Protocol Analysis

DNS State Exhaustion: From TCP Slot Starvation to NXNS Amplification

TIME_WAIT and Sockstress don’t translate directly to UDP DNS, but DNS has its own state surface. Recursive-client tables, pending-query slots, TCP/853 (DoT) and TCP/443 (DoH) sockets, delegation chains, and DNSSEC validation state are all exhaustible. This post covers water torture, NXNS, TsuNAME, NRDelegation, and the operational defaults that make DNS a softer target than HTTP.

TCP Connection State Exhaustion: TIME_WAIT, Sockstress, and Why 4-Tuple Math Beats Port Counting

The ‘65536 port’ framing is wrong. TCP connection capacity is governed by 4-tuple uniqueness and kernel state tables, not port counts. This post breaks down TIME_WAIT exhaustion, Sockstress (window=0 + Persist Timer abuse), Slowloris-class L7 variants, and the conditions under which each is still effective today.