| 摘要: | 網路協定是資訊工程與資訊安全領域的基礎知識，然而當前的教學模式多依賴靜
態教材與單向講授，缺乏互動性與即時回饋，導致學生難以將抽象的協定理論與實際
封包數據建立有效連結。教師也面臨缺乏系統化框架輔助設計互動式課程，以及難以
即時掌握學生理解狀況的挑戰。此外，Wireshark等專業工具雖然能夠顯示封包的詳
細細節與封包資訊統計，但其介面複雜且學習曲線陡峭，增加初學者的學習門檻。
本研究提出一個結合大型語言模型(Large Language Models, LLM)、模型上下文協
定(Model Context Protocol, MCP) 與WebShark封包分析工具的智慧網路協定教學
平台。系統以Claude 4 Sonnet作為核心的理解與教學引導引擎，透過MCP 技術整
合WebShark 進行實際封包分析，實現語意理解與實務操作的結合。透過學生提問來引
導學生，並根據學生問題動態調整教學策略，提供個別化的學習體驗。
為評估系統成效，本研究採用G-Eval評估框架，使用GPT-4o與Gemini
作為雙評估器，針對Answer Relevancy(答案相關性)、Hallucination(幻覺程度)、Role
Adherence(角色遵循) 與Knowledge Retention(知識保留) 四個維度進行評估。實驗設計
涵蓋HTTP、TCP、DNS 與HTTPS 等四種網路協定教學場景，比較本系統與純LLM 基
準系統的表現。
實驗結果顯示，本系統在雙評估器的評估下均展現顯著優勢。在需要具體數據包
證據的教學場景中，本系統的Answer Relevancy 顯著優於純LLM(GPT-4o vs 純LLM：
0.70 vs 0.36；Gemini vs 純LLM：0.79 vs 0.55)，證實MCP 工具整合能提供更相關且精
確的回應。Role Adherence 方面，本系統在兩個評估器下均維持高分(GPT-4o 約0.78，
Gemini 達1.0)，而純LLM 在所有實驗中均為0，突顯純LLM 無法維持教學助理角色的
可能存在缺陷。本系統在Knowledge Retention 與Conversation Completeness 兩項指標均
達到優異表現，反映出系統能在多輪互動中維持脈絡一致性。值得注意的是，Gemini
在純LLM 的部分實驗中偵測到Misuse 現象，而GPT-4o 並未發現此問題，顯示雙評估
器策略能更全面地揭示系統潛在風險。
本研究的主要貢獻在於：(1) 設計並實作整合 LLM、MCP 與 WebShark 的混合式網路協定教學系統原型；(2) 透過對比實驗驗證工具輔助對系統
效能的提升，包括回應相關性、角色遵循、知識保留等多個維度；(3)
建立基於 G-Eval 雙評估者的多維度評估方法，為教學型 AI 系統效能
評估提供可行框架；(4) 提供可立即應用的學習輔助工具原型，降低
初學者使用 Wireshark 的學習門檻。;Network protocols constitute the foundational knowledge of Computer Science and Information
Security. However, current pedagogical models rely heavily on static materials and oneway
lectures, lacking interactivity and real-time feedback. This results in students struggling to
bridge the gap between abstract protocol theories and actual packet data. Educators also face
challenges such as a lack of systematic frameworks for designing interactive curricula and difficulty
in monitoring student understanding in real-time. Furthermore, while professional tools
like Wireshark provide comprehensive packet details and statistics, their complex interfaces
and steep learning curves present significant barriers for beginners.
This study proposes an intelligent network protocol teaching platform that integrates Large
Language Models (LLMs), the Model Context Protocol (MCP), and the WebShark packet
analysis tool. The system employs Claude 4 Sonnet as the core engine for understanding and
pedagogical guidance. Through MCP technology, the platform integrates WebShark to perform
live packet analysis, achieving a fusion of semantic understanding and practical operation. The
system guides students through inquiry-based learning and dynamically adjusts teaching strategies
based on student questions to provide a personalized learning experience.
To evaluate the system’s effectiveness, this study utilizes the G-Eval framework, employing
GPT-4o and Gemini as dual-evaluators. The evaluation focuses on four dimensions:
Answer Relevancy, Hallucination, Role Adherence, and Knowledge Retention. The experimental
design covers four protocol teaching scenarios—HTTP, TCP, DNS, and HTTPS—
comparing the proposed system against a pure LLM baseline.
Experimental results demonstrate that the proposed system exhibits significant advantages
across both evaluators. In scenarios requiring specific packet evidence, the Answer Relevancy
of this system was significantly superior to the pure LLM (GPT-4o: 0.70 vs. 0.36; Gemini: 0.79vs. 0.55), confirming that MCP tool integration provides more relevant and precise responses.
Regarding Role Adherence, the system maintained high scores (approx. 0.78 by GPT-4o and
1.0 by Gemini), whereas the pure LLM scored 0 across all experiments, highlighting the baseline’s
inability to maintain a teaching assistant persona. The system also achieved excellent
performance in Knowledge Retention and Conversation Completeness, reflecting its ability to
maintain contextual consistency over multiple interactions. Notably, Gemini detected ”Misuse”
in some pure LLM experiments that GPT-4o failed to identify, underscoring the importance of
a dual-evaluator strategy in revealing potential system risks.
The main contributions of this research are: (1) designing and implementing
a hybrid network protocol teaching system that integrates LLM, MCP, and
WebShark; (2) validating the performance improvement through comparative
experiments across multiple dimensions including answer relevancy, role
adherence, and knowledge retention; (3) establishing a multi-dimensional
evaluation framework based on G-Eval with dual evaluators, providing a
feasible approach for assessing teaching-oriented AI systems; (4) providing
an immediately applicable learning assistance tool prototype that lowers
the learning barrier for beginners using Wireshark. |
