Heartbeat
Easy 20 ptsTwo hosts are pinging out. One is a normal machine doing keepalives. The other is spelling something out, one packet at a time — the payload of an ICMP echo is arbitrary, and nothing says it has to be filler.
Hints
Open them in order. They nudge, they do not solve.
Hint 1
Filter icmp. Two sources are pinging; separate them with ip.src.
Hint 2
One sends the usual ascending filler. The other's payload is a single character, repeated.
Hint 3
Add icmp.seq as a column, order by it, and read the payloads down the column.
The capture
Forged on this server. Open it in Wireshark, or run
tshark -r heartbeat.pcap.