Agent skill · research science · wshobson
protocol-reverse-engineering
Master network protocol reverse engineering including packet analysis, protocol dissection, and custom protocol documentation. Use when analyzing network traffic, understanding proprietary protocols, or debugging network communication.
Why this skill is useful
Adds executable scripts for capturing and analyzing network traffic that extend the AI's capabilities in protocol reverse engineering.
What it needs
Requires burp-suite, mitmproxy, scapy, tcpdump, tshark, wireshark installed locally. About 7k tokens when loaded. Last updated 2026-08-05. 38,570 stars on the source repository.
What this skill does
Protocol Reverse Engineering Comprehensive techniques for capturing, analyzing, and documenting network protocols for security research, interoperability, and debugging. Traffic Capture Wireshark Capture tcpdump Capture Man-in-the-Middle Capture Protocol Analysis Wireshark Analysis tshark Analysis Scapy for Custom Analysis Protocol Identification Common Protocol Signatures Protocol Header Patterns Binary Protocol Analysis Structure Identification Python Protocol Parser Hex Dump Analysis Encryption Analysis Identifying Encryption TLS Analysis Decryption Approaches Custom Protocol Documentation Protocol Specification Template [INIT] --HELLO--> [WAITACK] --HELLOACK--> [CONNECTED] DATA/DATA [CLOSED] <--CLOSE--+ Client -> Server: HELLO (ClientID=0x12345678) Server -> Client: HELLOACK (Status=OK) Client -> Server: DATA (payload) Wireshark Dissector (Lua) Active Testing Fuzzing with Boofuzz Replay and Modification Best Practices Analysis Workflow 1. Capture traffic: Multiple sessions, different scenarios 2. Identify boundaries: Message start/end markers 3. Map structure: Fixed header, variable payload 4. Identify fields: Compare multiple samples 5. Document format: Create specification 6. Validate understanding: Implement parser/generator 7. Test edge cases: Fuzzing, boundary conditions Common Patterns to Look For Magic numbers/signatures at message start Version fields for compatibility Length fields (often before variable data) Type/opcode fields for message identification Sequence numbers for ordering Checksums/CRCs for integrity Timestamps for timing Session/connection identifiers
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills wshobson/protocol-reverse-engineering