Skip to content

a tcpdump-like tool for automatically decoding Protobuf in the gRPC h2c protocol

Notifications You must be signed in to change notification settings

kkHAIKE/grpcdump

Repository files navigation

grpcdump

This is a tcpdump-like tool for automatically decoding Protobuf in the gRPC h2c protocol.

feature

  • h2c capture & decode
  • auto decoding of Protobuf in gRPC using the Reflection service
  • manual specification of the Proto file if reflection is not registered
  • simple BPF compiler for pure go build (linux only)

preview

<path header is add by this tool show

usage

This tool has one required parameter -i, which allows you to choose your interface, similar to tcpdump.

However, in production environments, you should use pcap-filter to reduce memory consumption, just like tcpdump.

By default, this tool does not decode the TCP stream on-the-fly (since HPACK requires the TCP connection to be established before capture).

parameter short description
interface i same as tcpdump
snapshot-length s same as tcpdump
path-regex P focus to show
force enable on-the-fly decode(use with pcap-filter)
hide-no-path non-path packet can't decode
proto-include I use like protoc -I
proto-file f proto relative path about proto-include

some case

use with my test cmd

  1. ./test + ./test -client: grpcdump -i any -P "/test\.Foo/Bar" "host 127.0.0.1 and port 9000"
  2. ./test -ref=false + ./test -client: grpcdump -i lo0 -P "/test\.Foo/Bar" -I .. -f grpcdump/test/pb/foo.proto "host 127.0.0.1 and port 9000"

require

  1. mac/win: install Wireshark or only install ChmodBPF.pkg
  2. linux: need libpcap-dev

About

a tcpdump-like tool for automatically decoding Protobuf in the gRPC h2c protocol

Topics

Resources

Stars

Watchers

Forks

Packages

No packages published