get the binary data transferred from grpc client

Question

I am new to gRPC framework, and I have created a sample client-server on my PC (referring to this).

In my client-server application I have implemented a simple RPC

service NameStudent {
  rpc GetRoll(RollNo) returns (Details) {}
}

The client sends a RollNo and receives his/her details which are name, age, gender, parent name, and roll no.

message RollNo{
    int32 roll = 1;
}

message Details {
    string name = 1;
    string gender = 2;
    int32 age = 3;
    string parent = 4;
    RollNo rollid = 5;
}

The actual server and client codes are adaptation of the sample code explained here

Now my server is able to listen to "0.0.0.0:50051(address:port)" and client is able to send the roll no on "localhost:50051" and receive the details.

I want to see the actual binary data that is transferred between client and server. i have tried using Wireshark, but I don't understand what I am seeing here.

Here is the screenshot of wireshark capture

And here are the details of highlighted entry from above screenshot.

Need help in understanding wireshark here, Or any other way that can be used to see the binary data.

Answer 1

Wireshark uses the port to determine how to decode the communication, and it doesn't know any protocol associated with 50051. So you need to configure it to treat this as HTTP.

Right click on a row and select "Decode As..." in the context menu.

Then set "Current" to "HTTP" or "HTTP2" (HTTP will generally auto-detect HTTP2) and hit "OK".

Then the HTTP/2 frames should be decoded. And if using a recent version of Wireshark, you may also see the gRPC frames decoded.

Answer 2

The whole idea of grpc is to HIDE that. Let's say we ignore that and you know what you're doing.

• Look at https://en.wikipedia.org/wiki/Protocol_Buffers. gRPC uses Protocol Buffers for it's data representation. You might get a hint at the data you're seeing.

Two good starting points for a reverse engineer exercise are:

• Start simple: compile a program that sends an integer. Understand it. Sniff it. Then compile a program that sends a string. Try several values. Once you understand it, pass to tacke the problem of understanding how's google sending your structure.

• Use known data and do small variations: knowing what 505249... means is easier if you start knowing the data you're sending (as an example, send "Hello world" string; then change it to "Hella world"; see what changes on the coded sniff; also check that sending several times the same data produces the same sniffed output). Apply prior point: start simple, first empty string, then " ", then "a", then "b", etc. and then pass to complex and larger strings. Don't be affraid to start simple.