picoctf/forensics/wireshark_doo_dooo_do_doo/solution.md

Found in tcp stream 5, packet 827 (the first unencrypted stream)

Gur synt vf cvpbPGS{c33xno00_1_f33_h_qrnqorrs}

Seems flaglike, maybe rot13 to protect against text search?

Output from cyberchef:

The flag is picoCTF{p33kab00_1_s33_u_deadbeef}