Topic: Different data values for the same transaction for outbound x inbound connection (Read 93 times)
April 18, 2024, 03:46:37 AM
It seems like the likeliest option. Thanks for the analysis
April 18, 2024, 03:44:53 AM
This is what I see when filtering by raw transaction data:
Bitcoin protocol
Packet magic: 0xf9beb4d9
Command name: tx
Payload Length: 370
Payload checksum: 0x7e0ee856
Tx message
Transaction version: 2
Input Count: 0
Output Count: 1
Transaction output
Value: 4883631285645190914
Script Length: 89
Script: 875bb05d7ffc73aa57300b826cd2227a6c9f0bab7713be420000000000fdffffff2f6f5c6a81926 8a4c95435dc4ed7182a262408217017cad749b504cdbb00a2650000000000fdffffff02bb840100 00000000160014ac3ec5
Block lock time or block ID: 1849243303
And when filtering by ScriptPubKey I see the above but also this in some records:
Bitcoin protocol
Packet magic: 0xf9beb4d9
Command name: tx
Payload Length: 154
Payload checksum: 0x7baa26fe
Tx message
Transaction version: 2
Input Count: 2
Transaction input
Transaction input
Output Count: 2
Transaction output
Value: 99515
Script Length: 22
Script: 0014ac3ec5a736396e82c09cd23e878d4b2ff6fdd528
Transaction output
Value: 100000
Script Length: 22
Script: 001441fa737e6b1c886a6ddf535fa944e1af08c9fad8
Block lock time or block ID: 777655
Bitcoin protocol
Packet magic: 0xf9beb4d9
Command name: tx
Payload Length: 370
Payload checksum: 0x7e0ee856
Tx message
Transaction version: 2
Input Count: 0
Output Count: 1
Transaction output
Value: 4883631285645190914
Script Length: 89
Script: 875bb05d7ffc73aa57300b826cd2227a6c9f0bab7713be420000000000fdffffff2f6f5c6a81926 8a4c95435dc4ed7182a262408217017cad749b504cdbb00a2650000000000fdffffff02bb840100 00000000160014ac3ec5
Block lock time or block ID: 1849243303
And when filtering by ScriptPubKey I see the above but also this in some records:
Bitcoin protocol
Packet magic: 0xf9beb4d9
Command name: tx
Payload Length: 154
Payload checksum: 0x7baa26fe
Tx message
Transaction version: 2
Input Count: 2
Transaction input
Transaction input
Output Count: 2
Transaction output
Value: 99515
Script Length: 22
Script: 0014ac3ec5a736396e82c09cd23e878d4b2ff6fdd528
Transaction output
Value: 100000
Script Length: 22
Script: 001441fa737e6b1c886a6ddf535fa944e1af08c9fad8
Block lock time or block ID: 777655
To me it looks like the packets are not being parsed properly or there is an endianness error in the first packet at least.
Look at the script for the first packet for example:
875bb05d7ffc73aa57300b826cd2227a6c9f0bab7713be420000000000fdffffff2f6f5c6a81926 8a4c95435dc4ed7182a262408217017cad749b504cdbb00a2650000000000fdffffff02bb840100 00000000160014ac3ec5
It ends with 14ac3ec5 which is what the script of the first output in the second packet also starts with.
The 0x16 before it also aligns with the script length of 22. Same with the transaction output value immediately before that too.
My hunch is that Wireshark is not interpreting your packets properly.
April 18, 2024, 02:39:19 AM
++ I was able to filter the INV messages by applying: bitcoin.inv.hash == TXID (Natural Byte Order), it shows me INV messages only through INBOUND peers. For outbound peers, it does not show anything, which is strange.
April 18, 2024, 02:28:32 AM
This is what I see when filtering by raw transaction data:
Bitcoin protocol
Packet magic: 0xf9beb4d9
Command name: tx
Payload Length: 370
Payload checksum: 0x7e0ee856
Tx message
Transaction version: 2
Input Count: 0
Output Count: 1
Transaction output
Value: 4883631285645190914
Script Length: 89
Script: 875bb05d7ffc73aa57300b826cd2227a6c9f0bab7713be420000000000fdffffff2f6f5c6a81926 8a4c95435dc4ed7182a262408217017cad749b504cdbb00a2650000000000fdffffff02bb840100 00000000160014ac3ec5
Block lock time or block ID: 1849243303
And when filtering by ScriptPubKey I see the above but also this in some records:
Bitcoin protocol
Packet magic: 0xf9beb4d9
Command name: tx
Payload Length: 154
Payload checksum: 0x7baa26fe
Tx message
Transaction version: 2
Input Count: 2
Transaction input
Transaction input
Output Count: 2
Transaction output
Value: 99515
Script Length: 22
Script: 0014ac3ec5a736396e82c09cd23e878d4b2ff6fdd528
Transaction output
Value: 100000
Script Length: 22
Script: 001441fa737e6b1c886a6ddf535fa944e1af08c9fad8
Block lock time or block ID: 777655
Bitcoin protocol
Packet magic: 0xf9beb4d9
Command name: tx
Payload Length: 370
Payload checksum: 0x7e0ee856
Tx message
Transaction version: 2
Input Count: 0
Output Count: 1
Transaction output
Value: 4883631285645190914
Script Length: 89
Script: 875bb05d7ffc73aa57300b826cd2227a6c9f0bab7713be420000000000fdffffff2f6f5c6a81926 8a4c95435dc4ed7182a262408217017cad749b504cdbb00a2650000000000fdffffff02bb840100 00000000160014ac3ec5
Block lock time or block ID: 1849243303
And when filtering by ScriptPubKey I see the above but also this in some records:
Bitcoin protocol
Packet magic: 0xf9beb4d9
Command name: tx
Payload Length: 154
Payload checksum: 0x7baa26fe
Tx message
Transaction version: 2
Input Count: 2
Transaction input
Transaction input
Output Count: 2
Transaction output
Value: 99515
Script Length: 22
Script: 0014ac3ec5a736396e82c09cd23e878d4b2ff6fdd528
Transaction output
Value: 100000
Script Length: 22
Script: 001441fa737e6b1c886a6ddf535fa944e1af08c9fad8
Block lock time or block ID: 777655
April 17, 2024, 11:11:41 PM
For example, in the Transaction output, the Value and Script are so long.
What do you consider long? For example the output amount value is always 8 bytes (64 bits) so it doesn't matter if you are paying 10000 satoshis like in your second output, the value will be: 0xa086010000000000 in little endian order.
Same for the Block lock time or block ID.
Transactions have lock time (not blocks) and it should be 4 bytes at the end of the tx hex. So when you set it to 777655 the hex value for it is 0xb7dd0b00.There also should not be any block ID in a tx message.
Posting exactly what Wireshark shows may get you a better answer.
April 17, 2024, 07:19:39 AM
Hi,
just doing some analysis in Wireshark for my deeper Bitcoin transaction understanding, and I find some things I do not understand.
When I filter the transaction by the hex value, which is raw transaction data, it finds me some records, but the values in the Tx message is really weird, they do not correspond to the ones find in the mempool space. For example, in the Transaction output, the Value and Script are so long. Same for the Block lock time or block ID. Each of this records points me toward outband peer.
When I filter for example the exact ScriptPubKey (HEX), it points me again to the previous records, but it finds also the record, that is corresponding exactly with the data find in the mempool.space. The interesting thing is, that when the records are exactly the same as in the mempool.space, its for the inbound connections.
My question is, why is it like this?
Transaction is: 3ceee5608d357b2f8d7f39ab8c441eb688ef54efb8051b49fb141787fe26aa7b
just doing some analysis in Wireshark for my deeper Bitcoin transaction understanding, and I find some things I do not understand.
When I filter the transaction by the hex value, which is raw transaction data, it finds me some records, but the values in the Tx message is really weird, they do not correspond to the ones find in the mempool space. For example, in the Transaction output, the Value and Script are so long. Same for the Block lock time or block ID. Each of this records points me toward outband peer.
When I filter for example the exact ScriptPubKey (HEX), it points me again to the previous records, but it finds also the record, that is corresponding exactly with the data find in the mempool.space. The interesting thing is, that when the records are exactly the same as in the mempool.space, its for the inbound connections.
My question is, why is it like this?
Transaction is: 3ceee5608d357b2f8d7f39ab8c441eb688ef54efb8051b49fb141787fe26aa7b
Jump to: