SESerCe·Sep 7, 2023
Out of interest, was this the project that eventually became wirefilter [1]?
[1]: https://github.com/cloudflare/wirefilter
In When URL parsers disagreecloudflare
wirefilter
Rust2019–2023
cloudflare / wirefilter
wirefilter
An execution engine for Wireshark-like filters
4Distinct people
4Mentions
0Explicit recommenders
1.2KGitHub stars
What to know before exploring
What it is
An execution engine for Wireshark-like filters
GitHub
Where it is used
No documented product use has been verified yet.
What people are saying
No recommendation phrase was found in the indexed comments.
No classified warning is attached to this page. Read the discussions before treating silence as approval.
Also in these discussions
No other repository is repeatedly linked in the same discussions.
This week on Hacker News
Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 1:49:46 PM UTC.
No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.
Mentions over time
HN mentions by year4 dated mentions
Observed mentions: 2019-03-04 16:37:27 UTC to 2023-09-07 12:15:55 UTC.
Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.
View mention counts and date ranges
| Period | Start (UTC) | End (exclusive, UTC) | Mentions | Submissions | Comments |
|---|---|---|---|---|---|
| 2019 | 2019-01-01 00:00:00 UTC | 2020-01-01 00:00:00 UTC | 2 | 1 | 1 |
| 2020 | 2020-01-01 00:00:00 UTC | 2021-01-01 00:00:00 UTC | 0 | 0 | 0 |
| 2021 | 2021-01-01 00:00:00 UTC | 2022-01-01 00:00:00 UTC | 1 | 0 | 1 |
| 2022 | 2022-01-01 00:00:00 UTC | 2023-01-01 00:00:00 UTC | 0 | 0 | 0 |
| 2023 | 2023-01-01 00:00:00 UTC | 2024-01-01 00:00:00 UTC | 1 | 0 | 1 |
What Hacker News says
4 sources> One company I worked with had an innovative idea for a firewall: build it with programmable logic and it works at wire speed
Ah, that's the idea I had at Cloudflare and we then built it as Firewall Rules. Externally it looks like it's a HTTP feature only and just a WAF type tool, but internally it's an extremely fast matcher that can work on any traffic and at different OSI layers so it forms part of the DDoS protection, bot protection, magic transit, etc. It's also in things like the URI rewrite... because fundamentally it's all just "match things" and associate actions with the matched things, usually the actions are deny, rate limit, allow, challenge... but no reason the actions can't be to transform, duplicate, log, etc too.
Just wireshark like matching at the equivalent of wire speed (for what that means at whatever layer you're wo
Read the rest
rking on) without having to have buffering or that pcap phase normally associated with firewalls or wireshark.
The same wireshark-like rules can also be translated into SQL easily enough, so it's possible to run a firewall rule over the logs and see what would've matched (it isn't perfect, logging isn't that complete... but for the most common scenarios it works well enough).
This work is OSS, the language syntax and a table matcher (used for the HTTP part) is all here https://github.com/cloudflare/wirefilter/tree/cloudflare and it's in Rust. For other systems the rule may be translated to eBPF for the matching part, etc. A blog post with an overview is here https://blog.cloudflare.com/how-we-made-firewall-rules/ .
Cloudflare wirefilter: An execution engine for Wireshark-like filters
1 points · Open discussionVery nice article. It describes writing an interpreter in Rust for a DSL for Wireshark-like filters.
The source code: https://github.com/cloudflare/wirefilter
In Building Fast Interpreters in Rust