protocol-reverse-engineering

Analyze network traffic to reverse engineer proprietary protocols and create Wireshark dissectors.

Updated May 16, 2026

Search Tags:#protocol analysis #packet capture #fuzzing #tshark #wireshark #tcpdump #binary parsing

Ready to run

npx skills add https://github.com/p-o-ke-nae/pokemondamagecalculatorforstory --skill protocol-reverse-engineering-p-o-ke-nae

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: protocol-reverse-engineering
Source: https://github.com/p-o-ke-nae/pokemondamagecalculatorforstory/tree/main/.github/skills/protocol-reverse-engineering
Command: npx skills add https://github.com/p-o-ke-nae/pokemondamagecalculatorforstory --skill protocol-reverse-engineering-p-o-ke-nae

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill helps you understand unknown network protocols when packet captures are opaque, documentation is missing, or interoperability and debugging are blocked by binary message formats.

Core Features & Use Cases

Capture traffic with Wireshark, tshark, tcpdump, or mitmproxy.
Identify message structures, fields, signatures, and encryption clues.
Document custom protocols and build dissectors, parsers, or fuzzing targets.
Use case: reverse-engineer a game server protocol from packet captures, then write a Wireshark dissector to inspect live sessions.

Quick Start

Ask this skill to analyze my capture file and help me map the protocol format, key fields, and message flow.

Frequently Asked Questions about protocol-reverse-engineering

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I reverse-engineer a proprietary network protocol from a packet capture?▼

You can reverse-engineer unknown protocols by capturing traffic with tools like Wireshark or tcpdump, then analyzing the binary messages to identify field structures, state machines, and encryption clues for custom dissection.

Can I build a Wireshark dissector for a custom binary protocol?▼

Yes, you can build a Wireshark dissector for custom binary protocols by mapping the message flow and header fields from captured traffic. This allows you to inspect live sessions and parse proprietary TCP/UDP services directly within Wireshark.

How does binary message dissection work on opaque TCP and UDP streams?▼

Binary message dissection on TCP and UDP streams works by reconstructing the captured packets into a continuous flow, then applying structural analysis to identify field boundaries, signatures, and state transitions within the undocumented binary payloads.

Do I need TLS inspection to analyze encrypted traffic in packet captures?▼

TLS inspection is required to analyze encrypted traffic in packet captures. By decrypting the intercepted traffic, you can perform binary message dissection and map the underlying proprietary protocol structures hidden within the secure layer.

What is the best way to identify message structures and signatures in network traffic?▼

The best way to identify message structures and signatures in network traffic is to capture live sessions using tshark or mitmproxy, then systematically isolate payloads to map state machines and document the custom protocol formats.

Can I use packet captures to create fuzzing targets for unknown protocols?▼

Yes, you can use packet captures to create fuzzing targets for unknown protocols. By reverse-engineering the binary message formats and state machines, you can generate structured inputs to test proprietary TCP and UDP services for vulnerabilities.