Capturing UDP Packets with an Oscilloscope: A Step‑by‑Step Guide

Answer: Capturing UDP packets with an oscilloscope, decoding the 8b/10b‑encoded QSGMII signal, reconstructing Ethernet frames, and exporting the result to a PCAP file is a step‑by‑step process that turns raw voltage waveforms into human‑readable network traffic.

From Oscilloscope to Wireshark: A Complete UDP Packet Analysis Guide

If you’re a network debugging enthusiast or a hardware engineer who needs to see exactly what’s happening on a high‑speed QSGMII link, this tutorial shows you how to go from raw UBOS platform overview‑level data capture to a fully‑decoded PCAP file ready for Wireshark. We’ll walk through the methodology, the oscilloscope capture settings, 8b/10b decoding, Ethernet frame reconstruction, and finally the export to analysis tools. Along the way, you’ll discover how Enterprise AI platform by UBOS can automate parts of this workflow, saving you hours of manual scripting.

Why This Matters for Modern Networking

• Traditional tools like tcpdump only show packets after they have been processed by the NIC.
• Low‑level debugging of high‑speed QSGMII links requires looking at the physical layer (L1) signals.
• Understanding 8b/10b encoding helps you pinpoint timing‑related bugs that manifest as intermittent link failures.
• Exporting to .pcap lets you leverage the full power of Wireshark, tshark, and AI‑driven analysis pipelines.

Methodology Summary (Inspired by Matt Keeter’s Original Work)

The original blog post by Matt Keeter (original article) demonstrated a hands‑on approach to capture UDP traffic from a QSGMII link using a Tektronix oscilloscope. The key steps were:

1. Configure the oscilloscope to capture a short burst of samples (≈100 µs) at 1 TS/s.
2. Parse the proprietary .wfm file to extract the raw i16 waveform and sample rate.
3. Detect comma characters (K28.5 / K28.1) to synchronize the 8b/10b decoder.
4. Separate the four interleaved SGMII streams and decode them into Ethernet frames.
5. Write the frames to separate .pcap files for each port.

Our guide expands on each of these steps, adds practical tips for handling gigabit‑rate data, and shows how to integrate the workflow with UBOS’s Workflow automation studio for repeatable analysis.

1. Capturing UDP Packets with an Oscilloscope

Choosing the Right Probe and Sampling Rate

For QSGMII (5 Gbps per lane) you need an active differential probe with at least 2 GHz bandwidth. The probe should be soldered directly to the TX/RX pair of the VSC7448 ↔ VSC8504 link, just as shown in the original setup. A 1 TS/s (tera‑sample per second) acquisition gives you 200 samples per bit, which is more than enough to resolve the 8b/10b transitions.

Configuring the Capture Window

Because UDP traffic can be extremely bursty (30 k packets / s ≈ one packet every 33 µs), a 100 µs capture window reliably contains 2–3 packets. Set the oscilloscope to:

• Acquisition length: 100 M samples
• Sample rate: 1 TS/s
• Trigger on a falling edge of the differential pair
• Export as .wfm (Tektronix binary format)

Exporting the Waveform

After the capture, copy the .wfm file to a workstation. The file size will be roughly 191 MiB for a 100 M‑sample capture. This size is manageable for modern laptops and can be processed with a simple Python or Rust script.

2. Decoding 8b/10b and Reconstructing Ethernet Frames

Parsing the .wfm File

While the original author wrote a 400‑line Rust parser, you can achieve the same result with a few lines of Python using numpy:

import numpy as np
data = open('udp-spam.wfm', 'rb').read()
pts = np.frombuffer(data[904:], dtype=np.int16)  # skip header

This yields an int16 array where each element represents the instantaneous voltage of the differential pair.

Finding Comma Characters for Synchronization

8b/10b encoding inserts special “comma” symbols (K28.5 = 0011111 or 1100000) that contain five identical bits in a row. Detecting these patterns lets you align the decoder:

• Convert the waveform to a binary stream by thresholding at zero.
• Identify transitions (zero‑crossings) and measure the distance between them.
• When a gap exceeds ~4.5 bit periods (≈900 samples), you have a comma.

8b/10b Decoding Logic

Once synchronized, sample every 200 samples (one bit) to extract 10‑bit code groups. Use a lookup table (as defined in the 8b/10b standard) to map each 10‑bit value to an 8‑bit data byte or a control symbol. The following Rust‑style pseudo‑code illustrates the process:

let mut code_groups = Vec::new();
while i < pts.len() {
    let mut value = 0u16;
    for _ in 0..10 {
        value = (value << 1) | (pts[i] > 0) as u16;
        i += samples_per_bit;
    }
    code_groups.push(value);
}

Demultiplexing the Four QSGMII Channels

QSGMII interleaves four SGMII streams in a round‑robin fashion. The K28.1 “swapper” identifies the start of Port 0. By scanning the decoded code groups for K28.1, you can split the stream into four separate byte arrays:

let mut ports = [Vec::new(), Vec::new(), Vec::new(), Vec::new()];
let mut port_idx = 0;
for cg in code_groups {
    if cg == K28_1 { port_idx = 0; continue; }
    ports[port_idx].push(cg);
    port_idx = (port_idx + 1) % 4;
}

Rebuilding Ethernet Frames

Each port now contains a raw 8‑bit byte stream. The 8b/10b decoder already stripped the control symbols, leaving you with the Ethernet preamble (seven 0x55 bytes) followed by 0xD5 (Start‑of‑Frame delimiter). From there, parse the Ethernet header, IPv6/IPv4 payload, and finally the UDP segment. The resulting packet structure matches what Wireshark expects.

3. Exporting to PCAP and Analyzing the Packets

Generating PCAP Files

Use the pcap crate (Rust) or scapy (Python) to write each port’s packet list to a .pcap file. The file header includes a timestamp (derived from the oscilloscope’s trigger time) and the link‑type DLT_EN10MB (Ethernet).

import scapy.all as sc
with sc.PcapWriter('port0.pcap', linktype=sc.DLT_EN10MB) as pcap:
    for pkt in port0_packets:
        pcap.write(pkt)

Verifying with Wireshark

Open the generated .pcap in Wireshark. You should see:

• Ethernet II frames with correct source/destination MACs.
• IPv6 (or IPv4) headers matching the original traffic.
• UDP payloads containing the original application data (e.g., 0x01‑0x08).

If the frames appear malformed, double‑check the comma detection logic and the sample‑per‑bit calculation. Small clock drift between the oscilloscope and the PHY can cause off‑by‑one‑sample errors; re‑synchronizing on every comma mitigates this issue.

Automating the Pipeline with UBOS

UBOS’s AI Email Marketing template can be repurposed to send automated reports after each capture. Combine the Workflow automation studio with a scheduled cron job that runs the decoder, generates PCAPs, and emails a summary to the network team. This reduces manual effort and ensures consistent documentation of every debugging session.

Conclusion: Turn Raw Waveforms into Actionable Insights

By following the steps above, you can transform low‑level oscilloscope data into fully decoded UDP packets, ready for deep inspection in Wireshark or AI‑enhanced analysis pipelines. This workflow bridges the gap between hardware‑level debugging and software‑level troubleshooting, empowering engineers to locate the root cause of intermittent link failures, timing glitches, or malformed packets.

Ready to accelerate your network debugging?

• Explore the UBOS templates for quick start and spin up a custom analysis pipeline in minutes.
• Leverage the UBOS partner program to get dedicated support for high‑speed data capture projects.
• Check out the UBOS pricing plans to find a tier that matches your team’s size.

Whether you’re debugging a rack‑scale server, building a custom telemetry system, or teaching a class on high‑speed serial links, the ability to see UDP packets at the physical layer is a game‑changer. Dive in, experiment, and let the data speak.

For more AI‑driven networking tutorials, stay tuned to the UBOS technology blog.