Can someone recommend any tutoial or books on how to analyze unknown network protocol. Basically given the dumps of network traffic, I need some guide/examples on reversing the protocol.
1 Answer
The Malware Analysis Tutorial 1 on Dr Fu's Security Blog involves running a piece of malware inside a Windows VM and capturing its network traffic using wireshark in a Linux VM set up for the purpose. Among other things. That should cover the 'acquisition' part of your project nicely in case plain wireshark on its own should not be enough...
As regards Ethereal/Wireshark as such, there's a series of tuts on Wikiversity and Google turns up a gazillion more.
As regards the analysis portion I found these quite interesting:
