networking
31 posts found
TPROXY vs REDIRECT: Transparent Socket Interception on Linux
Intercepting routed TCP and UDP traffic on a Linux gateway without rewriting packet headers requires Netfilter TPROXY. Here is why REDIRECT breaks UDP and conne…
Eliminating Multi-Core Socket Contention with SO_REUSEPORT and SO_INCOMING_CPU
High-throughput TCP servers on multi-core Linux hit latency walls from accept queue spinlocks. Learn how SO_REUSEPORT and SO_INCOMING_CPU isolate socket queues …
X25519MLKEM768 vs X25519: Evaluating Hybrid Post-Quantum Key Encapsulation
A technical comparison of X25519 and hybrid X25519MLKEM768 in TLS 1.3, evaluating handshake wire overhead, CPU cycles, cryptanalytic resilience, and edge middle…
The Evolution of Web Application Firewalls: From RegEx Rules to AST Tokenizers and Wasm Filters
A technical timeline of how HTTP inspection evolved from brittle regular expressions and ReDoS traps to lexical tokenizers, WebAssembly filters, and streaming p…
Defensive Sysctl Parameters for Production IP Stacks
Default Linux kernel settings leave servers exposed to route hijacking, spoofed packets, and connection floods. Here are ten sysctl directives to secure the net…
You’re Debugging DNS in the Wrong Namespace
Network namespaces isolate DNS resolvers from the host. A practical guide to finding which namespace your process lives in, dropping into it, and tracing the ac…
TCP Keepalive Does Not Keep Your Connection Alive
Linux defaults to a 2-hour keepalive time. Dead connections sit in your process table for hours before the kernel notices. Here is how to fix that and why appli…
Noise Handshakes for NAT Traversal: Rathole Multiplexing Architecture
An architectural look at how user-space Noise Protocol tunnels avoid TCP-over-TCP breakdown and solve CGNAT ingress bottlenecks.
Your Localhost Server Is Listening on Every Interface
Running python http.server without --bind 127.0.0.1 opens every NIC to incoming connections. localhost in the URL bar does not equal loopback in the kernel.
Linux Nftables Flowtables: Netfilter Fastpath Connection State Gaps
Software flowtables cut CPU load on Linux routers by bypassing Netfilter chains. Here is why established connections ignore live firewall rule updates and how t…