Elasticsearch http://www.elasticsearch.org/ is a distributed full-text search engine based on Lucene. It provides a RESTful HTTP API as well as a binary API for indexing and searching documents. Elasticsearch offers unicast and multicast discovery of nodes in a cluster.

Ports used

  • 9200 - TCP HTTP RESTful interface

  • 9300 - TCP Binary API and inter-cluster communications

  • 54328 - UDP Multicast discovery

Dissector status

Protocol type Dissection Notes
HTTP Full Passed to HTTP dissector
Discovery Full  
Binary Partial Actions, request/response type, request IDs, errors and packet length decoded.

Supported versions

In theory the dissector should work from versions of Elasticsearch >= 0.20.0RC1. This may change as the binary protocol gets more dissection work.

Example packet captures


The filter elasticsearch will include Discovery, HTTP and Binary protocols.

Code reviews

To do

  • There are 60-odd action requests that need to be decoded.
  • Request/responses can be compressed with LZ compression. Currently, Wireshark does not support LZ decompression (only gzip) so this needs to be introduced first.

Imported from https://wiki.wireshark.org/Elasticsearch on 2020-08-11 23:13:46 UTC