This paper introduces an approach to automatic synthesis of the specification models of routing protocol behavior from the observed flow of the network traffic. In particular, our technique zes the monitored sequences of routing messages constructing a high-level abstract view of the protocol. The basis of our method is similar to Inductive Logic Programming technique that derives a sound hypothesis from the individual examples. We conduct preliminary experiments on the example of AODV and DSR ad-hoc routing protocols and discuss the effectiveness of the generated specification models in detecting protocol misuses.