{"id":9374,"date":"2020-10-22T10:00:18","date_gmt":"2020-10-22T17:00:18","guid":{"rendered":"https:\/\/www.couchbase.com\/blog\/?p=9374"},"modified":"2020-10-25T01:01:30","modified_gmt":"2020-10-25T08:01:30","slug":"cbl-sync-protocol-examination-via-wireshark","status":"publish","type":"post","link":"https:\/\/www.couchbase.com\/blog\/cbl-sync-protocol-examination-via-wireshark\/","title":{"rendered":"Couchbase Lite Sync Protocol Examination via Wireshark"},"content":{"rendered":"<p>During the course of development it is often useful to examine what exactly is sent over the network between machines.\u00a0 This helps to perform tasks like finding the source of an issue or just simply understanding the conversation.\u00a0 Often times the conversation uses a well known protocol like HTTP.\u00a0 However, for Couchbase Mobile 2.0 and higher, the conversation takes place using a sync protocol called <a href=\"https:\/\/github.com\/couchbase\/couchbase-lite-core\/blob\/7bb2cff39f79168340dfde02a16ec7d9394d7e56\/Networking\/BLIP\/docs\/BLIP%20Protocol.md\">BLIP<\/a>, transported via web socket.\u00a0 You might think that this makes the conversation entirely opaque, but actually <a href=\"https:\/\/www.wireshark.org\/#download\">wireshark<\/a> is able to analyze BLIP messages.\u00a0 Let&#8217;s take a quick look at how to do this.<\/p>\n<p>Before we get into that, however, I need to disclaim something.\u00a0 The information here is presented purely for educational purposes.\u00a0 You should not rely on this format always being the same.\u00a0 We at Couchbase have no contract with consumers about it, and it is subject to change.\u00a0 However, sometimes it is still nice to be able to see what is going on.<\/p>\n<p><!--more--><\/p>\n<h4>Filtering On BLIP<\/h4>\n<p>This post will assume that you know the basics of how to use wireshark.\u00a0 Any version 3.0.0 or higher is able to be used, but earlier versions have a bug that can cause a crash on large compressed messages so 3.2.7+ \/ 3.0.14+ is recommended.\u00a0 You should be familiar with how to start a network capture.\u00a0 This post starts assuming that you have already made one.\u00a0 When we open your capture to examine, you may see something like the following image.<\/p>\n<div id=\"attachment_9376\" style=\"width: 910px\" class=\"wp-caption aligncenter\"><a href=\"https:\/\/www.couchbase.com\/blog\/wp-content\/uploads\/2020\/09\/Wireshark_Unfiltered.png\"><img loading=\"lazy\" decoding=\"async\" aria-describedby=\"caption-attachment-9376\" class=\"size-large wp-image-9376\" src=\"https:\/\/www.couchbase.com\/blog\/wp-content\/uploads\/2020\/09\/Wireshark_Unfiltered-1024x205.png\" alt=\"A wireshark trace without a filter\" width=\"900\" height=\"180\" srcset=\"https:\/\/www.couchbase.com\/blog\/wp-content\/uploads\/sites\/1\/2020\/09\/Wireshark_Unfiltered-1024x205.png 1024w, https:\/\/www.couchbase.com\/blog\/wp-content\/uploads\/sites\/1\/2020\/09\/Wireshark_Unfiltered-300x60.png 300w, https:\/\/www.couchbase.com\/blog\/wp-content\/uploads\/sites\/1\/2020\/09\/Wireshark_Unfiltered-768x154.png 768w, https:\/\/www.couchbase.com\/blog\/wp-content\/uploads\/sites\/1\/2020\/09\/Wireshark_Unfiltered-1536x308.png 1536w, https:\/\/www.couchbase.com\/blog\/wp-content\/uploads\/sites\/1\/2020\/09\/Wireshark_Unfiltered-2048x410.png 2048w, https:\/\/www.couchbase.com\/blog\/wp-content\/uploads\/sites\/1\/2020\/09\/Wireshark_Unfiltered-20x4.png 20w, https:\/\/www.couchbase.com\/blog\/wp-content\/uploads\/sites\/1\/2020\/09\/Wireshark_Unfiltered-1320x264.png 1320w\" sizes=\"auto, (max-width: 900px) 100vw, 900px\" \/><\/a><p id=\"caption-attachment-9376\" class=\"wp-caption-text\">This is the view you will probably see when you open a new trace<\/p><\/div>\n<p>This is because we have not set any filters yet.\u00a0 Every packet of every type is currently visible. If you notice, near the top is a text box with the hint text &#8220;Apply a display filter&#8221; in it.\u00a0 BLIP is a supported packet format, and you can set a filter to show only BLIP messages.<\/p>\n<div id=\"attachment_9377\" style=\"width: 910px\" class=\"wp-caption aligncenter\"><a href=\"https:\/\/www.couchbase.com\/blog\/wp-content\/uploads\/2020\/09\/Wireshark_BLIP_Filtered.png\"><img loading=\"lazy\" decoding=\"async\" aria-describedby=\"caption-attachment-9377\" class=\"size-large wp-image-9377\" src=\"https:\/\/www.couchbase.com\/blog\/wp-content\/uploads\/2020\/09\/Wireshark_BLIP_Filtered-1024x202.png\" alt=\"A wireshark trace filtered to BLIP\" width=\"900\" height=\"178\" srcset=\"https:\/\/www.couchbase.com\/blog\/wp-content\/uploads\/sites\/1\/2020\/09\/Wireshark_BLIP_Filtered-1024x202.png 1024w, https:\/\/www.couchbase.com\/blog\/wp-content\/uploads\/sites\/1\/2020\/09\/Wireshark_BLIP_Filtered-300x59.png 300w, https:\/\/www.couchbase.com\/blog\/wp-content\/uploads\/sites\/1\/2020\/09\/Wireshark_BLIP_Filtered-768x152.png 768w, https:\/\/www.couchbase.com\/blog\/wp-content\/uploads\/sites\/1\/2020\/09\/Wireshark_BLIP_Filtered-1536x303.png 1536w, https:\/\/www.couchbase.com\/blog\/wp-content\/uploads\/sites\/1\/2020\/09\/Wireshark_BLIP_Filtered-2048x405.png 2048w, https:\/\/www.couchbase.com\/blog\/wp-content\/uploads\/sites\/1\/2020\/09\/Wireshark_BLIP_Filtered-20x4.png 20w, https:\/\/www.couchbase.com\/blog\/wp-content\/uploads\/sites\/1\/2020\/09\/Wireshark_BLIP_Filtered-1320x261.png 1320w\" sizes=\"auto, (max-width: 900px) 100vw, 900px\" \/><\/a><p id=\"caption-attachment-9377\" class=\"wp-caption-text\">Now things look more manageable, showing only the BLIP conversation.<\/p><\/div>\n<p>One caveat to this is that since BLIP uses web sockets, it cannot be decoded if the entire conversation is not present.\u00a0 In other words, the initial HTTP request for the web socket must be present.\u00a0 For example, if you change the filter to <code>blip || http<\/code> then you can see the first HTTP message in this conversation.<\/p>\n<div id=\"attachment_9378\" style=\"width: 910px\" class=\"wp-caption aligncenter\"><a href=\"https:\/\/www.couchbase.com\/blog\/wp-content\/uploads\/2020\/09\/Wireshark_BLIP_HTTP_Filtered.png\"><img loading=\"lazy\" decoding=\"async\" aria-describedby=\"caption-attachment-9378\" class=\"size-large wp-image-9378\" src=\"https:\/\/www.couchbase.com\/blog\/wp-content\/uploads\/2020\/09\/Wireshark_BLIP_HTTP_Filtered-1024x201.png\" alt=\"A wireshark trace filtered to BLIP and HTTP\" width=\"900\" height=\"177\" srcset=\"https:\/\/www.couchbase.com\/blog\/wp-content\/uploads\/sites\/1\/2020\/09\/Wireshark_BLIP_HTTP_Filtered-1024x201.png 1024w, https:\/\/www.couchbase.com\/blog\/wp-content\/uploads\/sites\/1\/2020\/09\/Wireshark_BLIP_HTTP_Filtered-300x59.png 300w, https:\/\/www.couchbase.com\/blog\/wp-content\/uploads\/sites\/1\/2020\/09\/Wireshark_BLIP_HTTP_Filtered-768x151.png 768w, https:\/\/www.couchbase.com\/blog\/wp-content\/uploads\/sites\/1\/2020\/09\/Wireshark_BLIP_HTTP_Filtered-1536x302.png 1536w, https:\/\/www.couchbase.com\/blog\/wp-content\/uploads\/sites\/1\/2020\/09\/Wireshark_BLIP_HTTP_Filtered-2048x403.png 2048w, https:\/\/www.couchbase.com\/blog\/wp-content\/uploads\/sites\/1\/2020\/09\/Wireshark_BLIP_HTTP_Filtered-20x4.png 20w, https:\/\/www.couchbase.com\/blog\/wp-content\/uploads\/sites\/1\/2020\/09\/Wireshark_BLIP_HTTP_Filtered-1320x260.png 1320w\" sizes=\"auto, (max-width: 900px) 100vw, 900px\" \/><\/a><p id=\"caption-attachment-9378\" class=\"wp-caption-text\">Note the two green entries at the top, which show a request\/response HTTP message for a web socket.<\/p><\/div>\n<h4>Message Details<\/h4>\n<p>So now that a BLIP conversation is here, what is inside of a BLIP message?\u00a0 To answer that question, let&#8217;s examine the contents of a typical BLIP message:<\/p>\n<div id=\"attachment_9413\" style=\"width: 910px\" class=\"wp-caption aligncenter\"><a href=\"https:\/\/www.couchbase.com\/blog\/wp-content\/uploads\/2020\/10\/Wireshark_BLIP_Details.png\"><img loading=\"lazy\" decoding=\"async\" aria-describedby=\"caption-attachment-9413\" class=\"size-large wp-image-9413\" src=\"https:\/\/www.couchbase.com\/blog\/wp-content\/uploads\/2020\/10\/Wireshark_BLIP_Details-1024x158.png\" alt=\"Details of a BLIP message\" width=\"900\" height=\"139\" srcset=\"https:\/\/www.couchbase.com\/blog\/wp-content\/uploads\/sites\/1\/2020\/10\/Wireshark_BLIP_Details-1024x158.png 1024w, https:\/\/www.couchbase.com\/blog\/wp-content\/uploads\/sites\/1\/2020\/10\/Wireshark_BLIP_Details-300x46.png 300w, https:\/\/www.couchbase.com\/blog\/wp-content\/uploads\/sites\/1\/2020\/10\/Wireshark_BLIP_Details-768x118.png 768w, https:\/\/www.couchbase.com\/blog\/wp-content\/uploads\/sites\/1\/2020\/10\/Wireshark_BLIP_Details-1536x237.png 1536w, https:\/\/www.couchbase.com\/blog\/wp-content\/uploads\/sites\/1\/2020\/10\/Wireshark_BLIP_Details-2048x315.png 2048w, https:\/\/www.couchbase.com\/blog\/wp-content\/uploads\/sites\/1\/2020\/10\/Wireshark_BLIP_Details-20x3.png 20w, https:\/\/www.couchbase.com\/blog\/wp-content\/uploads\/sites\/1\/2020\/10\/Wireshark_BLIP_Details-1320x203.png 1320w\" sizes=\"auto, (max-width: 900px) 100vw, 900px\" \/><\/a><p id=\"caption-attachment-9413\" class=\"wp-caption-text\">The contents of a typical BLIP message.<\/p><\/div>\n<p>From top to bottom we have the following items:<\/p>\n<ul>\n<li>Message Number &#8211; Basically the ID of the message being referred to.\u00a0 This is important for the next section.<\/li>\n<li>Frame Flags &#8211; Some metadata information about the message (In this example, the body is compressed and it is urgent.\u00a0 This means that it will be handled out of order.)<\/li>\n<li>Properties Length &#8211; The length of the properties of the message (The properties are encoding as a length entry, followed by the data of the given length)<\/li>\n<li>Properties &#8211; The properties of the message (A collection of key value pairs)<\/li>\n<li>Message Body &#8211; The actual content of the message.\u00a0 It occupies the entire rest of the message, except for the last 4 bytes.<\/li>\n<li>Checksum &#8211; A checksum value is written to ensure that the message is received in the order it was sent, and that the packet contents have not been malformed<\/li>\n<\/ul>\n<p>There are 6 types of messages that can be sent, indicated by the way they are marked in the list of packets:<\/p>\n<ul>\n<li>MSG &#8211; A new message<\/li>\n<li>RPY &#8211; A [normal] reply to a received message<\/li>\n<li>ERR &#8211; An error reply to a received message<\/li>\n<li>ACKMSG &#8211; Progress acknowledgement for receiving a long multi packet message<\/li>\n<li>ACKRPY &#8211; Progress acknowledgement for receiving a long multi packet reply<\/li>\n<\/ul>\n<h4>Following a Conversation<\/h4>\n<p>For the purposes of following a given conversation, an important thing to take into account is that both sides can initiate a message.\u00a0 This will show up in the list of messages in wireshark as <code>MSG#{NUM}<\/code>.\u00a0 The way to tell which side sent the message is to look at the source and destination IP addresses.\u00a0 For example, two diagrams up you can see <code>MSG#2<\/code> as the third message in the list.\u00a0 You can also see <code>MSG#2<\/code> as the second to last message in the list.\u00a0 The difference is that the first entry has the source IP as 192.168.33.1 and the destination IP as 192.168.33.11, and the latter is reversed.\u00a0 This indicates the first message is a message that Couchbase Lite sent to Sync Gateway because in my setup the Sync Gateway instance is running at 192.168.33.11.\u00a0 The second is the opposite, a message that Sync Gateway sent to Couchbase Lite.<\/p>\n<p>After receiving a message one of three things will occur:<\/p>\n<ol>\n<li>The message is received, executed, and finishes normally.\u00a0 In this case, a reply message will be sent with the same message number as the received message.\u00a0 So for example, <code>MSG#2<\/code> will get a <code>RPY#2<\/code> (with the source and destination IP reversed).<\/li>\n<li>The message is received, but cannot complete normally.\u00a0 In this case, an error message will be sent with the same conditions as #1.<\/li>\n<li>The message has a <code>NoReply<\/code> flag in its flags.\u00a0 In this case, no response is sent.<\/li>\n<\/ol>\n<p>Using the above, we can see that in the message list, the message immediately following the first <code>MSG#2<\/code> is <code>RPY#2<\/code> and thus it is the reply to the message.\u00a0 Similarly, the first <code>MSG#1<\/code> has an <code>ERR#1<\/code> reply, indicating that it finished with an error.\u00a0 This method is applicable to both sides of the conversation, so it should be easy to track the back and forth messages in a given BLIP conversation.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>During the course of development it is often useful to examine what exactly is sent over the network between machines.\u00a0 This helps to perform tasks like finding the source of an issue or just simply understanding the conversation.\u00a0 Often times [&hellip;]<\/p>\n","protected":false},"author":67726,"featured_media":9525,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"inline_featured_image":false,"footnotes":""},"categories":[1810],"tags":[2034,1331,1562],"ppma_author":[9118],"class_list":["post-9374","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-couchbase-mobile","tag-blip","tag-network","tag-replication"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v25.7.1 (Yoast SEO v25.7) - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Couchbase Lite Sync Protocol Examination via Wireshark - The Couchbase Blog<\/title>\n<meta name=\"description\" content=\"Wireshark has the ability to analyze sync protocol messages that occur during Couchbase Lite and Sync Gateway Replication. Find out how to make use of that!\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.couchbase.com\/blog\/cbl-sync-protocol-examination-via-wireshark\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Couchbase Lite Sync Protocol Examination via Wireshark\" \/>\n<meta property=\"og:description\" content=\"Wireshark has the ability to analyze BLIP messages that occur during Couchbase Lite and Sync Gateway Replication. Find out how to make use of that!\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.couchbase.com\/blog\/cbl-sync-protocol-examination-via-wireshark\/\" \/>\n<meta property=\"og:site_name\" content=\"The Couchbase Blog\" \/>\n<meta property=\"article:published_time\" content=\"2020-10-22T17:00:18+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2020-10-25T08:01:30+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.couchbase.com\/blog\/wp-content\/uploads\/2020\/10\/Couchbase-Lite-Sync-Protocol-Examination-via-Wireshark.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t<meta property=\"og:image:height\" content=\"627\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Jim Borden, Principal Software Engineer, Couchbase\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:description\" content=\"Wireshark has the ability to analyze BLIP messages that occur during Couchbase Lite and Sync Gateway Replication. Find out how to make use of that!\" \/>\n<meta name=\"twitter:image\" content=\"https:\/\/www.couchbase.com\/blog\/wp-content\/uploads\/sites\/1\/2020\/10\/Couchbase-Lite-Sync-Protocol-Examination-via-Wireshark-1.png\" \/>\n<meta name=\"twitter:creator\" content=\"@borrrden\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Jim Borden, Principal Software Engineer, Couchbase\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.couchbase.com\/blog\/cbl-sync-protocol-examination-via-wireshark\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.couchbase.com\/blog\/cbl-sync-protocol-examination-via-wireshark\/\"},\"author\":{\"name\":\"Jim Borden, Senior Software Engineer, Couchbase\",\"@id\":\"https:\/\/www.couchbase.com\/blog\/#\/schema\/person\/403326eb3d3a8dfbdce18e17ba917f5b\"},\"headline\":\"Couchbase Lite Sync Protocol Examination via Wireshark\",\"datePublished\":\"2020-10-22T17:00:18+00:00\",\"dateModified\":\"2020-10-25T08:01:30+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.couchbase.com\/blog\/cbl-sync-protocol-examination-via-wireshark\/\"},\"wordCount\":982,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/www.couchbase.com\/blog\/#organization\"},\"image\":{\"@id\":\"https:\/\/www.couchbase.com\/blog\/cbl-sync-protocol-examination-via-wireshark\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.couchbase.com\/blog\/wp-content\/uploads\/sites\/1\/2020\/10\/Wireshark_BLIP_Featured.png\",\"keywords\":[\"BLIP\",\"network\",\"replication\"],\"articleSection\":[\"Couchbase Mobile\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/www.couchbase.com\/blog\/cbl-sync-protocol-examination-via-wireshark\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.couchbase.com\/blog\/cbl-sync-protocol-examination-via-wireshark\/\",\"url\":\"https:\/\/www.couchbase.com\/blog\/cbl-sync-protocol-examination-via-wireshark\/\",\"name\":\"Couchbase Lite Sync Protocol Examination via Wireshark - The Couchbase Blog\",\"isPartOf\":{\"@id\":\"https:\/\/www.couchbase.com\/blog\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.couchbase.com\/blog\/cbl-sync-protocol-examination-via-wireshark\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.couchbase.com\/blog\/cbl-sync-protocol-examination-via-wireshark\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.couchbase.com\/blog\/wp-content\/uploads\/sites\/1\/2020\/10\/Wireshark_BLIP_Featured.png\",\"datePublished\":\"2020-10-22T17:00:18+00:00\",\"dateModified\":\"2020-10-25T08:01:30+00:00\",\"description\":\"Wireshark has the ability to analyze sync protocol messages that occur during Couchbase Lite and Sync Gateway Replication. Find out how to make use of that!\",\"breadcrumb\":{\"@id\":\"https:\/\/www.couchbase.com\/blog\/cbl-sync-protocol-examination-via-wireshark\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.couchbase.com\/blog\/cbl-sync-protocol-examination-via-wireshark\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.couchbase.com\/blog\/cbl-sync-protocol-examination-via-wireshark\/#primaryimage\",\"url\":\"https:\/\/www.couchbase.com\/blog\/wp-content\/uploads\/sites\/1\/2020\/10\/Wireshark_BLIP_Featured.png\",\"contentUrl\":\"https:\/\/www.couchbase.com\/blog\/wp-content\/uploads\/sites\/1\/2020\/10\/Wireshark_BLIP_Featured.png\",\"width\":1200,\"height\":628},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.couchbase.com\/blog\/cbl-sync-protocol-examination-via-wireshark\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.couchbase.com\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Couchbase Lite Sync Protocol Examination via Wireshark\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.couchbase.com\/blog\/#website\",\"url\":\"https:\/\/www.couchbase.com\/blog\/\",\"name\":\"The Couchbase Blog\",\"description\":\"Couchbase, the NoSQL Database\",\"publisher\":{\"@id\":\"https:\/\/www.couchbase.com\/blog\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.couchbase.com\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.couchbase.com\/blog\/#organization\",\"name\":\"The Couchbase Blog\",\"url\":\"https:\/\/www.couchbase.com\/blog\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.couchbase.com\/blog\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.couchbase.com\/blog\/wp-content\/uploads\/2023\/04\/admin-logo.png\",\"contentUrl\":\"https:\/\/www.couchbase.com\/blog\/wp-content\/uploads\/2023\/04\/admin-logo.png\",\"width\":218,\"height\":34,\"caption\":\"The Couchbase Blog\"},\"image\":{\"@id\":\"https:\/\/www.couchbase.com\/blog\/#\/schema\/logo\/image\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.couchbase.com\/blog\/#\/schema\/person\/403326eb3d3a8dfbdce18e17ba917f5b\",\"name\":\"Jim Borden, Senior Software Engineer, Couchbase\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.couchbase.com\/blog\/#\/schema\/person\/image\/f60249485b16e1dc6d0219a0c47e54d7\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/1c1fb225bfe3fe6743ca2bd8091dcead38558b2d4164003772042f8e12cdfccb?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/1c1fb225bfe3fe6743ca2bd8091dcead38558b2d4164003772042f8e12cdfccb?s=96&d=mm&r=g\",\"caption\":\"Jim Borden, Senior Software Engineer, Couchbase\"},\"description\":\"Senior Software Engineer @ Couchbase working on Couchbase Lite.\",\"sameAs\":[\"https:\/\/x.com\/borrrden\"],\"url\":\"https:\/\/www.couchbase.com\/blog\/author\/jim-borden\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Couchbase Lite Sync Protocol Examination via Wireshark - The Couchbase Blog","description":"Wireshark has the ability to analyze sync protocol messages that occur during Couchbase Lite and Sync Gateway Replication. Find out how to make use of that!","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.couchbase.com\/blog\/cbl-sync-protocol-examination-via-wireshark\/","og_locale":"en_US","og_type":"article","og_title":"Couchbase Lite Sync Protocol Examination via Wireshark","og_description":"Wireshark has the ability to analyze BLIP messages that occur during Couchbase Lite and Sync Gateway Replication. Find out how to make use of that!","og_url":"https:\/\/www.couchbase.com\/blog\/cbl-sync-protocol-examination-via-wireshark\/","og_site_name":"The Couchbase Blog","article_published_time":"2020-10-22T17:00:18+00:00","article_modified_time":"2020-10-25T08:01:30+00:00","og_image":[{"width":1200,"height":627,"url":"https:\/\/www.couchbase.com\/blog\/wp-content\/uploads\/2020\/10\/Couchbase-Lite-Sync-Protocol-Examination-via-Wireshark.png","type":"image\/png"}],"author":"Jim Borden, Principal Software Engineer, Couchbase","twitter_card":"summary_large_image","twitter_description":"Wireshark has the ability to analyze BLIP messages that occur during Couchbase Lite and Sync Gateway Replication. Find out how to make use of that!","twitter_image":"https:\/\/www.couchbase.com\/blog\/wp-content\/uploads\/sites\/1\/2020\/10\/Couchbase-Lite-Sync-Protocol-Examination-via-Wireshark-1.png","twitter_creator":"@borrrden","twitter_misc":{"Written by":"Jim Borden, Principal Software Engineer, Couchbase","Est. reading time":"5 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.couchbase.com\/blog\/cbl-sync-protocol-examination-via-wireshark\/#article","isPartOf":{"@id":"https:\/\/www.couchbase.com\/blog\/cbl-sync-protocol-examination-via-wireshark\/"},"author":{"name":"Jim Borden, Senior Software Engineer, Couchbase","@id":"https:\/\/www.couchbase.com\/blog\/#\/schema\/person\/403326eb3d3a8dfbdce18e17ba917f5b"},"headline":"Couchbase Lite Sync Protocol Examination via Wireshark","datePublished":"2020-10-22T17:00:18+00:00","dateModified":"2020-10-25T08:01:30+00:00","mainEntityOfPage":{"@id":"https:\/\/www.couchbase.com\/blog\/cbl-sync-protocol-examination-via-wireshark\/"},"wordCount":982,"commentCount":0,"publisher":{"@id":"https:\/\/www.couchbase.com\/blog\/#organization"},"image":{"@id":"https:\/\/www.couchbase.com\/blog\/cbl-sync-protocol-examination-via-wireshark\/#primaryimage"},"thumbnailUrl":"https:\/\/www.couchbase.com\/blog\/wp-content\/uploads\/sites\/1\/2020\/10\/Wireshark_BLIP_Featured.png","keywords":["BLIP","network","replication"],"articleSection":["Couchbase Mobile"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.couchbase.com\/blog\/cbl-sync-protocol-examination-via-wireshark\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.couchbase.com\/blog\/cbl-sync-protocol-examination-via-wireshark\/","url":"https:\/\/www.couchbase.com\/blog\/cbl-sync-protocol-examination-via-wireshark\/","name":"Couchbase Lite Sync Protocol Examination via Wireshark - The Couchbase Blog","isPartOf":{"@id":"https:\/\/www.couchbase.com\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.couchbase.com\/blog\/cbl-sync-protocol-examination-via-wireshark\/#primaryimage"},"image":{"@id":"https:\/\/www.couchbase.com\/blog\/cbl-sync-protocol-examination-via-wireshark\/#primaryimage"},"thumbnailUrl":"https:\/\/www.couchbase.com\/blog\/wp-content\/uploads\/sites\/1\/2020\/10\/Wireshark_BLIP_Featured.png","datePublished":"2020-10-22T17:00:18+00:00","dateModified":"2020-10-25T08:01:30+00:00","description":"Wireshark has the ability to analyze sync protocol messages that occur during Couchbase Lite and Sync Gateway Replication. Find out how to make use of that!","breadcrumb":{"@id":"https:\/\/www.couchbase.com\/blog\/cbl-sync-protocol-examination-via-wireshark\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.couchbase.com\/blog\/cbl-sync-protocol-examination-via-wireshark\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.couchbase.com\/blog\/cbl-sync-protocol-examination-via-wireshark\/#primaryimage","url":"https:\/\/www.couchbase.com\/blog\/wp-content\/uploads\/sites\/1\/2020\/10\/Wireshark_BLIP_Featured.png","contentUrl":"https:\/\/www.couchbase.com\/blog\/wp-content\/uploads\/sites\/1\/2020\/10\/Wireshark_BLIP_Featured.png","width":1200,"height":628},{"@type":"BreadcrumbList","@id":"https:\/\/www.couchbase.com\/blog\/cbl-sync-protocol-examination-via-wireshark\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.couchbase.com\/blog\/"},{"@type":"ListItem","position":2,"name":"Couchbase Lite Sync Protocol Examination via Wireshark"}]},{"@type":"WebSite","@id":"https:\/\/www.couchbase.com\/blog\/#website","url":"https:\/\/www.couchbase.com\/blog\/","name":"The Couchbase Blog","description":"Couchbase, the NoSQL Database","publisher":{"@id":"https:\/\/www.couchbase.com\/blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.couchbase.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.couchbase.com\/blog\/#organization","name":"The Couchbase Blog","url":"https:\/\/www.couchbase.com\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.couchbase.com\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.couchbase.com\/blog\/wp-content\/uploads\/2023\/04\/admin-logo.png","contentUrl":"https:\/\/www.couchbase.com\/blog\/wp-content\/uploads\/2023\/04\/admin-logo.png","width":218,"height":34,"caption":"The Couchbase Blog"},"image":{"@id":"https:\/\/www.couchbase.com\/blog\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/www.couchbase.com\/blog\/#\/schema\/person\/403326eb3d3a8dfbdce18e17ba917f5b","name":"Jim Borden, Senior Software Engineer, Couchbase","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.couchbase.com\/blog\/#\/schema\/person\/image\/f60249485b16e1dc6d0219a0c47e54d7","url":"https:\/\/secure.gravatar.com\/avatar\/1c1fb225bfe3fe6743ca2bd8091dcead38558b2d4164003772042f8e12cdfccb?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/1c1fb225bfe3fe6743ca2bd8091dcead38558b2d4164003772042f8e12cdfccb?s=96&d=mm&r=g","caption":"Jim Borden, Senior Software Engineer, Couchbase"},"description":"Senior Software Engineer @ Couchbase working on Couchbase Lite.","sameAs":["https:\/\/x.com\/borrrden"],"url":"https:\/\/www.couchbase.com\/blog\/author\/jim-borden\/"}]}},"authors":[{"term_id":9118,"user_id":67726,"is_guest":0,"slug":"jim-borden","display_name":"Jim Borden, Principal Software Engineer, Couchbase","avatar_url":"https:\/\/secure.gravatar.com\/avatar\/1c1fb225bfe3fe6743ca2bd8091dcead38558b2d4164003772042f8e12cdfccb?s=96&d=mm&r=g","author_category":"","last_name":"Borden, Principal Software Engineer, Couchbase","first_name":"Jim","job_title":"","user_url":"","description":"Principal Software Engineer @ Couchbase working on Couchbase Lite."}],"_links":{"self":[{"href":"https:\/\/www.couchbase.com\/blog\/wp-json\/wp\/v2\/posts\/9374","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.couchbase.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.couchbase.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.couchbase.com\/blog\/wp-json\/wp\/v2\/users\/67726"}],"replies":[{"embeddable":true,"href":"https:\/\/www.couchbase.com\/blog\/wp-json\/wp\/v2\/comments?post=9374"}],"version-history":[{"count":0,"href":"https:\/\/www.couchbase.com\/blog\/wp-json\/wp\/v2\/posts\/9374\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.couchbase.com\/blog\/wp-json\/wp\/v2\/media\/9525"}],"wp:attachment":[{"href":"https:\/\/www.couchbase.com\/blog\/wp-json\/wp\/v2\/media?parent=9374"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.couchbase.com\/blog\/wp-json\/wp\/v2\/categories?post=9374"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.couchbase.com\/blog\/wp-json\/wp\/v2\/tags?post=9374"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/www.couchbase.com\/blog\/wp-json\/wp\/v2\/ppma_author?post=9374"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}