From Oscilloscope to Wireshark: A UDP Story

Engineer goes full CSI on network wires; comments melt down over “1 TSPS”

TLDR: An engineer debugged a network bug by probing raw signals and decoding them into messages, likely mistyping a “1 TSPS” scope setting. The comments erupted over the impossible sample rate, split between hardware‑sleuth hype, “just use software tools” groans, and Rust‑vs‑Python jokes—proof that typos can overshadow triumphs.

A hardware engineer at Oxide Computer set the internet buzzing by chasing a network bug the old‑school way: soldering probes onto a rack switch, recording raw electrical wiggles, and decoding them into internet messages called UDP. The post promised a wild ride from physical wires (Layer 1) to app traffic (Layer 4), but the community immediately slammed the brakes at a jaw‑dropping claim: a scope capture set to “1 TSPS” — that’s a tera‑sample per second. Cue the dogpile. One sharp‑eyed commenter asked if it was a typo, and within minutes the thread turned into “TeraGate.”

Some readers cheered the hardcore, hands‑on debugging, calling it “CSI: Ethernet” and praising the detective work that uncovered a misconfigured switch chip as the culprit. Others rolled their eyes: “Just use tcpdump,” they quipped, arguing you don’t need to go all the way to the metal to find a flaky link. Then came the language wars. The author wrote a 400‑line Rust parser to read the scope file, followed by a cheeky “3 lines of Python” version — and suddenly we’re debating robustness vs. brevity like it’s a stadium sport. Memes flew fast: “NASA called, they want their scope back”, and “from wires to Wireshark, but first, spellcheck.” Whether you’re team Rust rigor, Python brevity, or Typo Police, the comments stole the show — and yes, everyone agrees: it’s probably GS/s, not TSPS. Post

Key Points

  • The author captures and decodes UDP traffic starting from physical-layer waveforms on a QSGMII link between a VSC7448 switch and a VSC8504 PHY.
  • The work supports debugging a management network issue on an Oxide rack; the root cause was a misconfigured switch IC causing intermittent links.
  • Oscilloscope capture was set to 100M samples at 1 TSa/s (~100 μs), targeting 1–3 UDP packets given ~30k pps traffic.
  • A 191 MB Tektronix .wfm file was exported; a ~400-line parser using nom decodes samples and rate for offline processing.
  • A minimal Python/NumPy example shows how to extract i16 samples directly from the .wfm payload for analysis.

Hottest takes

"Typo? I didn't think we had sample rates anywhere near that high!" — Retr0id
"NASA called; they want their 1 tera‑sample scope back" — multiple replies
"400 lines of Rust vs 3 lines of Python—bring popcorn" — another commenter
Made with <3 by @siedrix and @shesho from CDMX. Powered by Forge&Hive.