Use wire shark to find the packets emitted by Curtis's computer. Flag is the mac address, ip address, and the website he is using.
Note: On a public wifi anyone can see these packets. Usually, these are encrypted. However, every now and then you can decrypt the contents. You can also see the packet IP addresses.