ABOUT QX9
QX9 develops encrypted infrastructure for critical communications. It publishes protocol documentation and wire-format analysis tools under open licenses. The current focus is next-generation 911, with radio dispatch interoperability reserved for future work.
ABOUT VEILID
Veilid is an open-source, peer-to-peer application framework written and maintained by the Veilid Foundation (veilid.org). Built in Rust, it provides end-to-end encrypted messaging, distributed hash table storage, and private routing.
Nodes reachable from the public internet carry traffic for the nodes that are not, and confirm that the addresses those nodes advertise can be reached. The Veilid Explainer covers how a node joins and how data is stored and read.
QX9 is interested in Veilid as a transport layer for private, low-complexity critical communication networks.
QX-TOOLKIT WIP
The QX9 Network Analysis Toolkit is an open-source Wireshark dissector and Veilid protocol primer for inspecting and understanding peer-to-peer network traffic. The toolkit is released under MPL-2.0 (code) and CC BY-SA 4.0 (docs).
Wireshark Veilid Dissector
A Lua dissector for inspecting Veilid peer-to-peer protocol traffic in Wireshark, with TCP reassembly, heuristic detection, expert diagnostics, and display filters. It reads the encrypted envelope, out-of-band receipt, and bootstrap request message types, and never decrypts: an envelope's encrypted body is shown as raw bytes.
Protocol Diagrams
SVG diagrams of Veilid's message types and transports, each drawn from constants and offsets validated against the veilid-core source, whose wire formats are byte-identical from 0.5.2 through 0.5.7, except the two marked anticipated below.
| Type | Description |
|---|---|
| ENV0 | Encrypted envelope layout |
| ENV1 | Anticipated layout for a later envelope version |
| RCP0 | Out-of-band receipt layout |
| BOOT | Bootstrap request/response flow |
| TCP | VL frame structure |
| UDP | Fragment header and reassembly |
| QUIC | Anticipated QUIC transport, which veilid-core does not define today |
| WS | WebSocket transport framing |
Architecture Reference
Architecture overview of the dissector plugin: installation, plugin structure, the dissector pipeline, and byte-level wire format diagrams, with links to the full technical reference. It doubles as a primer on the Veilid wire format, and reads on its own without installing anything.
Roadmap: The Veilid wire protocol is still under active development and has no published specification. Once the protocol settles, the goal is a C dissector built into Wireshark, whether that work comes from QX9, the Veilid community, or both.
VNS WIP
VNS is a proposed naming layer built on the Veilid distributed hash table. An address is an encoding of an ed25519 public key, generated rather than issued, so no registrar allocates it and no certificate authority vouches for it. Only the holder of the matching secret can publish at that address.
Veilid Explainer
What Veilid provides, in the detail needed to follow the VNS page: nodes rather than servers, the distributed hash table and its two stores, what happens when you read a record you have never seen, and what the framework leaves to applications.
VNS Explainer
What an address is made of, how one resolves with no authority consulted, what the design removes from the classic web, and what it does not provide.