Capturing and Analyzing Lightning Node Traffic

Hey folks, I wanna sniff some traffic from the p2p Lightning Network and possibly analyze it with Wireshark or a similar program. The problem is, the traffic is encrypted. Is there any node implementation where I can get the key used for that encryption? If there's another way to capture traffic without needing to extract the key, like setting up a man-in-the-middle between the node and the p2p network, hit me up. Appreciate it!

If you're running a node and using LND, you can specify the TLS certificate via lnd.conf. Not a full solution, but it could help. Anything that connects to your node can be monitored that way. If you're just looking to see general activity, set up a few nodes to chat among themselves and check their traffic.

Thanks for the info! I checked that link, but it seems like it's only for RPC connections. I wanna dig into p2p network messages, specifically the gossip protocol. Not sure if that uses the same TLS cert.

Did some digging, and I'm not finding any mention of encryption in the gossip protocol docs. Kinda strange, right? There has to be a certificate involved somewhere when they connect. But like, is it really encrypted? Seems like public info being shared...

I think it is encrypted, mainly for privacy. From what I saw, it seems like the node ID (like a public key) is used to encrypt the messages.

So it's not standard TLS encryption. It's using some keys based on the secp256k1 curve and a type of ECDH known as Noise_XK. To get the session key used for encryption, you gotta find a tool that can replicate the Noise_XK key exchange process.

Thanks! That sounds about right. If anyone has tips or knows how to do this, it’d be super helpful.