PlugWiki

Protocol Reverse Engineering Skill for Claude: Capture and Decode Network Traffic

Gives Claude a playbook for capturing, decoding and documenting network protocols with Wireshark, tcpdump, mitmproxy, Scapy and fuzzing.

Installs
13.1K
on skills.sh
Stars
42.1K
on GitHub
Files
2
besides SKILL.md
Updated
Oct 2026
last repo commit

protocol-reverse-engineering teaches Claude how to capture network traffic, work out how a protocol is built and write it down. SKILL.md gives commands for Wireshark, tshark and tcpdump capture, mitmproxy and Burp for intercepting HTTP and TLS, and Scapy for custom analysis. It also lists signatures of common protocols, a typical header layout and a seven-step workflow from capture to edge-case testing.

Two references go deeper: binary and encryption analysis (structure, entropy, TLS metadata, decryption with a key log) and a specification template with a Wireshark Lua dissector. The skill bundles no scripts, but the commands it teaches can sniff a network, intercept TLS and send or modify packets, so use it only on systems you own or have permission to test.

Good for

  • Security researchers analyzing traffic from software they are allowed to test
  • Developers debugging a proprietary or undocumented network protocol
  • Engineers writing a protocol spec or a Wireshark dissector for interoperability

Install protocol-reverse-engineering

Claude Code

  1. 1

    Copy this prompt.

    Install the protocol-reverse-engineering skill in Claude Code. Run this command:

/plugin marketplace add wshobson/agents
/plugin install reverse-engineering@claude-code-workflows

Then check that it loaded and tell me how to use it.
  2. 2

    Paste it into Claude Code. It shows the change and asks before running it.

Pick one route. The plugin routes install the whole reverse-engineering plugin: 3 agents and 4 skills, no commands (counted from the plugin folder in the repo tree, which has no hooks or MCP config files). The skills-only routes install just this skill, with no agents or commands. The skill teaches commands for tools such as Wireshark, tshark, tcpdump, mitmproxy, Scapy and Boofuzz, which you install yourself on your own machine, so it has no Claude app upload route.

From the project README. Source.

What's in the skill

When it loads

Master network protocol reverse engineering including packet analysis, protocol dissection, and custom protocol documentation. Use when analyzing network traffic, understanding proprietary protocols, or debugging network communication.

Sections in SKILL.md

  1. Traffic Capture
  2. Wireshark Capture
  3. tcpdump Capture
  4. Man-in-the-Middle Capture
  5. Protocol Analysis
  6. Wireshark Analysis
  7. tshark Analysis
  8. Scapy for Custom Analysis
  9. Protocol Identification
  10. Common Protocol Signatures
  11. Protocol Header Patterns
  12. Active Testing
  13. Fuzzing with Boofuzz
  14. Replay and Modification
  15. Best Practices
  16. Analysis Workflow

Key facts

Author
wshobson (repo owner)
License
MIT
Installs on skills.sh
13,117 as of 2026-11-02
GitHub stars
42,081 for the whole repo
Last commit to the repo
2026-10-30
Files in the skill
3 files including SKILL.md: references/binary-encryption-analysis.md and references/protocol-documentation.md
skills.sh audits
Gen Agent Trust Hub pass, Socket warn, Snyk pass

What it includes

  • Wireshark, tshark and tcpdump commands, including ring-buffer capture.

    Captures packets from a network interface into a .pcap file, optionally with a filter such as a port.

    Runs code · Traffic capture

  • mitmproxy in transparent mode, mitmdump to file, and Burp via a browser proxy.

    Includes a mitmproxy command with --ssl-insecure for TLS interception.

    Runs code · Man-in-the-middle capture

  • Wireshark display filters, tshark field extraction and Scapy scripts.

    Reads a capture, lists conversations and endpoints, exports JSON and walks packets in Python.

    Try: “Analyze capture.pcap and tell me the message structure of the traffic on port 8888.”

    Runs code · Protocol analysis

  • Signatures for HTTP, TLS, DNS, SMB, SSH, FTP, SMTP, MySQL, PostgreSQL, Redis, MongoDB.

    Also shows a generic header layout: magic number, version, flags, length, type and sequence.

    Read · Protocol identification

  • A Boofuzz session that fuzzes a TCP target on port 8888.

    Defines a message structure and runs session.fuzz() against a target host.

    Runs code · Active testing: fuzzing

  • Scapy code that replays captured packets and rewrites payloads before sending.

    Calls send() on captured or modified packets and recalculates checksums.

    Runs code · Active testing: replay and modify

  • Seven steps from capturing traffic to testing edge cases.

    Capture, find message boundaries, map structure, identify fields, document the format, validate with a parser, then test edge cases.

    Read · Analysis workflow

  • Binary structure, entropy checks, TLS metadata and decryption approaches.

    Covers length-prefixed and TLV messages, JA3 fingerprints and decrypting TLS with a pre-master secret log.

    Runs code · references/binary-encryption-analysis.md

  • A specification template and a Wireshark Lua dissector example.

    The template covers overview, transport, header, message types, state machine and examples.

    Write · references/protocol-documentation.md

From the official docs

Permissions

High risk

The commands this skill teaches can sniff a network, intercept TLS and send or fuzz packets. Use them only on systems you own or have permission to test, and approve each command yourself.

What it can do

  • Read your data
  • Create and change things
  • Delete things
  • Read-only mode

Watch out for

  • It teaches sniffing, TLS interception and packet injection

    SKILL.md shows tcpdump and tshark capture, mitmproxy transparent mode with --ssl-insecure, Scapy send() of replayed or modified packets and a Boofuzz fuzzer. Use them only on systems you own or may test, preferably on a lab network, and approve each command yourself. github.com

  • Captures can hold passwords and private data

    A .pcap, a mitm dump or a TLS key log can contain credentials and personal data. Keep them off shared drives and do not paste them into a chat you do not control. github.com

  • Fuzzing can crash the target

    The Boofuzz example runs session.fuzz() against a TCP port. Point it at a test instance, not production. github.com

  • The plugin route adds more than this skill

    The reverse-engineering plugin also installs 3 agents (reverse-engineer, malware-analyst, firmware-analyst) and 3 other skills. The repo tree shows no hooks or MCP config files in it. The skills CLI route installs only this skill. github.com

Technical details
Scopes

  • Commands in SKILL.md capture packets from a network interface

  • mitmproxy examples intercept HTTP and TLS traffic

  • Scapy and Boofuzz examples send, replay, modify and fuzz packets against a target host

Questions

What does the protocol-reverse-engineering skill do?

It gives Claude a playbook for capturing network traffic, identifying and decoding a protocol, and writing a spec or dissector. It covers Wireshark, tcpdump, mitmproxy, Scapy and fuzzing with Boofuzz.

How do I install protocol-reverse-engineering?

Use the install box above. The skills CLI command installs only this skill, three markdown files with no scripts. The plugin route installs the whole reverse-engineering plugin, with its 3 agents. The tools the skill mentions, such as Wireshark and mitmproxy, you install yourself.

Is protocol-reverse-engineering safe to use?

Only on systems you own or have written permission to test. The commands it teaches sniff network interfaces, intercept TLS, fuzz a target and send modified packets. Read each command before Claude runs it, and use a lab network.

Can it decrypt HTTPS traffic?

It shows how to decrypt TLS in Wireshark using a pre-master secret log from a browser, and how to intercept with mitmproxy. Both need you to control one of the endpoints.

Does Claude capture traffic by itself?

The skill bundles no scripts. Claude only captures traffic if it runs the tcpdump, tshark or mitmproxy commands from the skill on your machine, so approve them one at a time.

Information

updated Nov 2, 2026

Repository
wshobson/agents
Folder
plugins/reverse-engineering/skills/protocol-reverse-engineering

wshobson/agentsskills.sh

Sources

Docs, issue trackers and discussions this page is built from.

Show all 6
  1. protocol-reverse-engineering SKILL.md · github.com
  2. wshobson/agents README · github.com
  3. reverse-engineering plugin.json · github.com
  4. SKILL.md · github.com
  5. binary-encryption-analysis.md · github.com
  6. protocol-documentation.md · github.com

Updated Nov 2, 2026.