Reverse Engineer Network Protocols

Covers the full workflow for capturing, analyzing, and documenting a network protocol. Traffic capture via Wireshark and tshark (interface capture, filters, file output, and ring-buffer rotation), tcpdump (basic and filtered capture, full-packet capture, real-time hex display), and man-in-the-middle capture via mitmproxy (transparent mode, TLS interception) and Burp Suite (proxy configuration). Protocol analysis with Wireshark display filters and stream following, tshark field extraction and protocol-hierarchy statistics, and Scapy for programmatic pcap reading, filtering, and custom packet crafting. Protocol identification via common signatures and header patterns. Binary protocol analysis covering three common structure patterns - length-prefixed messages, Type-Length-Value (TLV) encoding, and a fixed magic-number header with variable payload - a Python MessageHeader parser using struct.unpack to decode a 12-byte header and walk successive messages by length, a companion TLV field parser, and a hexdump function formatting binary data as offset, hex, and ASCII columns. Encryption analysis via entropy thresholds for distinguishing plaintext, compressed, and encrypted data (below 6.0 likely plaintext, 6.0-7.5 possibly compressed, above 7.5 likely encrypted), TLS metadata extraction with JA3 and JA3S fingerprinting and certificate extraction, and decryption approaches using a browser's pre-master-secret log file configured into Wireshark's TLS preferences, or an RSA private key for key-exchange decryption. Custom protocol documentation via a specification template (Overview, Transport, Message Format, State Machine, Examples) and a Lua Wireshark dissector. Active testing via fuzzing with Boofuzz and replay-and-modification of captured traffic. Closes with an analysis workflow and common patterns to look for.

Use it when capturing and analyzing network traffic for interoperability, debugging a protocol implementation, documenting an undocumented protocol, or conducting authorized security research on a protocol. Skip it for anything unrelated to protocol reverse engineering or outside this scope.

Input is captured or live network traffic and the protocol under investigation; output is a parsed message structure, a protocol specification document, a Wireshark dissector, or a decryption of TLS-protected traffic using an available key or secret log.

Wireshark and tshark for capture and analysis, tcpdump for packet capture, mitmproxy and Burp Suite for MITM interception, Scapy for programmatic packet manipulation, Boofuzz for protocol fuzzing, and JA3 and JA3S for TLS client and server fingerprinting.

Engineers and security researchers reverse-engineering an undocumented protocol for interoperability, debugging, or authorized security research who need concrete capture, parsing, and documentation techniques rather than trial-and-error packet staring.