3

I captured bitcoin protocol communication in real-time and it is present in fig1 and fig2.

Fig1 enter image description here

In red box, there are many types of command.

First Question:

How can Wireshark detect bitcoin communication and parse them? I think the packet that socket sends may have something what I don't know.

In red box of fig2, you can see many properties of packet. this is definitely defined by software program, not hardware such as router. Real data that client send is really just hex data which is encoded by specific rule.

Second Question:

How Wireshark can parse data received? Bitcoin client can parse it because they know the rule but Wireshark doesn't know anything since Wireshark is thrid-party program, which no have any relation with Bitcoin software.

Fig2 enter image description here

Sorry for my English.

Improve this question
1
  • Wireshark knows about 3000 different protocols, including Bitcoin. The list of protocols it handles is here: wireshark.org/docs/dfref
    – Ken Shirriff
    Commented Nov 27, 2019 at 1:35

1 Answer 1

Reset to default
16

Someone wrote a Bitcoin protocol decoder for Wireshark, several years ago. I assume it was included in the Wireshark distribution.

Wireshark simply knows about the Bitcoin protocol. There is no magic involved.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.