I took a graduate networking class and for my project, I decided to reverse-engineer the DS download play protocol (commonly referred to as Wireless Multi-Boot, due to ideological similarities with the GBA Multi-Boot feature). This is the protocol underlying the ability for wirelessly transferring demos from a download station or another DS to your own DS. Many games have the ability to transfer demos of the full game, or multiplayer clients for LAN gaming, and the kiosks are used in stores and at conferences to distribute game demos.
The project title was ‘Inferring a Proprietary Wireless L3 Protocol From Packet Traces’, and I gave a presentation in class, as well as a project report that had the technical details. I’ve since placed all of that information on the NDSTech wiki.
Note: I was not the first person to do this. FireFly did everything that I did first, but he did not publish any information on the protocol or source code for his tools. However, his raw-mode driver for Ralink cards and the already re-assembled WMB captures made my life a whole lot easier. A number of other people on the gbadev.org forums also provided vital insight (to both FireFly and myself).