Network and transport

Pixop Prime is an MPEG-TS appliance: SRT (or other relay-capable transports) at the WAN edge, UDP multicast for on-host hand-off between TSDuck and Pixop LIVE, then SRT again at egress. This page is the reference landing for topology, ports, release gates, and readiness semantics. Step-by-step commissioning stays in Connect your first SRT stream. Configuration change control is in Transport configuration. Multipath bonded SRT is in Multipath and bonded SRT. Fault isolation is in Transport troubleshooting.

System topology

Traffic moves in one direction through fixed internal stages. External peers never address multicast; only the guest OS and containers use the 239.0.0.0/8 hand-off.

                    ON-HOST (not in AWS SG / not on LAN)
                    =====================================

  External SRT caller ──UDP 5000──► tsduck-in@main (ingest relay or native SRT)
                                           │
                                           ▼
                              239.0.0.1:5500  (pre-Pixop tap / backbone)
                                           │
                                           ▼
                                    pixop-live (GPU enhancement)
                                           │
                                           ▼
                              239.0.0.1:5501  (replacement elementary stream)
                                           │
                                           ▼
         tsduck-in@main `tsp` (same process: tap, Pixop hand-off, mux / PCR / PID)
                                           │
                                           ▼
                              239.0.0.1:5600  (merged transport stream)
                                           │
                                           ▼
  External SRT caller ──UDP 5001──◄ tsduck-out@egress-main (egress relay or native SRT)

Multicast defaults are defined in /etc/pixop-live/network.env (TAP_OUT_*, REPLACEMENT_IN_*, FINAL_OUT_*) and mirrored in /etc/pixop-live/tsduck/main.env for the ingress instance. Addresses such as 239.0.0.1 are on-guest / on-appliance UDP multicast hand-offs — not the loopback interface (lo) and not WAN endpoints. You do not open 239.0.0.1 in a security group, corporate firewall, or KVM port-forward rules.

Optional secondary egress instances (egress-aux1, egress-aux2) ingest merged TS from FINAL_OUT_ADDR:FINAL_OUT_PORT in network.env (default 239.0.0.1:5600). tsduck-out-run uses those keys for the -I ip source. Instance .env may still define UDP_IN_PORT=5600 as a legacy fallback for tsduckctl check when transport introspection is unavailable — keep it aligned with FINAL_OUT_PORT. Aux lanes publish SRT on UDP 5002 and 5003 when explicitly enabled.

Ports and flows

SRT direction: Shipped templates use listener on the appliance for both ingest and egress. The appliance does not dial outbound SRT in the default recipe. Callers at the encoder and at the downstream receiver initiate sessions.

AWS EC2: Inbound security group rules must allow UDP 5000 from the encoder CIDR and UDP 5001 from the receiver CIDR (or your operational equivalent). Reference CloudFormation parameters SrtInputCidr, SrtOutputCidr, ManagementCidr, and SshCidr. The sample stack opens outbound all so License Manager, Pulse, and DNS can reach AWS endpoints — restrict egress only if your account policy requires it and you accept activation/metrics risk.

KVM: Production attaches virtio-net to an existing host bridge; SRT and HTTP use the guest LAN IP on the usual ports. Lab userspace installs forward 127.0.0.1:5000, 5001, 8080, and SSH to the guest — nothing binds on 0.0.0.0 on the host unless you design otherwise. See KVM quickstart.

Release and transport compatibility

Confirm the running build with pixop-version on the appliance. Documentation below contrasts native-only images (no tsduck-transport-info helper) with relay-capable images (helper and relay templates installed). Image recipe and selected TRANSPORT_BACKEND are independent—a relay-capable image may still run native. Classify from installed binaries and .env, not from a Marketplace product label.

If TRANSPORT_BACKEND is unset, wrappers default to native. Setting relay without the relay helper and *.ingest.args / *.egress.args templates will fail at start—stay on native until your image supports relay.

Native vs relay (summary)

Read-only checks on any shipped appliance:

pixop-version
tsduckctl check main
tsduckctl check egress-main
ss -uln | grep -E ':5000|:5001'    # optional UDP listener detail
pixop-flow --secs 5

On relay-capable appliances (after command -v tsduck-transport-info succeeds), tsduckctl transport summarizes backend and relay templates (the CLI re-executes via sudo to read root-owned config):

tsduckctl transport main
tsduckctl transport egress-main

Details and safe edit flows: Transport configuration.

SRT credentials and encryption

pixop-instance-init generates unique alphanumeric passphrases on first boot for primary ingress and egress. They live only in instance .env files (root:root, mode 0600) and are injected into containers via --env-file — not expanded on the host docker run command line.

View the operator connection sheet on the appliance:

tsduckctl credentials

Do not paste passphrases into tickets, chat, or documentation. Aux egress passphrases are empty until you configure those lanes.

Operational readiness (what “up” means)

Treat these layers separately during commissioning and incidents:

Instance scope: tsduckctl restart main interrupts ingest and the internal mux path; tsduckctl restart egress-main interrupts egress output only. pixopctl restart recycles Pixop LIVE only — SRT listeners stay up. See tsduckctl and Configuration.

Checklist (primary path):

1. First boot complete (/var/lib/pixop-live/instance-init.complete).
2. License healthy (pixop-license doctor on AWS; JWT on KVM).
3. Firewall / security group permits UDP 5000 and 5001 from correct peers.
4. tsduckctl credentials — distribute URIs to encoder and receiver teams securely.
5. Continuous live source during first minute (GPU model load).
6. pixop-flow --secs 5 — confirm :5500 then :5501.
7. tsduckctl detect-video-pid main then --apply only after review.
8. tsduckctl tune-latency main then --apply only after review.

Video loss policy

PIXOP_VIDEO_LOSS_POLICY in main.env controls behavior when Pixop replacement video disappears. Defaults, semantics, and change control: Transport configuration.

Changing transport

Edits to relay *.args or native SRT_* keys require tsduckctl restart <instance>. Expect brief media interruption on that leg. After restart, run tsduckctl check <name> and pixop-flow --secs 5. When tsduck-transport-info is installed, also run tsduckctl transport <name> before declaring success.

Relay, bonding, pixop-net, and stall recovery require a relay-capable image—confirm helpers and templates before enabling. Do not enable relay templates on a native-only appliance without migrating to a qualified image that ships relay.

Related documentation