Wireshark dissectors for Solana

Installation

macOS

Download latest version of plugin

rm -f /Applications/Wireshark.app/Contents/PlugIns/wireshark/solana.lua
curl --output /Applications/Wireshark.app/Contents/PlugIns/wireshark/solana.lua \
  --proto '=https' --tlsv1.2 -sSf \
  https://raw.githubusercontent.com/firedancer-io/solana_dissector/main/solana.lua

To activate, hit Cmd+Shift+L or restart Wireshark.

Ports

Solana nodes allocate ports in a block starting at an arbitrary number. To discover endpoints, nodes use the gossip protocol to send each other port mappings.

This plugin doesn't implement mappings yet and instead hardcodes ports.

• 8000: Gossip
• 8001, 8002: Shreds
• 8008, 8009: Repair

This might get fixed in the future, but for now, you have to use "Decode As" to select a protocol if the hardcoded mapping fails.

mev-protos

Provided mev-protos are added to the Wireshark search path, solana_dissector will decode Solana Transactions occurring in bundles received via gRPC.

Development

• 🚧 Gossip protocol
  • Messages
    • ✅ Pull Request
    • ✅ Pull Response
    • ✅ Push Message
    • ✅ Prune Message
    • ✅ Ping Message
    • ✅ Pong Message
  • Types
    • ✅ Socket Address
    • ✅ Transaction (legacy)
    • ❌ Transaction (v0)
  • CRDS
    • ✅ Contact Info
    • ✅ Vote
      • ❌ Vote program data
    • ✅ Lowest Slot
    • ✅ Snapshot Hashes
    • ✅ Accounts Hashes
    • ✅ Epoch Slots
    • ✅ Legacy Version
    • ✅ Version
    • ✅ Node Instance
    • ❌ Duplicate Shred
    • ✅ Incremental Snapshot Hashes
• ✅ Shreds
  • ✅ Legacy Shreds
  • ✅ Merkle Shreds
  • ✅ Chained Merkle Shreds
  • ✅ Chained Resigned Merkle Shreds
  • ❌ FEC Recovery
• ✅ Repair
  • ✅ Legacy types
  • ✅ Pong
  • ✅ WindowIndex
  • ✅ HighestWindowIndex
  • ✅ Orphan
  • ✅ AncestorHashes
• ✅ TPU (UDP)
• 🚧 TPU (QUIC)
  • If solana-tpu QUIC traffic doesn't dissect, run "Reload Lua plugins"
• ✅ mev-protos