<p>Someone wrote a Bitcoin protocol decoder for Wireshark, several years ago. I assume it was included in the Wireshark distribution.</p>

<p>Wireshark simply knows about the Bitcoin protocol. There is no magic involved.</p>

CC BY-SA 4.0
2019-11-26T06:11:52.137Z
2019-11-26T17:15:04.583Z
2019-11-26T17:15:04.583Z
Pieter Wuille
<p>I captured bitcoin protocol communication in real-time and it is present in fig1 and fig2.</p>

<p><strong>Fig1</strong>
<a href="https://i.sstatic.net/TBsD6.jpg" rel="nofollow noreferrer"><img src="https://i.sstatic.net/TBsD6.jpg" alt="enter image description here"></a></p>

<p>In red box, there are many types of command. <br/><br/>
<strong>First Question</strong>:</p>

<blockquote>
  <p>How can Wireshark detect bitcoin communication and parse them? I think
  the packet that socket sends may have something what I don't know.</p>
</blockquote>

<p>In red box of fig2, you can see many properties of packet. this is definitely defined by software program, not hardware such as router. Real data that client send is really just hex data which is encoded by specific rule.
<br/><br/>
<strong>Second Question</strong>:</p>

<blockquote>
  <p>How Wireshark can parse data received? Bitcoin client can parse it because they know the rule but Wireshark doesn't know anything since Wireshark is thrid-party program, which no have any relation with Bitcoin software.</p>
</blockquote>

<p><strong>Fig2</strong>
<a href="https://i.sstatic.net/latgV.jpg" rel="nofollow noreferrer"><img src="https://i.sstatic.net/latgV.jpg" alt="enter image description here"></a></p>

<p>Sorry for my English.</p>

CC BY-SA 4.0
2019-11-27T01:35:31.440Z
Wireshark knows about 3000 different protocols, including Bitcoin. The list of protocols it handles is here: https://www.wireshark.org/docs/dfref/
Ken Shirriff
<bitcoin-core-development><protocol><p2p><network>
Bitcoin protocol and Wireshark
Hyunsoo
# Bitcoin protocol and Wireshark

(Asked by: username_0 on 2019-11-26)

I captured bitcoin protocol communication in real-time and it is present in fig1 and fig2.

**Fig1**
[![enter image description here](https://i.sstatic.net/TBsD6.jpg)](https://i.sstatic.net/TBsD6.jpg)

In red box, there are many types of command.   
  
**First Question**:

> How can Wireshark detect bitcoin communication and parse them? I think
> the packet that socket sends may have something what I don't know.

In red box of fig2, you can see many properties of packet. this is definitely defined by software program, not hardware such as router. Real data that client send is really just hex data which is encoded by specific rule.
  
  
**Second Question**:

> How Wireshark can parse data received? Bitcoin client can parse it because they know the rule but Wireshark doesn't know anything since Wireshark is thrid-party program, which no have any relation with Bitcoin software.

**Fig2**
[![enter image description here](https://i.sstatic.net/latgV.jpg)](https://i.sstatic.net/latgV.jpg)

Sorry for my English.

**Tags:** bitcoin-core-development, protocol, p2p, network

> **Comments:**
> **username_1**: Wireshark knows about 3000 different protocols, including Bitcoin. The list of protocols it handles is here: https://www.wireshark.org/docs/dfref/  

---

## 1 answers

### Answer by username_2 on 2019-11-26. Score: 16 | Accepted answer

Someone wrote a Bitcoin protocol decoder for Wireshark, several years ago. I assume it was included in the Wireshark distribution.

Wireshark simply knows about the Bitcoin protocol. There is no magic involved.


---

