While AI assisted tools are helping us speed run the analysis of unknown protocols, we still need to have a solid foundation to make sense of the larger picture. In this talk I will focus on three topics for that initial step of the investigation before analysis tools or even dissectors start to make sense: I will start start by sharing how to prepare a sane and fresh Wireshark environment for a new reverse engineering session. Then followed by example on how to weed out traffic and translating initial findings into usable information. Finally we will go through several TLS variants and see what we need to decrypt those to add plain text information to our protocol tree.
The skills demonstrated in this talk sit solidly before more advanced steps such as automated analysis with scapy/AI tools and writing full dissectors or reverse engineered implementations of communication protocols.