<p>You can't.</p>

<p>If all you have is a capture of the wire traffic for a single tx, you can't (always) compute the actual address.</p>

<p>In a certain subset of cases, such as for standardized scripts such as P2PKH or P2SH multisig, you might be able to <em>assume</em> the script sig to correspond to one of them, if it has the right data.</p>

<p>The scriptsig mentioned is for a segwit address, and is commonly put as the redeem script for P2SH wrapped segwit addresses.</p>

<p>However, note that just because a script sig matches the expected form for an address does not mean that the actual output corresponds to that address. For example, a P2PKH address would have a script sig with two pushes (one for the signature, one for the public key) - If you were so inclined, you could build an output script that simply consumes the top two elements of the stack, and create an output that will accept a P2PKH script sig as valid, while having absolutely no relation to the P2PKH address.</p>

<p>In general, if you want to know the source address, look up the transaction being spent, and use the locking script from that vout.</p>

CC BY-SA 4.0
2019-06-16T14:04:53.753Z
You also can't just blindly search pcaps for "addresses", I can construct data to send over the bitcoin network that looks like a valid transaction to you, but isn't to anybody else. You'd be colossally silly to rely on this having any meaning without the context of a validating node.
Claris
CC BY-SA 4.0
2019-06-17T05:23:04.597Z
@Anonymous I know that my scriptsig is for a segwit address and I calculate it's output address correctly before. My main question is which is the relation between public key which inserted in scriptsig and source address? in other words how we can evaluate the validity of trasnaction and ensure that sender have enough credit to send a specific bitcoin to an output address? i want to find a relation beween output address and source address from this scriptsig.
Aristo
CC BY-SA 4.0
2019-06-17T05:31:34.043Z
You can’t. The idea is silly. Run a validating node, don’t try to parse the information from packet dumps.
Claris
CC BY-SA 4.0
2019-06-16T12:03:04.833Z
2019-06-16T12:03:04.833Z
Raghav Sood
<p>I have a simple bitcoin packet which contains TX message.</p>

<p>in a TX message, one of it's Transaction input hex data was like this:</p>

<blockquote>
  <p>8b3e6cc50fd114f8f40f4223dcf3150448ffc1dc5587f1ca5de6d65f1972f46101000000232200203fff89bc822618068e248c92163cd1f3d0c4f1c7e71f0baf172f4b31438fb423ffffffff</p>
</blockquote>

<p>when i open this pcap file with wireshark, it show's previous output equal to:</p>

<blockquote>
  <p>8b3e6cc50fd114f8f40f4223dcf3150448ffc1dc5587f1ca5de6d65f1972f46101000000</p>
</blockquote>

<p>after that i see script length which is 0x23(35). so signature script of this packet is equal to:</p>

<blockquote>
  <p>2200203fff89bc822618068e248c92163cd1f3d0c4f1c7e71f0baf172f4b31438fb423</p>
</blockquote>

<p>.</p>

<p>can anybody explain to me how to extract source address which is generated from signature script in the above?</p>

<address><script><public-key><multi-signature><input-script>
Getting source address of a Tx message from it's signature script
Aristo
# Getting source address of a Tx message from it's signature script

(Asked by: username_0 on 2019-06-16)

I have a simple bitcoin packet which contains TX message.

in a TX message, one of it's Transaction input hex data was like this:

> 8b3e6cc50fd114f8f40f4223dcf3150448ffc1dc5587f1ca5de6d65f1972f46101000000232200203fff89bc822618068e248c92163cd1f3d0c4f1c7e71f0baf172f4b31438fb423ffffffff

when i open this pcap file with wireshark, it show's previous output equal to:

> 8b3e6cc50fd114f8f40f4223dcf3150448ffc1dc5587f1ca5de6d65f1972f46101000000

after that i see script length which is 0x23(35). so signature script of this packet is equal to:

> 2200203fff89bc822618068e248c92163cd1f3d0c4f1c7e71f0baf172f4b31438fb423

.

can anybody explain to me how to extract source address which is generated from signature script in the above?

**Tags:** address, script, public-key, multi-signature, input-script


---

## 1 answers

### Answer by username_1 on 2019-06-16. Score: 1

You can't.

If all you have is a capture of the wire traffic for a single tx, you can't (always) compute the actual address.

In a certain subset of cases, such as for standardized scripts such as P2PKH or P2SH multisig, you might be able to *assume* the script sig to correspond to one of them, if it has the right data.

The scriptsig mentioned is for a segwit address, and is commonly put as the redeem script for P2SH wrapped segwit addresses.

However, note that just because a script sig matches the expected form for an address does not mean that the actual output corresponds to that address. For example, a P2PKH address would have a script sig with two pushes (one for the signature, one for the public key) - If you were so inclined, you could build an output script that simply consumes the top two elements of the stack, and create an output that will accept a P2PKH script sig as valid, while having absolutely no relation to the P2PKH address.

In general, if you want to know the source address, look up the transaction being spent, and use the locking script from that vout.

> **Comments:**
> **username_2**: You also can't just blindly search pcaps for "addresses", I can construct data to send over the bitcoin network that looks like a valid transaction to you, but isn't to anybody else. You'd be colossally silly to rely on this having any meaning without the context of a validating node.  
> **username_0**: @Anonymous I know that my scriptsig is for a segwit address and I calculate it's output address correctly before. My main question is which is the relation between public key which inserted in scriptsig and source address? in other words how we can evaluate the validity of trasnaction and ensure that sender have enough credit to send a specific bitcoin to an output address? i want to find a relation beween output address and source address from this scriptsig.  
> **username_2**: You can’t. The idea is silly. Run a validating node, don’t try to parse the information from packet dumps.  

---

