Master network protocol reverse engineering including packet analysis, protocol dissection, and custom protocol documentation. Use when analyzing network traffic, understanding proprietary protocols, or debugging network communication.

Protocol Reverse Engineering Comprehensive techniques for capturing, analyzing, and documenting network protocols for security research, interoperability, and debugging. Traffic Capture Wireshark Capture tcpdump Capture Man in the Middle Capture Protocol Analysis Wireshark Analysis tshark Analysis Scapy for Custom Analysis Protocol Identification Common Protocol Signatures Protocol Header Patterns Binary Protocol Analysis Structure Identification Python Protocol Parser Hex Dump Analysis Encryption Analysis Identifying Encryption TLS Analysis Decryption Approaches Custom Protocol Documentation Protocol Specification Template [INIT] HELLO [WAIT ACK] HELLO ACK [CONNECTED] DATA/DATA [CLOSED] < CLOSE + Client Server: HELLO (ClientID=0x12345678) Server Client: HELLO ACK (Status=OK) Client Server: DATA (payload) Wireshark Dissector (Lua) Active Testing Fuzzing with Boofuzz Replay and Modification Best Practices Analysis Workflow 1. Capture traffic : Multiple sessions, different scenarios 2. Identify boundaries : Message start/end markers 3. Map structure : Fixed header, variable payload 4. Identify fields : Compare multiple samples 5. Document format : Create specification 6. Validate understanding : Implement parser/generator 7. Test edge cases : Fuzzing, boundary conditions Common Patterns to Look For Magic numbers/signatures at message start Version fields for compatibility Length fields (often before variable data) Type/opcode fields for message identification Sequence numbers for ordering Checksums/CRCs for integrity Timestamps for timing Session/connection identifiers

protocol-reverse-engineering