Finally found the flag (my first challenge "owned’), thanks to the hints here. I spent too much time in wireshark analyzing and not enough trying to actually find the flag. It feels silly now how easy it was.
Side note: Is this challenge worth 30 pts or 3 pts? My profile only says +3, which is disappointing b/c I was psyched to finally be a script kiddie lol.