Ask HN: Guides on finding hidden APIs by monitoring network traffic?

Andrew Tridgell has several posts about reverse engineering the SMB protocol to implement Samba [1]

Additionally the Wireshark docs [2] would be a fruitful place to go looking and learning about setting up a protocol analyzer.

1. http://www.samba.org/samba/docs/myths_about_samba.html

2. https://www.wireshark.org/docs/

I suspect that http://humdi.net/vnstat/ or something similar could do the trick.