ---
2026-04-09 09:14:42.300100 IP 192.168.1.50.52200 > 151.101.1.140.443: Flags [S], seq 1928374650, win 64240, length 0
2026-04-09 09:14:42.331201 IP 151.101.1.140.443 > 192.168.1.50.52200: Flags [S.], seq 2871936450, ack 1928374651, win 65535, length 0
2026-04-09 09:14:43.100521 IP 192.168.1.50.49815 > 8.8.8.8.53: 33401+ A? stackoverflow.com. (35)
2026-04-09 09:14:43.122103 IP 8.8.8.8.53 > 192.168.1.50.49815: 33401 1/0/0 A 151.101.1.69 (51)

# --- SUSPICIOUS: ICMP tunnel traffic (oversized packets) ---
2026-04-09 09:14:45.200100 IP 192.168.1.200 > 45.33.92.157: ICMP echo request, id 8192, seq 1, length 1024
2026-04-09 09:14:45.242003 IP 45.33.92.157 > 192.168.1.200: ICMP echo reply, id 8192, seq 1, length 1024
2026-04-09 09:14:46.200500 IP 192.168.1.200 > 45.33.92.157: ICMP echo request, id 8192, seq 2, length 1024
2026-04-09 09:14:46.243100 IP 45.33.92.157 > 192.168.1.200: ICMP echo reply, id 8192, seq 2, length 1024
2026-04-09 09:14:47.201200 IP 192.168.1.200 > 45.33.92.157: ICMP echo request, id 8192, seq 3, length 1024
2026-04-09 09:14:47.244010 IP 45.33.92.157 > 192.168.1.200: ICMP echo reply, id 8192, seq 3, length 1024
2026-04-09 09:14:48.200900 IP 192.168.1.200 > 45.33.92.157: ICMP echo request, id 8192, seq 4, length 1024
2026-04-09 09:14:48.243500 IP 45.33.92.157 > 192.168.1.200: ICMP echo reply, id 8192, seq 4, length 1024
# NOTE: Normal ping payloads are 56 bytes. 1024-byte ICMP payloads suggest covert channel.

# --- SUSPICIOUS: More C2 DNS lookups ---
2026-04-09 09:14:50.100200 IP 192.168.1.200.51003 > 8.8.8.8.53: 44782+ A? update.evil-domain.xyz. (40)
2026-04-09 09:14:50.122100 IP 8.8.8.8.53 > 192.168.1.200.51003: 44782 1/0/0 A 45.33.92.157 (56)
2026-04-09 09:14:51.200100 IP 192.168.1.200.51004 > 8.8.8.8.53: 44783+ A? beacon.evil-domain.xyz. (40)
2026-04-09 09:14:51.221003 IP 8.8.8.8.53 > 192.168.1.200.51004: 44783 1/0/0 A 45.33.92.157 (56)

# --- Normal HTTPS traffic ---
2026-04-09 09:14:53.400100 IP 192.168.1.105.52300 > 140.82.114.3.443: Flags [S], seq 3918274650, win 64240, length 0
2026-04-09 09:14:53.432201 IP 140.82.114.3.443 > 192.168.1.105.52300: Flags [S.], seq 1982736450, ack 3918274651, win 65535, length 0
2026-04-09 09:14:54.100100 IP 192.168.1.105.49902 > 8.8.8.8.53: 55501+ A? github.com. (28)
2026-04-09 09:14:54.118900 IP 8.8.8.8.53 > 192.168.1.105.49902: 55501 1/0/0 A 140.82.114.3 (44)

# --- SUSPICIOUS: HTTP credentials in GET (second instance) ---
2026-04-09 09:14:58.100300 IP 192.168.1.75.60200 > 10.0.5.20.80: Flags [P.], seq 1:310, ack 1, win 64240, length 309: HTTP: GET /api/auth?username=svc_backup&token=eyJhbGciOiJIUzI1NiJ9.eyJ1c2VyIjoiYWRtaW4ifQ.TJVA95OrM7E2cBab30RMHrHDcEfxjoYZgeFONFh7HgQ&action=list HTTP/1.1
2026-04-09 09:14:58.132100 IP 10.0.5.20.80 > 192.168.1.75.60200: Flags [P.], seq 1:1890, ack 310, win 65535, length 1889: HTTP: HTTP/1.1 200 OK

# --- ICMP tunnel continues ---
2026-04-09 09:15:00.200100 IP 192.168.1.200 > 45.33.92.157: ICMP echo request, id 8192, seq 5, length 1024
2026-04-09 09:15:00.242800 IP 45.33.92.157 > 192.168.1.200: ICMP echo reply, id 8192, seq 5, length 1024
2026-04-09 09:15:01.201100 IP 192.168.1.200 > 45.33.92.157: ICMP echo request, id 8192, seq 6, length 1024
2026-04-09 09:15:01.244200 IP 45.33.92.157 > 192.168.1.200: ICMP echo reply, id 8192, seq 6, length 1024

# --- Normal DNS ---
2026-04-09 09:15:03.500100 IP 192.168.1.50.49816 > 8.8.8.8.53: 66701+ A? api.slack.com. (31)
2026-04-09 09:15:03.519201 IP 8.8.8.8.53 > 192.168.1.50.49816: 66701 1/0/0 A 18.164.80.5 (47)
2026-04-09 09:15:04.100200 IP 192.168.1.50.52400 > 18.164.80.5.443: Flags [S], seq 4192837650, win 64240, length 0

# --- ARP spoofing continues ---
2026-04-09 09:15:10.001100 ARP, Reply 192.168.1.1 is-at de:ad:be:ef:ca:fe, length 28
2026-04-09 09:15:10.001350 ARP, Reply 192.168.1.1 is-at de:ad:be:ef:ca:fe, length 28

# --- SUSPICIOUS: DNS to another C2 subdomain ---
2026-04-09 09:15:15.300100 IP 192.168.1.200.51005 > 8.8.8.8.53: 44784+ A? tasks.evil-domain.xyz. (39)
2026-04-09 09:15:15.322200 IP 8.8.8.8.53 > 192.168.1.200.51005: 44784 1/0/0 A 45.33.92.157 (55)
2026-04-09 09:15:16.100100 IP 192.168.1.200.48902 > 45.33.92.157.443: Flags [S], seq 5019283746, win 64240, length 0
2026-04-09 09:15:16.143200 IP 45.33.92.157.443 > 192.168.1.200.48902: Flags [S.], seq 2098173645, ack 5019283747, win 65535, length 0

# --- Normal traffic ---
2026-04-09 09:15:20.100100 IP 192.168.1.50.52500 > 104.16.88.20.443: Flags [S], seq 6192837450, win 64240, length 0
2026-04-09 09:15:20.131200 IP 104.16.88.20.443 > 192.168.1.50.52500: Flags [S.], seq 3091827364, ack 6192837451, win 65535, length 0
2026-04-09 09:15:22.200100 IP 192.168.1.105.49903 > 8.8.8.8.53: 77801+ A? www.wikipedia.org. (35)
2026-04-09 09:15:22.221300 IP 8.8.8.8.53 > 192.168.1.105.49903: 77801 1/0/0 A 208.80.154.224 (51)

# --- ICMP tunnel final burst ---
2026-04-09 09:15:25.200100 IP 192.168.1.200 > 45.33.92.157: ICMP echo request, id 8192, seq 7, length 1024
2026-04-09 09:15:25.243100 IP 45.33.92.157 > 192.168.1.200: ICMP echo reply, id 8192, seq 7, length 1024
2026-04-09 09:15:26.200200 IP 192.168.1.200 > 45.33.92.157: ICMP echo request, id 8192, seq 8, length 1024
2026-04-09 09:15:26.244000 IP 45.33.92.157 > 192.168.1.200: ICMP echo reply, id 8192, seq 8, length 1024