PACKETDUEL

The duel

Two players, one small online retailer. Red wants the Customer Records out of the building. Blue has to stop that for 8 rounds without breaking the business.

Red wins by finishing an Extract, or if Blue’s average Uptime ends below 60. Blue wins by reaching the end of round 8 with the records safe and Uptime at 60 or above. Round 8 counts triple in that average.

A round

Both sides plan at the same time and in secret. Pick a move, then pick its target on the map or in the list: it is queued straight away. You can queue up to 6 moves if you can pay for them, reorder them, or remove one.

Press Lock in when you are done. The round resolves when both players lock in. Rooms are untimed by default, so take your time; in a timed room the round also resolves when the clock runs out, and anything left unlocked still counts.

Resolution order: Blue’s emergency moves (Quarantine, Seal, Reopen) happen first, then Red’s moves in your queued order, then Blue’s other moves. Results land in the feed.

Hidden information

Red starts nearly blind: only the public systems are on its map, and new systems and links appear as Red explores. Weaknesses Red finds are listed under Intel.

Blue sees the whole network but not the intruder. Blue only learns about Red through alerts and log lines, and some of those are ordinary business activity.

Moves fail for a reason that exists on the board (a patched flaw, a cut link, an account that needs MFA). The reveal after the match shows which.

Unlocking moves

You do not start with every move. Moves come in tiers, shown above the move grid. A tier opens the first time you reach its milestone and stays open for the rest of the match. Locked moves show a 🔒 and say what opens them.

Red: Recon (Sweep, Inspect, Hush) is open from the start. Scouting any system opens Access (Breach, Unlock, Forge). Your first foothold opens Inside (Chart, Pivot, Elevate, Decoy). Charting a system you hold opens Objective (Gather, Extract).

Blue: Assess (Analyze, Audit, Sensors, Narrow, Reopen and request answers) is open from the start. Investigating any system opens Respond (Fortify, Rekey, Quarantine, Seal, Purge).

On top of tiers, you have to understand a target before you act on it. Red needs a known weakness to Breach, a scouted Identity to Unlock, and a Chart of a system to Elevate there. Blue needs to have investigated a system (Analyze it or one of its alerts, or Audit an unknown there) before it can Fortify, Quarantine or Seal it, and needs a confirmed attack before it can Rekey.

A milestone reached earlier in the same round counts, because moves resolve in order.

Words you will see

Foothold

Red has a presence on a system. Admin is a stronger foothold that can read data stored there.

Staged

Red has copied the records onto that system with Gather and can now Extract from it.

Logging

None, Partial or Full. Decides whether Red’s moves on that system show up for Blue, and how clearly.

Noise band

Low, medium or high. Both sides see it. High noise means Red’s next loud move will very likely be spotted.

Uptime

Weighted share of business functions running this round. Blue needs the average at 60 or more.

Forged request

A fake stakeholder request Red planted with Forge. It looks real but has small tells. Approving it gives Red a staff account; Verify exposes it.

Instant

Blue emergency moves resolve before Red acts this round.

Two rounds

Extract and Fortify take this round and the next to finish.