The Windows registry key EnableICMPTimestampRep=0 is silently ignored by tcpip.sys — Ipv4pHandleTimestampRequest generates ICMP Type 14 replies unconditionally regardless of the registry value. Ghidra static analysis of tcpip.sys 10.0.26100.8457 reveals a second RFC 792 violation: Receive and Transmit timestamps are written in little-endian byte order while the adjacent IP Timestamp Option handler correctly calls htonl() on the same value. Confirmed via pcap, netstat ICMP counters, and WinDbg kernel breakpoints. CVE-1999-0524 scope analysis and WFP mitigation rule included.

ICMP-Ghost v3.6.3 hardens DNS tunneling with 5-domain rotation, RFC 4648 Base32 encoding, and A record QTYPE — eliminating static fingerprinting for rule-based NDR systems like Suricata and Snort.

icmp_timestamp() is implemented in every Linux kernel but never scrutinized at source level. A depth-8 ftrace investigation reveals six RFC 792 deviations: silent payload length threshold, Code field never validated, ts_ori echoed unconditionally across the full 32-bit range, conntrack state creation on Type 13, netfilter hook ordering, and reply generation path that bypasses standard socket accounting. Full call chain mapped: ip_rcv() → icmp_rcv() → icmp_timestamp() → icmp_reply() with all branching conditions documented.

HTTP request smuggling arises from RFC 7230 ambiguity: when a proxy and backend disagree on where one request ends and the next begins, attacker-controlled bytes prepend to a victim’s request. CL.TE embeds a hidden TE chunk; TE.CL sets a short Content-Length; H2 downgrade reintroduces CL.TE on H1 backend connections after H2 header stripping. In production proxy chains with persistent connections and traffic volume, a single smuggle primitive becomes a credential harvester. Full byte-level mechanics, Burp Suite detection methodology, and mitigation per proxy tier.

uRPF performs reverse routing lookup on every incoming packet’s source address — if the packet arrived on the wrong interface, it’s spoofed and dropped. When uRPF is disabled (the enterprise wireless default due to asymmetric routing), any host on the L2 segment can claim any source IP unconditionally. This is CWE-290 at Layer 3. Three confirmed attack classes in ArubaOS AOS-8: Smurf amplification (spoofed src → broadcast → victim flood), ICMP Timestamp leak (impersonate trusted management IP → elicit timestamp response), pre-auth reflection (use controller as intermediary). Single-packet pcap signature included. Linux sysctl and Cisco IOS uRPF configuration provided.

EtherLeak is an ICMP information disclosure class that resurfaces across vendors and decades — same root cause, different hardware. IP stacks that trust IP_Total_Length over actual frame length expose NIC DMA ring buffer contents via ICMP Echo. Combined with TTL=0, extraction runs at 1,800 bytes/second with zero IDS alerts, zero firewall logs. Covers full mechanism, threshold math, Suricata detection rules, and Scapy PoC.