0145-protocol-reverse-engineering

What problem does it solve?

It helps you understand proprietary or undocumented network protocols by turning raw packet captures into a clear breakdown of message formats, fields, and behavior.

Core Features & Use Cases

• Traffic capture & inspection: Capture network sessions with Wireshark/tshark and tcpdump, then filter streams to isolate relevant request/response patterns.
• Protocol identification & dissection: Detect protocol types using signatures and header patterns, and infer structures like fixed headers, TLV, and length-prefixed messages.
• Decryption & analysis workflows: Use TLS metadata, JA3/JA3S, certificate extraction, and key-log based decryption to reveal application-layer content.
• Documentation & validation: Produce custom protocol specifications and implement parsers/dissectors and test them with replay or fuzzing.

Quick Start

Use the skill’s workflow to capture traffic, apply Wireshark/tshark filters to isolate messages, infer the header and message boundaries, then document the protocol and validate your understanding with a custom parser.