Networking

HTTP request smuggling arises from RFC 7230 ambiguity: when a proxy and backend disagree on where one request ends and the next begins, attacker-controlled bytes prepend to a victim’s request. CL.TE embeds a hidden TE chunk; TE.CL sets a short Content-Length; H2 downgrade reintroduces CL.TE on H1 backend connections after H2 header stripping. In production proxy chains with persistent connections and traffic volume, a single smuggle primitive becomes a credential harvester. Full byte-level mechanics, Burp Suite detection methodology, and mitigation per proxy tier.

UDP DNS is stateful in practice: recursive resolvers hold per-query client tables, delegation chain depth counters, DNSSEC validation state, and TCP connection pools for DoT/DoH. Each layer is exhaustible at different cost ratios. Water torture generates maximum valid NXDOMAIN workload at minimum bandwidth. NXNS amplification (CVE-2020-8616) forces resolver delegation storms via NS referrals. TsuNAME creates infinite cyclic delegation. NRDelegation combines both. Full BIND9/Unbound configuration hardening and rate-limiting defense included.

The ‘65536 port limit’ framing is wrong — Linux TCP capacity is governed by 4-tuple uniqueness (src_ip:src_port:dst_ip:dst_port) and ip_conntrack_max. TIME_WAIT exhaustion holds sockets in 2MSL timeout, consuming conntrack entries. Sockstress sets TCP window=0 to trigger infinite Persist Timer loops, stalling server state machines with minimal bandwidth. Slowloris-class variants do the same at L7. Full kernel parameter analysis: tcp_tw_reuse, tcp_fin_timeout, conntrack_max, and per-attack mitigation.

Every HTTP server abstraction collapses to the same syscall chain: socket → bind → listen → accept → read → sendfile → close. In pure x86_64 Assembly, each step is explicit: bswap converts port to network byte order, SCASB/LODSB scans the GET request path byte-by-byte for ../ traversal sequences, sys_fstat retrieves exact file size for sys_sendfile, sys_sendfile(40) transfers file data directly from disk to NIC via kernel space — zero user-space copy, zero libc, zero external libraries. Full source on GitHub.

OS-level clocks (gettimeofday, clock_gettime) introduce their own scheduling jitter — unusable for nanosecond-scale network measurement. RDTSC reads the CPU’s Time Stamp Counter directly: rdtsc + shl rdx,32 + or rax,rdx yields a 64-bit cycle count. Delta between two RDTSC reads gives precise inter-packet timing. Jitter = |D_i - D_{i-1}| across packet sequence. Gaussian distribution = stable network. High variance = bufferbloat, middlebox processing, or behavioral detection baseline deviation. CPUID/RDTSCP prevent out-of-order execution from skewing measurements.

Linux and Windows ICMP Echo Requests differ in payload size (64B vs 40B), default content (timestamp vs alphabetical), and TTL values — forming OS-specific network fingerprints that NIDS use for traffic classification. Traffic mimicry replicates these signatures at the assembly level: 8-byte RDTSC timestamp emulation, sequential byte padding (0x10–0x1F), and strict 64-byte structural alignment bypass DPI anomaly detection without triggering empty-payload or entropy signatures.