skills.rest
dslsdzc
dslsdzcCOMMUNITY
Explore all skills by this author →
GitHub

re-iot-proto

Analyze and reverse engineer IoT protocols including MQTT, CoAP, BLE, Zigbee, and NFC smart cards.

64|9|Updated Aug 17, 2026
Search Tags:#iot#mqtt#wireshark#zigbee#ble#nfc#protocol reverse engineering
One-click install
npx skills add https://github.com/dslsdzc/rev-skills --skill re-iot-proto-dslsdzc
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: re-iot-proto
Source: https://github.com/dslsdzc/rev-skills/tree/main/.claude/skills/re-iot-proto
Command: npx skills add https://github.com/dslsdzc/rev-skills --skill re-iot-proto-dslsdzc

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? IoT device traffic is often opaque: MQTT topics, CoAP payloads, BLE GATT exchanges, Zigbee frames, and NFC APDU interactions each require different capture hardware, dissectors, and decryption keys. This Skill provides a structured workflow to identify, capture, parse, and decrypt these protocols, and to link protocol semantics back to device firmware. ## Core Features & Use Cases - MQTT/CoAP Analysis: Identify protocols by port and header signatures, extract topics and payloads with tshark, and actively verify semantics with mosquitto and coap-client within authorized scope. - BLE Link-Layer & GATT: Capture via btmon, Android btsnoop, or ubertooth; parse advertising PDUs, connection events on channels 37/38/39, SMP pairing modes, and GATT characteristics. - Zigbee & NFC: Decrypt Zigbee NWK/APS/ZCL layers with network keys, and analyze ISO14443 anticollision, APDU exchanges, and MIFARE Classic Crypto-1 weaknesses with proxmark3-class readers. - Use Case: You captured traffic from a smart home hub. Use this Skill to bucket MQTT topics, decrypt the Zigbee network with a key extracted from firmware, and map BLE GATT writes to device control commands. ## Quick Start Analyze the attached IoT packet capture to identify the protocols in use, extract MQTT topics and BLE GATT values, and explain the device control semantics.

Frequently Asked Questions about re-iot-proto

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I analyze MQTT traffic from a packet capture?▼

Use tshark with the mqtt display filter to extract topics and messages, for example listing mqtt.topic and mqtt.msg fields. Bucket topics with sort and uniq to find control semantics, then verify actively with mosquitto_sub and mosquitto_pub within authorized scope.

How to capture and decrypt BLE traffic between two devices?▼

Capture with Android btsnoop logs, btmon on Linux, or an nRF sniffer dongle with Wireshark extcap. Encrypted connections require the LTK, which is only exchanged during first pairing or must be extracted from device flash or app storage.

What tools are needed for Zigbee packet sniffing?▼

Use a CC2531 USB stick or EFR32-based sniffer with Wireshark's built-in zbee dissector, plus KillerBee for ZCL crafting and replay. Decryption requires the 16-byte network key entered in Wireshark's ZigBee security preferences.

Can Wireshark decrypt CoAP DTLS or MQTT TLS traffic?▼

Yes, if you have the keys. DTLS with PSK is decrypted by entering the hex pre-shared key in Wireshark's dtls preferences, and TLS uses SSLKEYLOGFILE; RSA private keys only work for legacy static-RSA sessions, not TLS 1.3 or ECDHE.

Why does my Zigbee capture show only encrypted payloads?▼

The network key is missing, so APS and ZCL layers stay encrypted. Obtain it by capturing the network join process, trying the default ZigBeeAlliance09 TC link key, or extracting keys from firmware with tools like zbgoodfind.

When should I not use this IoT protocol skill?▼

Do not use it for generic custom protocols, which belong to general protocol reverse engineering, or for plain network capture tasks. Encrypted traffic without any key access path should first go through cryptographic identification and key extraction workflows.

Related Skills

Explore More Software Engineering Skills→
xalgordxalgord
954

detecting-bluetooth-low-energy-attacks

Detects BLE sniffing, replay, GATT enumeration, and MITM attacks using Ubertooth, bleak, and crackle.

Community
Advanced
xalgordxalgord
954

performing-iot-security-assessment

Tests IoT devices across hardware, firmware, network, and cloud layers for exploitable vulnerabilities.

Community
Advanced
rnavarychrnavarych
14

domain-iot:iot-security

Secure IoT devices with X.509 certificates, TLS/DTLS, and secure boot.

Community
Advanced
rnavarychrnavarych
14

domain-iot:protocol-advisor

Advise on selecting IoT communication protocols and wireless technologies for deployment scenarios.

Community
Intermediate