This paper introduces an approach to automatic synthesis of the specification models of rout- ing protocol behavior from the observed flow of the network traffic. In particular, our technique generalizes the monitored sequences of routing messages constructing a high-level abstract view of the protocol. The basis of our method is similar to Inductive Logic Programming technique that derives a sound hypothesis from the individual examples. We conduct preliminary experi- ments on the example of AODV and DSR ad-hoc routing protocols and discuss the effectiveness of the generated specification models in detecting protocol misuses.