[HN Gopher] Show HN: A toy version of Wireshark (student project)
___________________________________________________________________
Show HN: A toy version of Wireshark (student project)
Hi everyone, I recently published a small open-source project.
It's a minimal network packet analyzer written in Go -- designed
more like a learning toy than a replacement for Wireshark. It
currently supports parsing basic protocols like TLS, DNS, and HTTP,
and includes a tiny fuzzing engine to test payload responses. You
can inspect raw packet content directly from the terminal. The
output is colored for readability, and the code structure is kept
simple and clear. The entire program is very small -- just about
400 lines of Go code. I know it's not anywhere near Wireshark's
level, and I still use Wireshark myself for real-world analysis.
But I built it as a personal experiment in network parsing and to
understand protocol behavior more directly. If you're curious or
would like to try it out, the project is here:
https://github.com/lixiasky/vanta I'm happy to hear your thoughts,
suggestions, or critiques. It's just a little network toy, but
maybe someone out there finds it useful or fun. Thanks for
reading!
Author : lixiasky
Score : 181 points
Date : 2025-06-02 15:20 UTC (7 hours ago)
(HTM) web link (github.com)
(TXT) w3m dump (github.com)
| dotaenjoyer322 wrote:
| Cool! Will definitely take a look.
|
| Curios what made you choose Go for this project? I am looking
| into building a toy version of Burp with either Rust/Go but still
| undecided.
| arbll wrote:
| For me the main reasons to pick Go in those context are cross-
| compilation, static binaries and more subjectively better
| productivity. You can very quickly get an MVP running and
| distribute it knowing it will work everywhere.
| rsync wrote:
| I appreciate the things you wrote at the end of the github
| page.
|
| I have no idea if you could make any use of such a thing,
| but, if you email info@rsync.net we would be happy to give a
| free-forever account to use in any way you see fit.
| duskwuff wrote:
| The user you're replying to isn't the author.
| danudey wrote:
| In this specific case, the 'static binaries' and 'cross-
| compilation' aspect aren't relevant, as vanta is a
| dynamically linked binary with multiple library dependencies;
| it has to link against libpcap, which also pulls in some
| infiniband libraries on my system, plus libdbus which pulls
| in libsystemd, libgcrypt, libgpg-error, libcap, and libs lz4,
| lzma, and zstd. In fact, the only library that tcpdump links
| against that vanta doesn't is libcrypto.
|
| Note that none of this has to do with vanta itself; it's
| solely because it depends on libpcap, and libpcap depends on
| all of those other libraries. Still, it does mean that cross-
| compiling isn't notably easier than just building tcpdump
| itself.
| jasonthorsness wrote:
| Go is great for tools like this. I've built MITM protocol
| analyzers a few times. Being able to completely customize the
| handling, analysis, and break in in the debugger can make it more
| useful than a super-capable but general-purpose tool like
| Wireshark.
| colesantiago wrote:
| This looks nice, perhaps name your project babyshark?
| qwertytyyuu wrote:
| ...
| mrbluecoat wrote:
| or Fanta
| 0xEF wrote:
| That one's taken, I think.
| mrbluecoat wrote:
| yes, that's the joke ;)
| poisonborz wrote:
| Have to say it would be worth making this project just for the
| sake of this pun alone.
| Andugal wrote:
| Yes especially since Vanta is an already well known company.
| ghc wrote:
| Oh no, I'm pretty sure Vanta is basically unknown compared to
| babyshark :)
|
| https://trends.google.com/trends/explore?date=today%205-y&q=.
| ..
| Bad_CRC wrote:
| na na na na na
| Kuraj wrote:
| At the risk of sounding boring, but be careful not to sacrifice
| searchability for this
| qmr wrote:
| Name it dootdoodoodootdoodo
| Hikikomori wrote:
| Cool! I did something similar when I wanted to learn Go, but did
| my own parsers instead of using gopacket, I would recommend doing
| that yourself if you want to learn more low level stuff.
|
| How I parsed IP for example: type Addr [4]uint8
| func (ip Addr) String() string { return
| fmt.Sprintf("%d.%d.%d.%d", ip[0], ip[1], ip[2], ip[3]) }
| type Hdr struct { Version uint8 IHL uint8
| DSCP uint8 ECN uint8 Length uint16
| Id uint16 Flags uint8 Fragoffset
| uint16 TTL uint8 Protocol uint8
| Checksum uint16 Src Addr Dst Addr
| } func (hdr *Hdr) Parse(d []byte) error {
| hdr.Version = uint8(d[0] >> 4) hdr.IHL = uint8(d[0] &
| 0x0f) hdr.DSCP = uint8(d[1] >> 6) hdr.ECN =
| uint8(d[1] & 0x03) hdr.Length =
| uint16(binary.BigEndian.Uint16(d[2:4])) hdr.Id =
| uint16(binary.BigEndian.Uint16(d[4:6])) hdr.Flags =
| uint8(d[6] >> 5) hdr.Fragoffset =
| uint16(binary.BigEndian.Uint16(d[6:8])) & 0x1fff hdr.TTL =
| d[8] hdr.Protocol = d[9] hdr.Checksum =
| uint16(binary.BigEndian.Uint16(d[10:12])) hdr.Src =
| Addr{d[12], d[13], d[14], d[15]} hdr.Dst = Addr{d[16],
| d[17], d[18], d[19]} if hdr.IHL > 5 {
| fmt.Println("extra options detected") // TODO: support for extra
| options } return nil }
| 0xbadcafebee wrote:
| Seconding this. Implementing low level protocols from scratch
| is a great introduction to network programming (do the kids
| today ever do network programming, or is it all just 15 layers
| of libraries on top of HTTP?). Good to understand the
| underpinnings of the systems you work with, and how subtly
| complex things get down there.
| thenthenthen wrote:
| Screenshots please!
| dang wrote:
| [stub for offtopicness]
| andygcook wrote:
| Congratulations on the launch! FYI there is a pretty well-known
| YC startup named Vanta that helps companies manage various
| security compliance certifications.
|
| Obviously, there are often different services that share the
| same name, but given that Vanta isn't an actual word in the
| English language, I would think this might be confusing for
| people.
|
| As a data point of one, I just assumed Vanta (the company) was
| doing a Show HN today and was confused at first glance.
| karambahh wrote:
| Yeah, and especially as Vanta is adjacent... I think a
| rebranding is in order.
|
| Vanta (and the auditors they market) is a nice company I'm
| happy user of but I'm afraid they won't be too pleased with
| this.
|
| Your project is a pretty nice overview of what network level
| monitoring encompasses, I'd say it's more than a tool, it has
| obvious educational value. Would be sad to see it buried
| under naming issues.
| philipwhiuk wrote:
| I'd argue they're both inspired by Vantablack.
| planetpluta wrote:
| > I just assumed Vanta (the company) was doing a Show HN
| today and was confused at first glance
|
| Did the title of the post change? At first glance the Show HN
| is a toy wireshark program very far from any Trust Management
| and compliance
| dang wrote:
| Yes, we changed it to try to stave off off-topic discussion
| about the name.
|
| The world is a big place. I bet this kid had no idea that
| the name was "taken"--either that or they assumed their
| project was so obviously different that no one would care.
|
| Little did they realize that internet discussions go into
| seizure about names under all too many conditions.
| chillpenguin wrote:
| Why are all of the comments about the name? The author
| literally said this is a toy project for educational
| purposes... There are thousands of projects on github. This
| isn't even the only other project named "vanta" on github (I
| just checked and there is an animation library for javascript
| called vanta). So, seriously, who cares?
|
| If OP was an actual company, that would be different. But this
| is quite literally a toy project.
|
| Anyway, congrats OP! Your project looks really cool.
| j1elo wrote:
| Yeah, it's like if one writes a tiny calculator and names it
| Disney to learn how to program in Delphi, it's a learning
| exercise with 0 commercial intent so who cares. But for those
| who care about the name vanta, get the G from Go and rename
| it to Ganta, problem solved :-)
|
| with the added benefit that the software family could be
| extended in the future with other learning exercises such as
| a Rust forum engine named Ranta
| 293984j29384 wrote:
| I agree. I was trying to use Vanta's trust management
| platform to prepare for an audit but instead downloaded
| Vanta, the toy version of Wireshark. It's very easy to mix up
| 400 lines of go code on github with the security platform on
| vanta.com.
|
| /s
| dang wrote:
| Most probably those other projects haven't been at #1 on HN
| or similar sites for long.
|
| I agree that having discussion get consumed by the name is
| unfortunate and off-topic. It's also predictable, alas
| (https://news.ycombinator.com/item?id=44161041) but we have
| various tricks to try to dampen it.
| idorube wrote:
| just please don't say "Founder/CEO of Vanta here" :-D
| accrual wrote:
| Sometimes I like to think of myself as the CEO of my life.
| Why yes, I'm the CEO and make all critical decisions around
| Me, LLC. However, the founders have disvested and retired in
| another city. :)
| mushufasa wrote:
| Note there's a popular cybersecurity company called "Vanta" to
| which they own the trademark, so the name probably should be
| changed to avoid confusion.
| Cockbrand wrote:
| This reads a bit like Linus' first annoucement, see
| https://en.wikipedia.org/wiki/History_of_Linux#:~:text=Hello... -
| godspeed to you, and let's see when you will take over :)
| dang wrote:
| I did a s/Vanta/you/ on this comment as part of trying to
| reduce the offtopic noise about the name. (More at
| https://news.ycombinator.com/item?id=44161041 and
| https://news.ycombinator.com/item?id=44161144.)
|
| I hope that's ok with you! The alternative would be to move it
| under https://news.ycombinator.com/item?id=44161021, but it's a
| really nice comment so I don't want to do that.
| Cockbrand wrote:
| Much appreciated, thank you! I'll also print and frame my
| first dang email :) It's a bit of a pity that the original
| description, which my comment refers to, is now gone.
| dang wrote:
| Not gone, just hidden under the rug :)
| worldsayshi wrote:
| Cool! I've sometimes gotten the impression that wireshark-lite is
| an unfulfilled niche so this is nice.
| thegoodduck wrote:
| https://github.com/thegoodduck/netsour
| op00to wrote:
| > This project is not just code -- it's a response. Amid
| political pressure, some universities like Harvard, MIT, and CMU
| stood up for international students.
|
| > I'm just an ordinary undergraduate with no resources or
| background. This is my way of responding -- not by petition, but
| through code. Vanta may be small, but it's real, and it's mine.
|
| This comes off as super ChatGPT-y to me. "X is not y -- it's Z!
| Preamble, passionate statement. Sycophantic encouraging statement
| -- list, of, a, few, things, but also this. Summarize statement,
| but this other thing, and saying the same thing again but in a
| slightly different way."
|
| I've given up on ChatGPT because of this style of writing.
| singiamtel wrote:
| It's the em dash that does it for me
| amingilani wrote:
| Friendly reminder that em and en dashes were part of English
| well before ChatGPT was launched. Anecdotally, I've been
| using them forever and English isn't even my native language.
| qmr wrote:
| I use em dashes, but always as two hyphens.
|
| I think this notion that em dash always means chatgpt is an
| overview correction.
| kstrauser wrote:
| AIs learned that from human because it's a normal, common bit
| of punctuation they see frequently.
|
| AIs also use the word "the" frequently.
| moffkalast wrote:
| A small Wireshark? A... baby shark?
| rezmason wrote:
| A toy Wireshark. A Blahaj!
| qmr wrote:
| Doot doo doo doot doo do
| BobbyTables2 wrote:
| Now you'll just have to figure out how to implement all of the
| vulnerabilities historically present in wireshark parsers! /s
___________________________________________________________________
(page generated 2025-06-02 23:00 UTC)