Matching Binary Patterns with Erlang

We know why Erlang does it well: its original narrow focus of switching packets and insane uptime. This meant it didn't prioritize other niceties, like strings for example. So it made sense to hard wire bit vector dissection and construction.

I think most other platforms have richer types and would rather use the generic type stack. Also, most general-purpose languages hide all the networking inside libraries so most users can just do foo = get($url) and not worry about it.

A good start for reading is the concepts around IP, especially how protocols can encapsulate each other, also known as layers. Skim [1] maybe. The definitive reference used to be the W. Richard Stevens books cited there.

Next pick a fun, simple protocol you're interested in. Consider ICMP, Echo, DNS, or if you like NTP, see OP's fine writeup to repeat the experiments. Skim the IETF RFC [2] for your protocol, especially the bitmap diagram.

Install Wireshark and play around dissecting packets on your network, noting how it shows you the layers and bitfields as above.

The most important step is to write some toy code for a client, server, or peer for your fun protocol. As above Erlang makes it simple to take apart packets directly referring to the bitfield diagrams, but most stacks should have a packet inspection library you can mess with. Wireshark will help watch your work.

Another good thing to learn is routing. If you have a BSD or Linux box or a Raspberry Pi, learn some IPTables or BPF [3]. Play around with writing your own firewall rules on your box. Play with how the OS sees networking, ie netstat, arp, and route outputs.

1. https://en.wikipedia.org/wiki/Internet_protocol_suite

2. https://ietf.org/standards/rfcs

3. http://www.brendangregg.com/ebpf.html