Skip to content

Latest commit

 

History

History
59 lines (45 loc) · 1.78 KB

README.md

File metadata and controls

59 lines (45 loc) · 1.78 KB
Raw

ethpd

Ethereum UDP packet dissector for discovery protocol v4.

ethpd decodes a pcap file of captured Ethereum packets into a readable format. The decoded packets will be printed to the standard output. Pipe the output to a text file for larger pcap files.

Usage

ethpd [pcapFile] -- Prints to standard output

ethpd [pcapFile] > file.txt -- Prints to text file file.txt

Install

With a correctly configured Go installation:

go get -u github.com/ymarcus93/ethpd

Version 4 Packet Structure

See RLPx protocol page for more information

  • All packets are signed with ECDSA-secp256k1 keys (represents a node's ID)
    • For authenticity
    • Signature: sign(privkey, sha3(packet-type || packet-data))
      • 65-byte compact ECDSA signature containing the recovery id as the last element.
      • See the code for more information on how NodeID is recovered from the signature.
  • All packets are prepended with SHA3-256 hash of the underlying data of the packet
    • For integrity
    • Hash: sha3(signature || packet-type || packet-data)
    • 32 bytes
  • Packet Type: Single byte < 2**7 // valid values are [1,4]

Full UDP Packet Payload: hash || signature || packet-type || packet-data

Packet Data

RLPx encoded list. Packet properties are serialized in the order in which they're defined.

Ping

  • Version
  • From, To (IP, UDP, TCP)
  • Expiration

Pong

  • To (IP, UDP, TCP)
  • ReplyTok
  • Expiration

Findnode

  • Target
  • Expiration

Neighbors

  • Nodes:
    • IP
    • UDP
    • TCP
    • ID
  • Expiration