the protocol is pretty much fully known, its the content of the data stream that keeps changing.
We write our own tools to help us understand, we start with raw packets (ethereal/tcpdump), and work on writting tools to reassemble the packet stream, then we use those tools to understand the contents, etc.
|