search_patterns
Search Wireshark capture data for CTF flags (flag{...}) and custom regex patterns to uncover hidden clues during network analysis.
Instructions
【CTF必备】Search for patterns including CTF flags (flag{...}, CTF{...}) and custom regex. Use this when: 1) User asks to find flag, 2) User wants to search for specific patterns in traffic, 3) After following a TCP stream to search its content.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| session_id | Yes | ID of the session | |
| data_source | No | Data source: tcp_streams, http_body, or raw_packet | tcp_streams |
| search_flag | No | Search for CTF flag patterns | |
| stream_index | No | Optional TCP stream index (for tcp_streams/http_body) | |
| custom_pattern | No | Custom regex pattern to search |