bitcoin-dissector with wireshark

[sanner]

Hello,

I was asked to prepare a school project on distributed systems.
I would like to analyze the Bitcoin protocol and capture transactions in real time. so I thought to do so by sniffing through WIRESHARK.
So I checked for filter/dissector and found repository authored by "blueCommand":

'bitcoin-dissector' https://github.com/blueCommand/bitcoin-dissector

Is there anyone here who has an idea how to deal with it, and know how to compile and run it?

i'll appreciate your help!
 

[voneiden]

If you're running linux..

I'd give it a shot with the old public release of wireshark; http://wiresharkdownloads.riverbed.com/wireshark/src/wireshark-1.6.15.tar.bz2 and then just follow the readme on the github.

If you're running windows, uh.. try something completely different. What's your level of understanding on packet sniffing? Would it be enough to observe the transactions going live on blockchain.info?

[sanner]

Well i manage to compile '/packet-bitcoin.c'
but when i run this command :
 * patch -p0 < ~/bitcoin-dissector/wireshark-make.patch
i get this error:

Code:

patching file epan/dissectors/Makefile.common
Hunk #1 FAILED at 274.
1 out of 1 hunk FAILED -- saving rejects to file epan/dissectors/Makefile.common.rej

What do i miss?

[marjan-]

This one is newer, and might be a better choice (did not try it myself):
https://github.com/lbotsch/wireshark-bitcoin/blob/master/README

[sanner]

Well i'm having a compiling problem in linux:

whenever i'm trying to install pkgs like - GTK+, glib etc. i get this error:

Code:

./configure

and then:

Code:

make
make: *** No targets specified and no makefile found.  Stop.

and i have makefile in the directory, i tried with
make -f makefile
 &
make -f Makefile
 
but i get :

Code:

make:*** No rule to make target `Makefile'.  Stop.

what is it then?

[bitanalyst]

The latest Developers Edition of Wireshark (1.10.0rc2) has support for the Bitcoin protocol.  I tested the 64 bit version on Windows 7 and I was successfully able to decode traffic.

http://www.wireshark.org/download.html#development-rel

I also compiled the newest version of the Developers Edition (1.11) from the source tree and the Bitcoin dissector was partially broken so for now I would recommend using the version from their site.

[sanner]

thanks!! ill give it a shot