ArubaOS 8.13.2.0 exposes an unauthenticated XML parser on port 32000 that resolves external entities, enabling OOB SSRF and internal port scanning. Wire-level pcap + target sshd log confirm server-side execution. Bugcrowd closed it as theoretical. No fix issued.
TIME_WAIT and Sockstress don’t translate directly to UDP DNS, but DNS has its own state surface. Recursive-client tables, pending-query slots, TCP/853 (DoT) and TCP/443 (DoH) sockets, delegation chains, and DNSSEC validation state are all exhaustible. This post covers water torture, NXNS, TsuNAME, NRDelegation, and the operational defaults that make DNS a softer target than HTTP.
The ‘65536 port’ framing is wrong. TCP connection capacity is governed by 4-tuple uniqueness and kernel state tables, not port counts. This post breaks down TIME_WAIT exhaustion, Sockstress (window=0 + Persist Timer abuse), Slowloris-class L7 variants, and the conditions under which each is still effective today.
A malformed packet is a dead packet. Learn how to implement the official RFC 1071 checksum algorithm in Assembly to ensure your custom ICMP data bypasses kernel drops.