Correlate both sides of the exchange
Capture only systems and links you are authorized to inspect. Record upstream and downstream platform roles, connection direction, peer center IDs and software versions. Redact identifiers without changing byte widths. Use timestamps, TCP sequence information and application serials to correlate the same message on both sides.
Reassemble TCP before searching for project framing markers. A marker pair is a candidate rather than proof of a frame because escape conventions, capture gaps and embedded values can affect boundaries. Carry unmatched tail bytes forward and reject candidates whose declared length cannot fit the available logical bytes.
Validate the 22-byte common header
Interpret the common header using big-endian fields: total length, serial, message ID, platform center ID, version bytes, encryption flag and key. Compare the exact 22 bytes with peer configuration and logs before routing the body. A correct message ID paired with the wrong length or center ID is not a valid basis for decoding.
Keep platform identifiers as fixed-width unsigned values. Decimal display is convenient for configuration, but the four-byte wire width and leading zeros belong in diagnostics. Numeric conversion does not verify that an identifier is assigned, authorized or permitted for the business route.
State the length and escape convention
A length check is meaningful only after naming the byte boundary and escape state. Record whether frame markers and check bytes are included, and whether the declaration describes logical unescaped bytes or transmitted bytes. Compare both peers using the same definition. Do not change the convention merely because another interpretation makes one sample match.
When declared and actual length differ, inspect capture truncation, stream duplication and escape reversal before blaming the field writer. Report the input boundary, declared count, actual count and selected profile together so another engineer can reproduce the diagnosis.
Route message IDs conservatively
Use the message ID to select a functional group only after header validation. A lookup table should contain confirmed common assignments and preserve unknown values, not guess from nearby numbers. Exact body layout must come from the licensed edition, regional requirements and peer interface agreement.
Encryption flags and keys require special handling. Header visibility does not make encrypted body bytes interpretable, and test systems should use authorized credentials and isolated data. Separate framing success from decryption, semantic validation and business acceptance in logs.
Maintain peer-to-peer test vectors
Keep redacted paired captures from both peers for login, keepalive, positioning and one controlled error. Record expected headers, byte boundaries and response correlation. Re-run them whenever framing, encryption or edition configuration changes.