Skip to content
Get packs

Protocol Reverse Engineering

Capture, dissect and document network protocols using Wireshark, tcpdump, Scapy and mitmproxy

Source Download skill
Repository
wshobson/agents
Stars
42,095
Licence
MIT
Files
3 files

What it does

This skill teaches an AI agent the standard workflow for studying network traffic: capturing packets with tools like Wireshark, tcpdump and mitmproxy, filtering and extracting fields, recognising common protocol signatures and header layouts, and writing up the structure of an undocumented protocol. It also covers basic active testing such as replaying captured traffic and fuzzing a test service with Boofuzz. Once installed, the agent can give step-by-step commands and analysis guidance instead of general answers.

Great for

  • Developers debugging how their app or device talks over the network
  • Security researchers analysing a proprietary or undocumented protocol they are authorised to test
  • Engineers who need to write a parser or interoperable client for an existing protocol

Skip it if

  • Capturing or intercepting traffic on networks or devices you do not own or have permission to monitor, which may be illegal
  • Fuzzing or replaying traffic against production or third-party systems, which can cause outages or legal trouble
  • Users who expect a point-and-click tool; the skill only guides an agent that runs command-line tools

Try asking

  • “Capture traffic from my app on port 8888 and help me figure out its header format”
  • “Write a tshark command that extracts HTTP request methods and URIs from this pcap”
  • “Help me document the binary message structure from these three captures”
  • “Build a Boofuzz script to fuzz my test server's HELLO message”
Step-by-step guide: how to use Protocol Reverse EngineeringInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 3 original files, the MIT licence and an attribution note.

    protocol-reverse-engineering.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip protocol-reverse-engineering.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip protocol-reverse-engineering.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Only use this on networks, devices and services you own or are explicitly authorised to test.
  • Capture several sessions across different scenarios so you can compare samples when identifying fields.
  • Run fuzzing and replay steps only against isolated test targets, never live systems.

What's inside

  • references/binary-encryption-analysis.md
  • references/protocol-documentation.md
  • SKILL.md

Redistributed unmodified from wshobson/agents under the MIT licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.