Jitter

Fixed-interval C2 beacons produce detectable periodic patterns in SOC traffic baselines and behavioral analysis engines. LCG jitter breaks this: rdtsc reads the CPU Time Stamp Counter for hardware entropy, imul+add applies the Numerical Recipes LCG scramble (X = 1664525X + 1013904223 mod 2^32), div maps the result to [100ms, 1000ms), sys_nanosleep (syscall 35) executes the delay. Result: uniform random inter-beacon intervals with 2^32 period, zero external dependencies, full register preservation, pure x64 Assembly.

OS-level clocks (gettimeofday, clock_gettime) introduce their own scheduling jitter — unusable for nanosecond-scale network measurement. RDTSC reads the CPU’s Time Stamp Counter directly: rdtsc + shl rdx,32 + or rax,rdx yields a 64-bit cycle count. Delta between two RDTSC reads gives precise inter-packet timing. Jitter = |D_i - D_{i-1}| across packet sequence. Gaussian distribution = stable network. High variance = bufferbloat, middlebox processing, or behavioral detection baseline deviation. CPUID/RDTSCP prevent out-of-order execution from skewing measurements.