Can someone recommend any tutoial or books on how to analyze unknown network protocol. Basically given the dumps of network traffic, I need some guide/examples on reversing the protocol.

1 Answer 1


The Malware Analysis Tutorial 1 on Dr Fu's Security Blog involves running a piece of malware inside a Windows VM and capturing its network traffic using wireshark in a Linux VM set up for the purpose. Among other things. That should cover the 'acquisition' part of your project nicely in case plain wireshark on its own should not be enough...

As regards Ethereal/Wireshark as such, there's a series of tuts on Wikiversity and Google turns up a gazillion more.

As regards the analysis portion I found these quite interesting:

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.