Reversing Network Protocols

An undocumented binary protocol is reverse-engineered from two sides at once: the wire, which shows you the bytes that actually flow, and the client, which shows you the code that produced them. Neither alone is enough — the capture tells you what varies, the client tells you why — and the deliverable is a parser precise enough to decode, replay, and eventually fuzz the protocol.

When to Use

• A proprietary or custom TCP/UDP protocol with no public specification
• Traffic Wireshark displays as raw Data bytes because no dissector matches
• Game, IoT, industrial, or C2 protocols you must decode from captures plus the client binary
• Building a Wireshark dissector, a Kaitai Struct spec, or a scapy layer to parse and replay a protocol

When NOT to Use