Decoding the Network with Claude Code

A Practical Guide to Understanding, Reverse Engineering, and Automating Network Data Analysis

Introduction

1. What Protocol Analysis Is Not
2. What Protocol Analysis Is
3. Why Claude Code
4. Who This Book Is For
5. How to Read This Book
6. A Note on Ethics and Safety
7. The Central Thesis

Chapter 1: How Networks Talk

1. What a protocol really is
2. The layers that matter (and which ones do not)
3. Connection-oriented and connectionless communication
4. Addressing, routing and the path a packet takes
5. Ports, sockets and multiplexing
6. State and conversations

Chapter 2: The Evidence in Packets

1. What PCAP is and is not
2. Link-layer visibility and blind spots
3. IP, TCP, UDP: what each header tells you
4. Payloads and encryption boundaries
5. Timestamps, sequence numbers and reassembly signals
6. What you can never see in a capture

Chapter 3: Claude Code as Analysis Partner

1. What Claude Code is and how it differs from chat interfaces
2. Setting up your analysis environment
3. Context management: what to share, when and how
4. Effective prompts for protocol analysis tasks
5. When Claude Code excels and when it fails
6. Trust calibration: validating AI-generated analysis

Chapter 4: The Investigation Method

1. Starting from a question, not a tool
2. Forming and documenting hypotheses
3. Gathering initial evidence: the first thirty minutes
4. Generating competing hypotheses
5. Testing and falsifying hypotheses
6. Documenting confidence levels and assumptions
7. When to stop and what “solved” actually means

Chapter 5: Project Structure and Context Engineering

1. Directory layout for analysis projects
2. Context files: what Claude Code needs to know
3. Note-taking patterns for investigations
4. Code organisation: modular, testable analysis scripts
5. Version control and collaboration considerations
6. Reproducibility: capturing analysis decisions

Chapter 6: Capture and Ingestion

1. tcpdump: the foundation, filters, options, pitfalls
2. tshark: powerful CLI analysis
3. Wireshark: when the GUI matters and when it does not
4. Capture placement and scope decisions
5. Capture loss: recognizing and mitigating it
6. File formats and interoperability

Chapter 7: Stream and Session Reconstruction

1. TCP streams: sequence numbers and reassembly
2. UDP and pseudo-sessions
3. Handling retransmissions and out-of-order delivery
4. Fragmentation and its complications
5. NAT: recognizing and working through it
6. Implementation: stream extraction with tshark and Python

Chapter 8: Protocol Detection and Classification

1. Port-based identification and why it lies
2. TLS handshake fingerprints and version detection
3. ASCII signatures and protocol banners
4. Statistical protocol detection
5. Unknown protocols: when everything fails
6. Automated detection pipelines

Chapter 9: Text and Binary Decoding

1. Reading text-based protocols: HTTP, SMTP, etc.
2. Binary representation: hex, endian and structure
3. Base64, URL encoding and other transformations
4. Finding structure in binary blobs
5. Mixed-content protocols
6. Claude Code as a decoder: patterns and pitfalls

Chapter 10: Message Boundaries and Framing

1. Length-prefixed framing
2. Delimiter-based framing
3. Fixed-length messages
4. Session-based and timing-based boundaries
5. Protocol multiplexing and sub-streams
6. Practical techniques for boundary detection

Chapter 11: Field Discovery and Schema Inference

1. Constant vs variable fields
2. Numeric fields: integers, floats, bitfields
3. String fields and character encodings
4. Repeated fields and arrays
5. Nested structures
6. Using Claude Code for schema hypothesis generation

Chapter 12: State Machines and Protocol Logic

1. Observable state transitions
2. Request-response patterns and session flows
3. Timeout and retransmission behaviour
4. Error handling and recovery paths
5. Inferring state from message sequences

Chapter 13: Fingerprinting and Identification

1. TLS fingerprinting (JA3, JA4, etc.)
2. HTTP client and server fingerprints
3. TCP stack fingerprints
4. Timing and behavioural fingerprints
5. Application-level fingerprints
6. Privacy implications and evasion

Chapter 14: Statistical Analysis and Pattern Discovery

1. Basic statistics: distributions, outliers, correlations
2. Traffic volume and timing analysis
3. Protocol-level metrics
4. Using Python for statistical analysis

Chapter 15: Anomaly Detection and Suspicious Behaviour

1. Defining normal and abnormal
2. Signature-based detection
3. Statistical anomaly detection
4. Protocol violations and edge cases
5. Malformed and crafted packets
6. False positives and validation

Chapter 16: Correlation and Cross-Flow Analysis

1. Host-centric correlation
2. Temporal correlation
3. Payload correlation across streams
4. Session linkage
5. Attack-reconnaissance correlation
6. Tools for correlation analysis

Chapter 17: Case Study - Reverse Engineering a Custom Protocol

1. The scenario: new internal service with unknown protocol
2. Initial reconnaissance and tool selection
3. Stream extraction and first observations
4. Hypothesis generation with Claude Code
5. Iterative decoding and validation
6. Final protocol documentation

Chapter 18: Case Study - Encrypted and Obscured Traffic

1. The scenario: unexpected encrypted service
2. TLS analysis and certificate inspection
3. SNI and JA3 analysis
4. Traffic pattern analysis
5. Metadata and timing analysis
6. Limits and what remains unknown

Chapter 19: Case Study - Large-Scale Analysis Pipeline

1. The scenario: weekly analysis of gigabytes of traffic
2. Architecture: ingestion, processing, storage
3. Flow extraction and indexing
4. Automated protocol classification
5. Anomaly detection integration
6. Report generation and validation

Chapter 20: Automated Analysis Pipelines

1. Pipeline architecture patterns
2. Zeek for scalable protocol analysis
3. Scapy for custom processing
4. Database and columnar storage options
5. Orchestration and scheduling
6. Monitoring and reliability

Chapter 21: Reproducibility, Validation and Trust

1. Reproducible analysis environments
2. Independent verification of Claude Code output
3. Validation techniques: cross-checking, manual review
4. Documenting analysis methodology
5. Peer review and collaboration
6. Operational decision-making from analysis

Conclusion

References