protocol-reverse-engineering

Analyze captured network traffic into field-level protocol specifications.

Updated Aug 23, 2026

Search Tags:#pcap analysis #wireshark #network protocols #tls decryption #binary parsing #protocol documentation

Ready to run

npx skills add https://github.com/3xecutablefile/opencode-rev-forensics --skill protocol-reverse-engineering-3xecutablefile

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: protocol-reverse-engineering
Source: https://github.com/3xecutablefile/opencode-rev-forensics/tree/main/skills/protocol-reverse-engineering
Command: npx skills add https://github.com/3xecutablefile/opencode-rev-forensics --skill protocol-reverse-engineering-3xecutablefile

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

It turns unknown or proprietary network traffic into a clear protocol model so you can understand message formats, field boundaries, encryption, and session behavior instead of guessing.

Core Features & Use Cases

Traffic capture & replay: Capture packets with Wireshark/tshark or tcpdump, then replay or modify traffic to validate hypotheses during debugging and interoperability work.
Protocol identification & structure mapping: Detect protocol families and infer binary message structure using signatures, header patterns, length/sequence fields, and TLV layouts.
Decryption and documentation: Use TLS key logging and metadata extraction to decrypt where possible, then produce a usable protocol specification and even a dissector/discovery-ready template for future analysis.

Quick Start

Use the attached capture.pcap to identify the protocol message boundaries, infer likely header fields and payload structure, and generate a protocol specification template with testable parser pseudocode.

Frequently Asked Questions about protocol-reverse-engineering

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I reverse engineer a custom binary protocol from a pcap capture?▼

To reverse engineer a custom binary protocol from a pcap, you analyze captured traffic to infer message framing, identify fixed headers and variable payloads, and document field boundaries. This process transforms unknown network traffic into a structured protocol specification.

What is the best way to identify TLV structures and message boundaries in captured network traffic?▼

Identifying TLV structures and message boundaries in captured network traffic involves detecting protocol signatures and analyzing length/sequence fields. This maps binary message structures by matching header patterns to infer the layout of variable payloads.

Can I decrypt TLS sessions in Wireshark to analyze proprietary application protocols?▼

You can decrypt TLS sessions in Wireshark to analyze proprietary application protocols by using TLS key logging. This allows you to extract metadata and inspect the unencrypted payload for undocumented binary formats.

Does protocol reverse engineering work for both TCP and UDP services?▼

Protocol reverse engineering works for both TCP and UDP services by analyzing packet captures from these streams. It supports inferring message framing and field semantics across different transport layers to build a complete protocol model.

How do I generate a protocol specification template from a pcap file?▼

To generate a protocol specification template from a pcap file, you dissect the captured traffic to map field boundaries and infer payload structures. This produces documented output with testable parser pseudocode suitable for implementing dissectors.

What are the limitations when reverse engineering encrypted traffic without TLS keys?▼

When reverse engineering encrypted traffic without TLS keys, the limitation is that payload field semantics cannot be directly inferred. You must rely on entropy analysis and metadata extraction, which prevents generating a complete protocol specification.