Network – How to identify Bitcoin/Lightning P2P packets using Wireshark

Run regtest on two nodes using different ports.

bitcoind -regtest=1 -port=18333 -datadir=/home/satoshi/node1

bitcoind -regtest=1 -port=18444 -datadir=/home/satoshi/node2

Add node1 to node2’s outbound connection

addnode "127.0.0.1:18333" "add"

Launch Wireshark and select the adapter for capturing loopback traffic. You will see some packets containing the ‘Bitcoin’ protocol.

Example: This is the INV message sent by node2 to node1 when a block was created using: generatetoaddress 10 bcrt1qugkqq2a3lhf58e4pclcf52dgd4e02hpve3vhzs

Please note that Wireshark has included the ability to decode Bitcoin Protocol packets since version 1.10.