Build a five-minute UDP receiver

Run the receiver

The following program uses only the Python standard library. It binds UDP port 9000 on every local IPv4 interface, requests an 8 MiB socket receive buffer, discards datagrams from unexpected source IPs, recognizes the verification prefix, and prints periodic packet counters for the stream.

python3 - <<'PY'
import socket
import time

HOST = "0.0.0.0"
PORT = 9000
EXPECTED_SOURCE = "64.130.40.90"
REPORT_EVERY_SECONDS = 1.0

sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
sock.setsockopt(socket.SOL_SOCKET, socket.SO_RCVBUF, 8 * 1024 * 1024)
sock.bind((HOST, PORT))
sock.settimeout(1.0)

packets = 0
byte_count = 0
last_report = time.monotonic()
print(f"listening on udp://{HOST}:{PORT}", flush=True)

while True:
    try:
        data, peer = sock.recvfrom(65535)
    except socket.timeout:
        data = None
        peer = None

    if data is not None and peer is not None:
        if not peer[0] == EXPECTED_SOURCE:
            print(f"ignored source={peer[0]}:{peer[1]}", flush=True)
            continue
        packets += 1
        byte_count += len(data)
        if data.startswith(b"SHRED-FANOUT-VERIFY/1"):
            text = data.decode("utf-8", errors="replace")
            print(f"verification={text}", flush=True)

    now = time.monotonic()
    if now - last_report >= REPORT_EVERY_SECONDS:
        actual_buffer = sock.getsockopt(socket.SOL_SOCKET, socket.SO_RCVBUF)
        print(
            f"packets={packets} bytes={byte_count} rcvbuf={actual_buffer}",
            flush=True,
        )
        last_report = now
PY

Keep the terminal open. Stop the process with Ctrl-C when testing is complete. The program never decodes shred payloads and never writes packet contents to disk. It is an activation probe, not a production receiver.

Verify the socket before requesting a challenge

1. Start the Python receiver.
2. Open a second terminal on the same server.
3. Run sudo ss -ulnp | grep ':9000 '.
4. Confirm that Python owns a UDP socket on 0.0.0.0:9000.
5. Run sudo tcpdump -n -i any 'src host 64.130.40.90 and udp dst port 9000'.
6. Request the verification challenge in the dashboard.
7. Stop tcpdump with Ctrl-C after the packet appears.

The Python terminal must print a line beginning with verification=${CHALLENGE_PREFIX}. The exact delimiter and encoding used for the following destination ID and token are not currently specified. Copy the token from the complete payload without writing a parser that assumes a delimiter.

If tcpdump sees the datagram but Python does not, inspect the bound socket and local packet path. If neither tool sees it, inspect the public IP, port, NAT mapping, cloud firewall, and host firewall. Every datagram uses ${SOURCE_IP}; a rule for any other source cannot admit the challenge.

Read the counters

The packets counter includes accepted verification and stream datagrams. The bytes counter is the sum of UDP payload lengths returned to the application. The program ignores traffic from every source IP other than ${SOURCE_IP}, but the firewall should still enforce the same restriction before packets reach the process.

The published feed was measured at ${FEED.mbps} Mbps, ${FEED.packetsPerSecond.toLocaleString("en-US")} packets per second, and a ${FEED.meanPacketBytes} byte mean packet size. A service datagram can contain up to ${WIRE.maxPacketBytes} payload bytes. The source UDP port is not currently specified, so the program checks only peer[0] and accepts any source port from the correct source IP.

Do not compare a one-second sample with the published rate as if it were an availability test. Scheduling, capture overhead, kernel drops, and feed variation can change a short sample. The peak packet rate and peak bit rate are not currently specified.

Understand the receive buffer

SO_RCVBUF asks the operating system for socket queue capacity. Linux can cap or transform the requested value. The program reads the effective value back and prints it. This makes the test observable without assuming a particular kernel configuration.

An 8 MiB request is an example receiver setting, not a product default or requirement. Required buffer capacity depends on scheduling pauses and burst behavior, and burst behavior is not currently specified. A production process should read continuously, record kernel drop counters, and move CPU-heavy decoding away from the receive loop.

Check UDP statistics before and after a test:

netstat -su

If netstat is unavailable, use the host's installed network-statistics tool. The product does not specify an operating system or package set.

Convert the probe into a production design

Keep the receive loop small. Copy each datagram into an application-owned buffer or bounded queue. Record arrival time, payload length, source address, and local drop counters. Process or decode the payload outside the socket-reading path. Define behavior for a full queue before traffic arrives.

Do not add a TCP-style retry loop. Raw UDP has no connection to reopen and no sender backpressure to trigger. A missing sequence position must be handled by the Solana shred processing logic, not by requesting transport retransmission from shredstream.sh.

Avoid logging each stream datagram. At the measured ${FEED.packetsPerSecond.toLocaleString("en-US")} packets per second, synchronous terminal output can become the receiver bottleneck. The example prints packet details only for the challenge and emits counters once per second.

Do not treat the source-IP check inside the process as the only security boundary. Apply the firewall rule for ${SOURCE_IP} at the edge and host. Application filtering occurs after the kernel has accepted and queued traffic.

Keep the test repeatable

Record the destination IP, destination port, firewall rule, receiver command, UTC test time, packet count, byte count, and observed source IP. These fields are sufficient to distinguish common path errors when contacting support. A required logging format and retention period are not currently specified.

After verification, leave the same socket bound to the same port. Changing the dashboard IP or port requires another challenge. Restarting the receiver on the same verified address does not by itself change the destination, but packets sent while the socket is closed cannot be recovered through UDP.