> For the complete documentation index, see [llms.txt](https://ctf.zeyu2001.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ctf.zeyu2001.com/2021/norzhctf-2021/discovery.md).

# Discovery

## Problem

I feel something tickling me, what is it?

## Solution

The description says that something is "tickling" me. It turns out that this was referring to network tickling. When I connected to the VPN, `tcpdump` showed that `10.35.2.134` is periodically pinging me.

![](/files/-MaRLM2MS3ccdfEAqhX_)

Let's open this in Wireshark to inspect the packet contents. The flag is in the ICMP data.

![](/files/-MaRLPXIzmBMW3nGMbtX)