Start string

Four bytes keep bitcoin's parallel networks from talking to each other by accident. Mainnet uses f9beb4d9 and regtest uses fabfb5da, and a node that reads an unexpected value throws away the message and usually the connection with it. The check catches misconfiguration rather than attackers, because anybody can send the correct four bytes.

How it works

The start string occupies bytes zero through three of a message and is tested before the node allocates memory for anything that follows.

Bitcoin Core hardcodes one value per chain. Mainnet is 0xf9beb4d9. Testnet3 is 0x0b110907. Testnet4, added alongside BIP94 in Bitcoin Core 28.0, is 0x1c163f28. Regtest is 0xfabfb5da. Signet is the interesting case: instead of a constant, its four bytes are derived by hashing the challenge script that defines who may sign that signet's blocks, so the public default signet and a private one you spin up for testing automatically refuse to speak to one another.

The values were not picked to look pretty. They are byte sequences unlikely to appear in ordinary stream data, so a client reading a corrupted or desynchronised TCP stream can scan forward until it finds the pattern again and resume from that point rather than dropping everything.

The same four bytes are written to disk. Inside the blk00000.dat files that hold raw blocks, every stored block is preceded by its network's start string and a four-byte length. That framing is what lets a node walk a block file it did not finish writing, locate the boundary between records, and discard only the truncated tail instead of the whole file.

Where you see it

The start string shows up whenever bitcoin traffic is inspected rather than simply used.

Open a packet capture on port 8333 and every frame in the conversation opens with f9 be b4 d9. Protocol analysers key on exactly that signature to label the traffic. Every project that forked the codebase changed the four bytes as one of its first acts, which is why forks cannot cross-connect even though their handshakes are otherwise identical.

For an ordinary user it surfaces once, as an unhelpful silence. Point a wallet configured for testnet at a mainnet node and you get no error, no rejection notice, no connection: the node reads four bytes it does not recognise, discards the message and eventually drops the peer. Confirming that both ends are on the same network is the first thing to check when a node and a wallet refuse to see each other.

Start string vs message header

The start string is one field; the message header is all four of them. A header is 24 bytes made of the start string, then a twelve-byte command name in ASCII, then a four-byte payload length, then a four-byte checksum. The start string answers which network, the command answers what sort of message, the length answers how much more to read. People use the two names interchangeably when they mean the header, which becomes actively confusing the moment you are counting byte offsets in a hex dump.