<p>I'm trying to send a raw bitcoin transaction through a raw socket connection in python. To debug I'm using wireshark to sniff the packets.</p>

<p>Wireshark figures out that the packet is for Bitcoin and that it's a 'version' message, and gets the first couple fields right, but then neglects the checksum field and instead assigns what should be the checksum to the protocol version, throwing everything else off.  I can't seem to get to the bottom of it.  </p>

<p>Other message types, like 'tx', include the checksum but have other issues (I'll get to later).  Any ideas why wireshark isn't picking up on the checksum for the version message?</p>

CC BY-SA 3.0
2014-05-24T17:47:34.990Z
Does Wireshark correctly parse transactions sent by the standard Bitcoin client?
Nate Eldredge
CC BY-SA 3.0
2014-05-24T18:07:08.710Z
I think the issue might be an old bitcoin dissector, since checksums were only added into the version msg recently.  building from source now with updates dissector.  don't have the cpp-client right now so can't check.
Ethan
CC BY-SA 3.0
2014-05-24T18:47:42.617Z
I believe the dissector for Bitcoin is broke in Wireshark, there are more issues.
Jori
CC BY-SA 3.0
2014-05-24T19:39:07.500Z
super.  is there an alternative.  how can I debug my packets?
Ethan
CC BY-SA 3.0
2014-05-25T09:32:56.987Z
Yes, the Bitcoin plugin for Wireshark is very old and doesn't include some types of messages. Your best bet is to just filter by the port and do the work manually, the types are identified correctly and are not encrypted so it's fairly easy going.
user13413
<protocol><raw-transaction><p2p><network>
wireshark packet analysis missing checksum in version msg
Ethan
# wireshark packet analysis missing checksum in version msg

(Asked by: username_0 on 2014-05-24)

I'm trying to send a raw bitcoin transaction through a raw socket connection in python. To debug I'm using wireshark to sniff the packets.

Wireshark figures out that the packet is for Bitcoin and that it's a 'version' message, and gets the first couple fields right, but then neglects the checksum field and instead assigns what should be the checksum to the protocol version, throwing everything else off. I can't seem to get to the bottom of it.

Other message types, like 'tx', include the checksum but have other issues (I'll get to later). Any ideas why wireshark isn't picking up on the checksum for the version message?

**Tags:** protocol, raw-transaction, p2p, network

> **Comments:**
> **username_1**: Does Wireshark correctly parse transactions sent by the standard Bitcoin client?  
> **username_0**: I think the issue might be an old bitcoin dissector, since checksums were only added into the version msg recently.  building from source now with updates dissector.  don't have the cpp-client right now so can't check.  
> **username_2**: I believe the dissector for Bitcoin is broke in Wireshark, there are more issues.  
> **username_0**: super.  is there an alternative.  how can I debug my packets?  
> **username_3**: Yes, the Bitcoin plugin for Wireshark is very old and doesn't include some types of messages. Your best bet is to just filter by the port and do the work manually, the types are identified correctly and are not encrypted so it's fairly easy going.  

---

## 0 answers

