Ethereum UDP packet dissector for discovery protocol v4.
ethpd
decodes a pcap file of captured Ethereum packets into a readable format.
The decoded packets will be printed to the standard output. Pipe the output to a text file for larger pcap files.
ethpd [pcapFile]
-- Prints to standard output
ethpd [pcapFile] > file.txt
-- Prints to text file file.txt
With a correctly configured Go installation:
go get -u github.com/ymarcus93/ethpd
See RLPx protocol page for more information
- All packets are signed with ECDSA-secp256k1 keys (represents a node's ID)
- For authenticity
- Signature: sign(privkey, sha3(packet-type || packet-data))
- 65-byte compact ECDSA signature containing the recovery id as the last element.
- See the code for more information on how NodeID is recovered from the signature.
- All packets are prepended with SHA3-256 hash of the underlying data of the packet
- For integrity
- Hash: sha3(signature || packet-type || packet-data)
- 32 bytes
- Packet Type: Single byte < 2**7 // valid values are [1,4]
Full UDP Packet Payload: hash || signature || packet-type || packet-data
RLPx encoded list. Packet properties are serialized in the order in which they're defined.
- Version
- From, To (IP, UDP, TCP)
- Expiration
- To (IP, UDP, TCP)
- ReplyTok
- Expiration
- Target
- Expiration
- Nodes:
- IP
- UDP
- TCP
- ID
- Expiration