The_Silent_Handshake

Our Intrusion Detection System just flagged a massive, anomalous data exfiltration event originating from an internal workstation (10.0.5.23). The attacker flooded an external server (198.51.100.45) with over a million connection attempts in a matter of minutes. We managed to capture the network traffic during the incident. Can you track down and recover the stolen data?

Flag format: IIITL{...}

Hint: The server IP address might be the key to everything.

https://storage.googleapis.com/breach-battle/packet_capture.pcap