Inspect your first shred packet

Prove network arrival first

Do not begin with a shred decoder. First establish network arrival at the verified port. Stream datagrams originate at ${SOURCE_IP}, which also sent the verification challenge.

On the destination server, substitute your verified port for 9000 in this command:

sudo tcpdump -n -i any -vv -c 20 'src host 203.23.178.228 and udp dst port 9000'

The command captures metadata for 20 matching packets and exits. It does not print the binary payload. Confirm that each displayed source is ${SOURCE_IP} and its destination is your registered port. Ignore tcpdump's displayed source-port value because the product publishes none.

If tcpdump prints nothing, the problem occurs before application decoding. Check the dashboard destination, cloud firewall, network ACL, public routing, NAT mapping, and host firewall. Use the exact source CIDR ${SOURCE_IP}/32 in allow rules.

Receive a bounded sample in Python

Stop any other process that owns the verified port, then run this receiver. It accepts 1,000 datagrams from ${SOURCE_IP}, records size statistics, prints the first accepted payload as hexadecimal, and fails if a service datagram exceeds the documented ${WIRE.maxPacketBytes} byte maximum.

python3 - <<'PY'import socketimport statisticsimport time HOST = "0.0.0.0"PORT = 9000EXPECTED_SOURCE = "203.23.178.228"TARGET_PACKETS = 1000MAX_PACKET_BYTES = 1228 sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)sock.setsockopt(socket.SOL_SOCKET, socket.SO_RCVBUF, 8 * 1024 * 1024)sock.bind((HOST, PORT))sock.settimeout(10.0) sizes = []started = time.monotonic() while len(sizes) < TARGET_PACKETS:    try:        data, peer = sock.recvfrom(65535)    except socket.timeout:        raise SystemExit("receiver timeout: no accepted datagram for 10 seconds")    if not peer[0] == EXPECTED_SOURCE:        continue    if len(data) > MAX_PACKET_BYTES:        raise SystemExit(            f"packet too large: {len(data)} bytes exceeds {MAX_PACKET_BYTES}"        )    if not sizes:        print(f"first_source={peer[0]}:{peer[1]}")        print(f"first_bytes={len(data)}")        print(f"first_32_bytes_hex={data[:32].hex()}")    sizes.append(len(data)) elapsed = time.monotonic() - startedprint(f"packets={len(sizes)}")print(f"elapsed_seconds={elapsed:.6f}")print(f"packets_per_second={len(sizes) / elapsed:.2f}")print(f"minimum_bytes={min(sizes)}")print(f"maximum_bytes={max(sizes)}")print(f"mean_bytes={statistics.fmean(sizes):.2f}")PY

The command is intentionally bounded. It exits after 1,000 accepted packets or a ten-second idle period. Ten seconds controls only this local diagnostic and makes no claim about a product timeout.

Interpret the output

first_source must show ${SOURCE_IP}. Its following UDP port can vary because no source-port value is published. first_bytes is the payload length delivered to the application. first_32_bytes_hex is a lossless hexadecimal view of the first 32 payload bytes, not a decoded shred.

maximum_bytes must not exceed ${WIRE.maxPacketBytes} for service datagrams under the documented wire contract. Packet lengths can vary, so inspect the sample distribution and do not treat a value below the maximum as a contract violation by itself.

packets_per_second measures only the bounded interval seen by this process. Scheduler pauses, socket drops, start timing, and Solana network activity affect a short sample. A peak rate, minimum rate, and acceptable sample deviation are not currently specified.

Confirm application ownership

Without special socket options, one process normally owns a given address-and-UDP-port binding. An address-in-use error may therefore identify your production receiver as the current owner. Do not stop production merely for this diagnostic. Observe delivery non-invasively with tcpdump.

Check the binding with:

sudo ss -ulnp | grep ':9000 '

An empty result means no visible UDP listener matches the textual port filter. A process bound elsewhere may still miss traffic delivered through the intended local interface. Align verified public routing with the local binding.

Check for local drops

Run netstat -su before and after a sample. Compare the host's receive-error and received-packet counters for UDP. Names vary by operating system, and no supported system or mandatory monitoring tool is published.

A packet captured by tcpdump but missing from application counts can indicate a closed socket, wrong bind, local firewall decision, full queue, or scheduling delay. Observe longer before changing the network. Compare capture, application, and kernel UDP counts within one UTC window.

The service does not retransmit a datagram, preserve order, or apply backpressure. Your receiver must keep draining the socket and tolerate missing or reordered shreds. Do not infer transport reliability from a successful 1,000-packet sample.

Move from arrival to decoding

After the sample succeeds, restore the intended receiver at the verified port, or start it there. Continue filtering sources for ${SOURCE_IP}. Hand the entire received payload to shred processing without stripping bytes for an assumed wrapper. Delivery is raw UDP, with no additional service envelope documented.

Product facts do not define the detailed Solana shred schema, variant parsing rules, or decoder library. Keep arrival validation separate from protocol decoding so a decoder error cannot be misreported as delivery failure.

Record the first accepted UTC timestamp, source IP, destination port, packet count, byte count, size range, and kernel drop delta. These observations form a useful activation record. No mandatory audit format or retention period is published.