Networking

OSI gives you 7 clean layers and tells you every packet goes through all of them in order. Modern networking disagrees. This post proposes a replacement model built around how systems actually behave: OS Kernel as its own layer, Proxy/Middleware as a first-class citizen, floating layers for protocols that shift placement based on deployment (TLS, eBPF, mTLS), and stack profiles for DPDK bypass, eBPF extension, and sidecar mesh. Positions taken on DoH, AF_XDP, io_uring, TOE offloads, and hardware crypto.

HTTP request smuggling arises from RFC 7230 ambiguity: when a proxy and backend disagree on where one request ends and the next begins, attacker-controlled bytes prepend to a victim’s request. CL.TE embeds a hidden TE chunk; TE.CL sets a short Content-Length; H2 downgrade reintroduces CL.TE on H1 backend connections after H2 header stripping. In production proxy chains with persistent connections and traffic volume, a single smuggle primitive becomes a credential harvester. Full byte-level mechanics, Burp Suite detection methodology, and mitigation per proxy tier.

UDP DNS is stateful in practice: recursive resolvers hold per-query client tables, delegation chain depth counters, DNSSEC validation state, and TCP connection pools for DoT/DoH. Each layer is exhaustible at different cost ratios. Water torture generates maximum valid NXDOMAIN workload at minimum bandwidth. NXNS amplification (CVE-2020-8616) forces resolver delegation storms via NS referrals. TsuNAME creates infinite cyclic delegation. NRDelegation combines both. Full BIND9/Unbound configuration hardening and rate-limiting defense included.

The ‘65536 port limit’ framing is wrong — Linux TCP capacity is governed by 4-tuple uniqueness (src_ip:src_port:dst_ip:dst_port) and ip_conntrack_max. TIME_WAIT exhaustion holds sockets in 2MSL timeout, consuming conntrack entries. Sockstress sets TCP window=0 to trigger infinite Persist Timer loops, stalling server state machines with minimal bandwidth. Slowloris-class variants do the same at L7. Full kernel parameter analysis: tcp_tw_reuse, tcp_fin_timeout, conntrack_max, and per-attack mitigation.

Every HTTP server abstraction collapses to the same syscall chain: socket → bind → listen → accept → read → sendfile → close. In pure x86_64 Assembly, each step is explicit: bswap converts port to network byte order, SCASB/LODSB scans the GET request path byte-by-byte for ../ traversal sequences, sys_fstat retrieves exact file size for sys_sendfile, sys_sendfile(40) transfers file data directly from disk to NIC via kernel space — zero user-space copy, zero libc, zero external libraries. Full source on GitHub.

OS-level clocks (gettimeofday, clock_gettime) introduce their own scheduling jitter — unusable for nanosecond-scale network measurement. RDTSC reads the CPU’s Time Stamp Counter directly: rdtsc + shl rdx,32 + or rax,rdx yields a 64-bit cycle count. Delta between two RDTSC reads gives precise inter-packet timing. Jitter = |D_i - D_{i-1}| across packet sequence. Gaussian distribution = stable network. High variance = bufferbloat, middlebox processing, or behavioral detection baseline deviation. CPUID/RDTSCP prevent out-of-order execution from skewing measurements.