I've seen that Wireshark can detect protocol packets like Bitcoin and Lightning Network, which are identified in the protocol column. However, my Wireshark is not classifying those packets, it just says tcp/ip or http/json. Does anyone know how to solve that? I want to identify the packets.

1 Answer 1


Run 2 nodes with different ports on regtest

bitcoind -regtest=1 -port=18333 -datadir=/home/satoshi/node1

bitcoind -regtest=1 -port=18444 -datadir=/home/satoshi/node2

Add node1 as outbound connection in node2

addnode "" "add"

Run Wireshark and select adapter for loopback traffic capture. You will see some packets with 'bitcoin' protocol.

Example: This is INV message sent by node2 to node1 when I generated a block using generatetoaddress 10 bcrt1qugkqq2a3lhf58e4pclcf52dgd4e02hpve3vhzs


For reference, Wireshark has included the ability to decode Bitcoin protocol packets since version 1.10.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.