First-principles systems engineering research evaluating operating system kernel boundaries, cross-protocol state friction, and internet-scale systemic risk modeling.
This repository avoids generic enterprise security abstractions. Instead, it utilizes custom raw C socket engines, eBPF telemetry hooks, and virtualized multi-AS environments to empirically verify RFC implementation limits under adversarial conditions.
- Host Development Node: Kali Linux (Primary engineering workstation & QEMU/KVM hypervisor controller)
- Fuzzing & Control VM: Ubuntu Server 24.04 LTS (Headless, non-GUI node optimized for Syzkaller, AFLnet, and high-speed payload compilation)
- Target Infrastructure VM: Rocky Linux 9.x (Running developer-compiled debug kernels, FRRouting, and Bind9 core services)
- Target Research Kernel: Custom Upstream Linux Source (Instrumented with
CONFIG_KASAN=y,CONFIG_KCOV=y,CONFIG_DEBUG_NET=y,CONFIG_PANIC_ON_OOPS=y) - Ecosystem Footprint: 100% Linux Native.
- Hypervisor & Core Sandbox: QEMU/KVM running on a dedicated physical host with isolated network namespace boundaries.
- Payload Engine & Crafting: Custom C network engines (
<netinet/*>), multithreaded Rust network injection utilities, and Scapy protocol grammars. - Telemetry & Kernel Auditing:
bpftrace/bcc(eBPF hooks tracing kernel socket queue allocations in real-time),dumpcap/tcpdump(rolling file-rotating ring-buffers), and socket state statistics (ss -t -i). - Orchestration & Routing Daemons: Containerlab injecting active FRRouting (BGP/OSPF) and OpenBGPD nodes.
- Simulation 1.1: IPv6 Extension Header Infinite Chain
- Focus: Recursive field parsing loops inside the Linux kernel
sk_buffstructure (RFC 8200 / RFC 7045).
- Focus: Recursive field parsing loops inside the Linux kernel
- Simulation 1.2: TCP State-Machine Blind Reset Validation
- Focus: Mapping Sequence/ACK window validation logic under direct injection (RFC 9293 / RFC 5961).
- Simulation 2.1: IP Fragmentation & TCP Reassembly Loops
- Focus: Overlapping fragment offset handling and interface queue desynchronization (RFC 791 / RFC 1858 / RFC 3128).
- Simulation 2.2: IPv6 NDP Multicast Resource Exhaustion
- Focus: Neighbor Cache state allocation table tracking induced by unauthenticated scans (RFC 4861 / RFC 6583).
- Simulation 3.1: BGP Session Teardown via Understream TCP Window Exhaustion
- Focus: Transpose transport-layer starvation into macro-scale BGP control plane failures (RFC 4271 / RFC 2385 / RFC 5925).
- Simulation 3.2: DNS Anycast Routing Desynchronization
- Focus: Path cost calculation changes driven by application-layer UDP-to-TCP fallback friction (RFC 4786 / RFC 1035 / RFC 6891).
- Simulation Extended 3.3: RPKI Validation Path Starvation via TCP Window Desynchronization
- Simulation Extended 3.4: BGP Route Reflector State Divergence via Induced Core Telemetry Jitter
- Simulation Extended 3.5: Carrier-Grade NAT (CGNAT) Memory Mapping Exhaustion via UDP-to-TCP Port Looping
- Simulation Extended 3.6: Anycast DNS Boundary Flapping via Injected ICMPv6 "Packet Too Big" Inconsistencies
- Simulation Extended 3.7: Segment Routing over IPv6 (SRv6) Endpoint State Stalls via Extension Header Recursion
Every simulation in this workspace is executed using an intense, reproducible 72-hour engineering sprint matrix designed to prioritize deep exploration and automated zero-day research:
- Day 1: Theory, Topology, and Baseline Infrastructure (8 Hours)
- RFC Isolation (2 Hours): Extract raw protocol specs, state variables, and input boundary constraints directly from authoritative standards documents.
- Topology Definition (2 Hours): Construct the isolated multi-interface network graph using Containerlab or QEMU nodes.
- Verification (4 Hours): Boot target nodes running custom debug kernels, confirm routing adjacency paths, and verify complete containment.
- Day 2: Scripting, Instrumentation, and Fuzz Loop Soak (8 Hours)
- Payload Engineering (3 Hours): Write the deterministic test scripts in C (
SOCK_RAW), Rust, or Scapy to hit the baseline protocol path. - Telemetry Attachment (2 Hours): Spin up rolling
dumpcapring buffers and attach real-time eBPF logic tracking hooks. - Fuzz Execution (3 Hours Setup): Deploy specialized fuzzing grammars to Syzkaller, AFLnet, or Atheris and let the automated testing pipeline run a continuous 12-to-16 hour soak session overnight to discover deep code paths.
- Payload Engineering (3 Hours): Write the deterministic test scripts in C (
- Day 3: Triage, Upstream Validation, and Portfolio Publishing (8 Hours)
- Crash Triage (2 Hours): Stop fuzzing runs. If anomalies are found, parse the automated logs, extract matching
.pcaptime slices, and break down KASAN memory maps or eBPF queue tracking data. - Upstream Verification (2 Hours): Compile the unreleased upstream stable source branch of the target software, deploy the crash-reproduction payload, and confirm if the bug persists on the bleeding-edge main branch.
- Portfolio Output (4 Hours): Format the project repository branch, clean and annotate scripts with RFC cross-references, author a deep architectural post detailing findings, and manage coordinated disclosures under
LEGAL_SAFE_HARBOR.md.
- Crash Triage (2 Hours): Stop fuzzing runs. If anomalies are found, parse the automated logs, extract matching
The code, technical methodologies, architecture blueprints, and documentation provided across this entire portfolio (including all sub-directories, automation scripts, and associated experimental pipelines) are created strictly for educational, defensive security optimization, and authorized academic research purposes.
- Isolated Testing Mandate: Software, scripts, and packet-crafting utilities contained herein are designed to interact with low-level kernel stacks and network protocols. They are built to test edge-cases that may cause immediate system instability or unrecoverable kernel panics. Execution must be confined strictly to host-isolated, software-defined air-gapped laboratory environments (e.g., as outlined in SOP-SEC-LAB-01).
- Explicit Authorization Required: Under no circumstances should any utility or methodology within this repository be deployed against systems, networks, or infrastructure without explicit, prior written authorization from the verified infrastructure owner.
- No Warranty or Liability: This software and information are provided "as-is" without warranty of any kind. The author assumes no liability, responsibility, or legal accountability for any misuse, unintended systemic disruption, data corruption, hardware damage, or illegal activity executed by third parties utilizing these materials.
- The "Domino Effect" Waiver: Due to the complex architectural nature of cross-protocol research simulations (such as transport-to-routing layer interactions), the user assumes all risks regarding cascading failures or state-desynchronization anomalies within their testing environments.
- Legal Compliance: Users are entirely responsible for ensuring their actions comply with all local, national, and international statutes regarding computer fraud, data privacy, and telecommunications security (e.g., the US Computer Fraud and Abuse Act, or regional equivalents).
- Commitment to Responsible Disclosure: The author is a dedicated advocate for global internet security and operates strictly under established Responsible Vulnerability Disclosure frameworks. Any zero-day vulnerabilities or systemic flaws discovered through the methodologies in this lab are reported directly to the affected vendors, maintainers, or appropriate coordination centers (e.g., CERT/CC, CISA) prior to any public architectural documentation.