# Competition Pcap Protocol

Internal downstream skill for ctf-sandbox-orchestrator.

- Repository: https://github.com/zhaoxuya520/reverse-skill (43923 stars)
- Category: Security
- License: MIT
- Last updated: 2026-09-22
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add zhaoxuya520/reverse-skill --skill competition-pcap-protocol -g -a claude-code -y`
Codex: `npx skills add zhaoxuya520/reverse-skill --skill competition-pcap-protocol -g -a codex -y`
Cursor: `npx skills add zhaoxuya520/reverse-skill --skill competition-pcap-protocol -g -a cursor -y`
Gemini CLI: `npx skills add zhaoxuya520/reverse-skill --skill competition-pcap-protocol -g -a gemini-cli -y`

## Description

Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for packet capture analysis, session reconstruction, application-protocol decoding, stream reassembly, beacon timing, and packet-to-process correlation. Use when the user asks to analyze a PCAP, rebuild TCP or UDP sessions, decode HTTP, WebSocket, DNS, custom C2, or binary protocols, extract transferred artifacts, or tie packet sequences to host or malware behavior. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Competition PCAP Protocol

Use this skill only as a downstream specialization after `$ctf-sandbox-orchestrator` is already active and has established sandbox assumptions, node ownership, and evidence priorities. If that has not happened yet, return to `$ctf-sandbox-orchestrator` first.

Use this skill when the decisive evidence sits inside packet order, protocol framing, or stream reconstruction rather than a single IOC or host log.

Reply in Simplified Chinese unless the user explicitly requests English.

## Quick Start

1. Establish the capture boundaries first: hosts, time span, interfaces, missing packets, retransmits, and stream count.
2. Group traffic into sessions before decoding payload semantics.
3. Record protocol framing, sequence, timing, and transferred artifacts together instead of as isolated packets.
4. Correlate packet evidence with host, malware, or app behavior only after the session is reconstructed.
5. Reproduce the smallest decoded stream or transferred artifact that proves the challenge path.

## Workflow

### 1. Build The Session Map

- Identify endpoints, protocols, ports, TLS handshakes, DNS lookups, websocket upgrades, and long-lived streams.
- Note missing capture coverage, asymmetric routing, packet loss, or reassembly issues before drawing conclusions.
- Separate control channels, bulk transfers, keepalives, and noise.

### 2. Decode The Protocol Boundary

- Reassemble TCP streams or UDP conversations before interpreting fields.
- Recover framing, message order, custom headers, binary fields, compression, encryption boundaries, and object transfers.
- Keep payload direction, timing, and session state aligned with each decoded message.

### 3. Tie Packets To Behavior

The rest: https://github.com/zhaoxuya520/reverse-skill/blob/HEAD/CTF-Sandbox-Orchestrator/competition-pcap-protocol/SKILL.md