Repository files navigation

This repo contains a set of network protocol dissectors for Ethereum that you can load into the widely popular Wireshark to begin inspecting Ethereum traffic.

Currently we support the UDP-based discovery protocol, but support for the RLPx Wire protocol and the ETH subprotocol are in the works.

Here are the features currently supported by the Ethereum Discovery dissector (we're working on more):

• Heuristics to dynamically detect Ethereum discovery traffic, no matter the port it's running on.
• Decoding ofPING,PONG,FIND_NODE andNODES packet, breaking the messages into its elements, with the appropriate datatypes.
• Linking ofPING =>PONG frames, as well asFIND_NODE =>NODES interactions in protocol trees.
• Lots of supported filters! (documentation WIP)
• Service response time calculation for RPC interactions.
  • under: Statistics > Service Response Time > ETH discovery.
  • inline in protocol trees.
• Useful protocol statistics (e.g. message counts per type, nodes reported per response, etc.)

• Build & run
• Team
• Why this project?
• License

We're working to enable building the plugin separately from Wireshark. In the meantime, you will need to clone the Wireshark repo.

1. Go to theWireshark repo and clone it.
2. Set up your build environment. The steps vary depending on your OS.

• For Windows, follow theinstructions here.
• For Unix and macOS systems, most tools are already installed, but you need to ensure you havecmake andninja. On macOS, you can runbrew install cmake ninja if you use Homebrew.

3. Run a plain Wireshark build to ensure all is OK. In macOS, it looks like this:

$ cd ${WIRESHARK_SRC}$ # check out the latest 2.6 tag (could be higher)$ git checkout wireshark-2.6.2$ mkdir ../wireshark-ninja$ cd ../wireshark-ninja$ cmake -G Ninja ../wireshark$ ninja

4. Clone this repo onto a separate directory.
5. Symlink the root of this repo under${WIRESHARK_SRC}/plugins/epan/ethereum, i.e.ln -s ${THIS_REPO} ${WIRESHARK_SRC}/plugins/epan/ethereum.
6. Modify the${WIRESHARK_SRC}/CMakeLists.txt file to add theplugins/epan/ethereum directory under thePLUGIN_SRC_DIRS variable, i.e.:

  ...set(PLUGIN_SRC_DIRSplugins/epan/ethercatplugins/epan/ethereumplugins/epan/gryphon    ...

7. Delete all contents underwireshark-ninja, and run the full Wireshark build again repeating step 3.
8. If all went well, you should be able to run the resulting Wireshark executable inside thewireshark-ninja/run directory.
9. Happy dissecting!

Ordered alphabetically by surname.

• Raúl Kripalani (ConsenSys/Protocol Labs) -- project lead
• Guilherme Salgado (Py-EVM)
• Zhenyang Shi (University of Queensland)
• Scott Whittington (University of Queensland)

In the Protocol Engineering Groups and Systems team (PegaSys) at ConsenSys, we specialise in the low-level, deep aspects of the Ethereum technology. Some of the challenges we tackle are: scalability, secrecy, modularity, finality, permissioning, etc.

To perform our job we need tooling to x-ray into different parts of the system. One of those parts is the networking layer. No central authority exists in public chain Ethereum, hence all communication is peer-to-peer (P2P), which gives rise to both RPC-style and gossip-like communication patterns we need full insight of during development, research and testing.

devp2p is the name of the networking subsystem of Ethereum, along with its collection of core protocols on top of which subprotocols like ETH, Whisper, Swarm, Light Ethereum, etc. are layered.

Wireshark is a popular tool for network packet analysis. Users can initiate network dumps and navigate through a wealth of packet data via its powerful GUI. The architecture of Wireshark is modular, and it revolves around the concept ofdissectors: components capable of decoding a concrete protocol, which can be in use at any layer of theOSI model.

Unfortunately no Wireshark dissectors exist yet for Ethereum devp2p protocols. This project changes that.

PegaSys’ mission is to build blockchain solutions ready for production in business environments. We are committed to open source, and are creating a framework for collaborative innovation for the public-chain community and leading enterprises.

Our team is composed of engineers leading in the areas of big data processing, applied cryptography, open source computing, cloud services, and blockchain development.

Learn more about PegaSys.

This project is licensed under GPLv2.