Master network protocol reverse engineering including packet analysis, protocol dissection, and custom protocol documentation. Use when analyzing network traffic, understanding proprietary protocols, or debugging network communication.

Protocol Reverse Engineering Comprehensive techniques for capturing, analyzing, and documenting network protocols for security research, interoperability, and debugging. Traffic Capture Wireshark Capture tcpdump Capture Man in the Middle Capture Protocol Analysis Wireshark Analysis tshark Analysis Scapy for Custom Analysis Protocol Identification Common Protocol Signatures Protocol Header Patterns Before binary protocol or encryption analysis, read [parsers, structure identification, and TLS techniques](references/binary encryption analysis.md). Before documenting a protocol or writing a dissector, read [the specification template and Lua example](references/protocol documentation.md). Active Testing Fuzzing with Boofuzz Replay and Modification Best Practices Analysis Workflow 1. Capture traffic : Multiple sessions, different scenarios 2. Identify boundaries : Message start/end markers 3. Map structure : Fixed header, variable payload 4. Identify fields : Compare multiple samples 5. Document format : Create specification 6. Validate understanding : Implement parser/generator 7. Test edge cases : Fuzzing, boundary conditions Common Patterns to Look For Magic numbers/signatures at message start Version fields for compatibility Length fields (often before variable data) Type/opcode fields for message identification Sequence numbers for ordering Checksums/CRCs for integrity Timestamps for timing Session/connection identifiers

protocol-reverse-engineering