# TCP/IP TCP/IP is a suite of communications protocols, specifically Transmission Control Protocol and Internet Protocol, that forms a technical foundation of the Internet. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Wireshark: analiza tráfico de red visualmente DevFeed: [Wireshark: analiza tráfico de red visualmente]() Original publisher: [Read original article]() Author: Antonio Pérez Published: 2026-08-02T00:00:00Z Content type: tutorial Language: es Sources: [tengoping.com]() Topics: [TCP/IP](), [Linux](), [Ethernet](), [Debian](), [Ubuntu](), [Command-line interface](), [interfaces](), [macOS](), [Windows]() Tags: [debian](), [ethernet](), [interfaces](), [linux](), [macos](), [tcp-ip](), [terminal](), [ubuntu](), [ubuntu-24-04](), [windows]() ### AI overview A practical guide to Wireshark covering installation, packet capture without running the graphical application as root, display filters, protocol-layer inspection, and TCP flow tracking. It includes real capture examples and discusses the security implications of granting capture permissions. ### Source excerpt Guía práctica de Wireshark: instalación, captura sin root, filtros de visualización, inspección de capas y seguimiento de flujos TCP con ejemplos reales. ## Putting the Tech in Fintech: How We Use FIX to Execute Trades at Scale DevFeed: [Putting the Tech in Fintech: How We Use FIX to Execute Trades at Scale]() Original publisher: [Read original article]() Author: Grace Sun Published: 2026-04-22T00:27:03Z Content type: article Language: en Sources: [Wealthfront]() Topics: [distributed-systems](), [networking](), [Transactions](), [Back end](), [IP routing](), [TCP/IP]() Tags: [architecture](), [backend](), [distributed](), [financial](), [infrastructure](), [networking](), [route](), [scale](), [systems](), [tcp-ip](), [tech](), [technology](), [trading](), [transactions](), [wealthfront-engineering]() ### AI overview Wealthfront explains the distributed-systems infrastructure it uses to route and execute large volumes of stock trades. The article describes broker networking, IP routing, the FIX protocol, and the application layers supporting automated, low-latency trade execution. ### Source excerpt At Wealthfront, the "tech" in financial technology isn't just a buzzword--it's the foundation of everything we build. Beneath the intuitive frontend our clients interact with lies a complex ecosystem of distributed systems. One of the most critical pieces of that backend architecture is the engine that enables us to route massive volumes of trades efficiently. ... Read more ## Comparing IP and CLNP: Reaching Off-Subnet Nodes DevFeed: [Comparing IP and CLNP: Reaching Off-Subnet Nodes]() Original publisher: [Read original article]() Published: 2025-03-05T07:08:00Z Content type: tutorial Language: en Sources: [ipSpace.net blog]() Topics: [TCP/IP](), [networking](), [DHCP](), [Load Balancing]() Tags: [cisco](), [dhcp](), [ip](), [ipv4](), [ipv6](), [load-balancing](), [networking-fundamentals](), [routing]() ### AI overview This article compares how TCP/IP and CLNP identify a first-hop router for traffic to off-subnet nodes. It describes IPv4 default routes, DHCP configuration, first-hop redundancy protocols, and CLNP Intermediate System Hellos. ### Source excerpt The previous blog post in this series discussed how TCP/IP and CLNP reach adjacent nodes and build ARP/ND/ES caches. Now let's move one step further: how do nodes running IPv4/IPv6 or CLNP discover the first-hop router that could forward their traffic to off-subnet nodes they want to communicate with? Read more ... ## The origins of the Idle Scan DevFeed: [The origins of the Idle Scan]() Original publisher: [Read original article]() Published: 2023-10-19T10:40:27Z Content type: article Language: en Sources: [Antirez]() Topics: [Network](), [TCP/IP](), [Operating system](), [Tool](), [Protocol (disambiguation)]() Tags: [attacks](), [network](), [operating-systems](), [protocol](), [research](), [tcp](), [tcp-ip](), [tool](), [udp]() ### AI overview The article recounts how the Idle scan originated in 1998 through experimentation with Hping, a tool for crafting unusual TCP/IP packets. It explains that observing incrementing IP ID values revealed a universal outgoing-packet counter in operating systems, which could be used to estimate a networked computer's outgoing traffic. ### Source excerpt The Idle scan was conceived at the end of 1998, evidenced by emails. I had moved to Milan a few months prior, having been there since September if I recall correctly, brimming with new ideas, unaware that my stay in that city would be brief. I spent the summer on the beaches of Sicily, mainly occupied with reading many books recommended by the folks at Seclab (mostly by David). However, those readings needed a catalyst: the Idle scan was an attack born from theoretical rumination, but the stream of thoughts originated from a rather practical circumstance. I had recently created Hping, a tool whose logo was borrowed from that of Nutella. I mention this to emphasize the seriousness that governed my efforts at that time -- after all, I was only twenty-one and already in Northern Italy with a full-time job on my shoulders; some understanding was warranted. Hping was a Swiss Army knife for the TCP/IP protocol. Its initial use was mostly exploratory, for research. With Hping, you could assemble TCP, UDP, and ICMP packets in the most bizarre manner, and encapsulate them in equally eccentric IP packets, fragmented, with fields set to anomalous values. These packets were sent around to observe the network stack response of different operating systems. This is where Idle scan originates: playing with Hping for just a few minutes revealed a well-known yet (to me) surprising fact. The response packets had an ID field that continuously incremented by some measure. At that time, given that the attacks I would later disclose were not yet known, this ID field behavior aroused no concern. Every time an operating system emitted an IP packet, it first incremented a counter (which reset to zero once it reached the maximum value of two to the sixteenth power minus one), then the packet was sent with the ID set to the counter's value. The counter was universal for all outgoing packets. This allowed, for starters, to estimate the outgoing traffic of any networked computer. This information ## Reverse-engineering tcpip.sys: mechanics of a packet of the death (CVE-2021-24086) DevFeed: [Reverse-engineering tcpip.sys: mechanics of a packet of the death (CVE-2021-24086)]() Original publisher: [Read original article]() Author: Axel "0vercl0k" Souchet Published: 2021-04-15T15:00:00Z Content type: tutorial Language: en Sources: [Diary of a reverse-engineer]() Topics: [Reverse Engineering](), [Vulnerabilities](), [Cybersecurity](), [TCP/IP](), [Windows](), [Kernel]() Tags: [cve-2021-24086](), [fragmentation](), [ipv6preassembledatagram](), [kernel](), [poc](), [recursive-fragmentation](), [reverse-engineering](), [tcp-ip](), [tcpip-sys](), [vulnerabilities](), [windows]() ### AI overview This article reverse-engineers CVE-2021-24086, a remotely triggerable NULL dereference in the Windows TCP/IP kernel code. It explains the patch-diffing and reverse-engineering process, the network-buffer condition behind the flaw, and the development of a proof of concept. ### Source excerpt Introduction Since the beginning of my journey in computer security I have always been amazed and fascinated by true remote vulnerabilities. By true remotes, I mean bugs that are triggerable remotely without any user interaction. Not even a single click. As a result I am always on the lookout for ... ## Jane Street's 2018 Intern Projects in Networking, Linux Security, and OCaml Web UIs DevFeed: [Jane Street's 2018 Intern Projects in Networking, Linux Security, and OCaml Web UIs]() Original publisher: [Read original article]() Author: Yaron Minsky Published: 2018-08-06T00:00:00Z Content type: article Language: en Sources: [Jane Street]() Topics: [networking](), [TCP/IP](), [Linux](), [Security](), [firewalls](), [OCaml](), [JavaScript](), [Framework](), [Go]() Tags: [firewalls](), [framework](), [hardware](), [incremental](), [internship](), [javascript](), [linux](), [networking](), [ocaml](), [performance](), [tcp](), [tcp-ip](), [ui]() ### AI overview Jane Street reviews a selection of its 2018 intern projects, including a user-level TCP/IP stack, Linux kernel and firewall configuration through netlink sockets, and improvements to Incr_dom, an OCaml framework for efficient JavaScript web UIs. The article also discusses the performance demands of financial-market networking and user-space network stacks. ### Source excerpt Yet again, intern season is coming to a close, and so it's time to look back at what the interns have achieved in their short time with us. I'm always impressed by what our interns manage to squeeze into the summer, and this year is no different. ## Tweaking TCP for Real-time Applications: Nagle's Algorithm and Delayed Acknowledgment DevFeed: [Tweaking TCP for Real-time Applications: Nagle's Algorithm and Delayed Acknowledgment]() Original publisher: [Read original article]() Author: umer Published: 2017-03-19T00:00:00Z Content type: tutorial Language: en Sources: [Code Ahoy - Articles]() Topics: [TCP/IP](), [real-time](), [Protocol (disambiguation)](), [Algorithm]() Tags: [algorithm](), [data-transmission](), [protocol](), [real-time](), [tcp-ip]() ### AI overview This tutorial explains how TCP buffering techniques affect real-time applications that send small messages. It focuses on Nagle's algorithm, which combines small messages to reduce packet overhead, and introduces TCP delayed acknowledgment. The article notes that Nagle's algorithm can create performance issues for multiplayer gaming servers. ### Source excerpt TCP is a complex protocol. Don't get me wrong. It is a marvelous piece of engineering that gives us the reliable data transmission guarantee that other protocols don't provide. Reliable data transmission between two devices on the internet is no walk in the park and TCP uses a lot of magic under the hood to make things happen. Generally, it does a fine job of abstracting away low level details and its default settings work fine for most general purpose use cases. However, once in a while, things don't go according to plan and we need to pop open the hood and do some tweaking. It is in these situations, that some knowledge of TCP comes in very handy. By default, TCP uses two buffering techniques to optimize and minimize overhead for general purpose applications. However, if you are building applications that require real-time message delivery for small messages (e.g. chat or control messages), you must have some knowledge of these techniques. Nagle's algorithm TCP delayed acknowledgment Let's look at them in more detail. Nagle's Algorithm If there's no congestion, TCP tacks on a header and sends data out as soon as it gets it from the application. If the application is generating a lot of small messages, the headers can add a lot of overhead: TCP/IP headers are 40-byte, so 1-byte of data is sent as 41-byte packet on the network. A computer programmer named John Nagle came up with an algorithm to reduce the overhead by combining many small messages into a single message. Nagle's algorithm, named after its inventor, is a technique to make TCP more efficient by reducing the number of packets that are sent over the network. Here's the pseudo code for the algorithm: if there is new data to send if the window size >= MaximumSegmentSize and available data is >= MaximumSegmentSize send complete MaximumSegmentSize segment now else if there is unconfirmed data still in the pipe enqueue data in the buffer until an acknowledge is received else send data immediately end if end if ## Why the select I/O multiplexing model is considered broken by design DevFeed: [Why the select I/O multiplexing model is considered broken by design]() Original publisher: [Read original article]() Author: Marek Published: 2017-01-05T23:00:00Z Content type: opinion Language: en Sources: [Marek Majkowski]() Topics: [IO](), [TCP/IP](), [Linux](), [Kernel](), [file]() Tags: [article](), [async](), [blog](), [kernel](), [tcp-ip]() ### AI overview This article examines alternatives for I/O multiplexing and argues that the select model is broken by design because its semantics prevent effective kernel-side optimizations. It also discusses related technologies that inherit those semantics. ### Source excerpt Select is fundamentally broken I/O multiplexing part #2 In a previous blog post we discussed a brief history of the syscall. The article concludes that some I/O multiplexing was necessary to do console emulation, games and non-trivial TCP/IP applications. The BSD designers chose the multiplexing model and other Unixes followed. But is the only multiplexing model? A good explanation can be found in the old revision of "The Design and Implementation of the FreeBSD Operating System" book. ## Google SoC lwIP Conclusion DevFeed: [Google SoC lwIP Conclusion]() Original publisher: [Read original article]() Published: 2016-08-23T00:00:00Z Content type: article Language: en Sources: [Front Page on ReactOS Website]() Topics: [ReactOS](), [lwIP](), [TCP/IP](), [Operating system]() Tags: [c](), [conclusion](), [free](), [google](), [kernel](), [lwip](), [open-source](), [os](), [react](), [reactos](), [tcp-ip](), [threading](), [udp](), [win32](), [winapi]() ### AI overview A Google Summer of Code participant reports on developing TCP and UDP support for ReactOS using lwIP. The project did not achieve full browser support or a Windows Server 2003 driver replacement, but produced a fairly robust TCP/IP driver for C console applications using TCP and UDP sockets, with extensive testing on loopback. ### Source excerpt My Google Summer of Code project proposal stated that I would add TCP support to the network branch of ReactOS, which sought to integrate lwIP 1.4.1 as the protocol level network driver for the operating system, to ultimately be tested by replacing the network driver in an installation of Windows Server 2003 with my driver. The full proposal can be found here. At the time of my proposal, I underestimated the amount of effort a fully working network driver would take. ## Google SoC lwIP Report Week 1 DevFeed: [Google SoC lwIP Report Week 1]() Original publisher: [Read original article]() Published: 2016-05-27T00:00:00Z Content type: article Language: en Sources: [Front Page on ReactOS Website]() Topics: [ReactOS](), [lwIP](), [TCP/IP](), [systems](), [Programming](), [Google]() Tags: [bug](), [debug](), [free](), [google-summer-of-code](), [lwip](), [open-source](), [os](), [programming](), [react](), [reactos](), [systems](), [tcp-ip](), [win32](), [winapi]() ### AI overview A first-week report on integrating lwIP into ReactOS during Google Summer of Code. The author describes testing a Winsock TCP server-client pair, debugging ReactOS kernel-mode drivers, fixing a socket binding bug, and investigating TCP connection establishment while noting that many TCP functions remain unimplemented. ### Source excerpt Note: I am publishing these but each student is responsible for actually writing them. I am Zuodian Hu or, as I like to be called, Dian (pronounced the same as Dan). I just finished my junior year at the University of Wisconsin at Madison, where I am working on an electrical engineering and computer science double major. My personal interest lies in systems programming and digital logic. In addition to my classes, I play violin in the UW-Madison symphony orchestra and do programming for Wisconsin Robotics and the UW-Madison team competing in the NASA Robotics Mining Competition. ## Bind before connect DevFeed: [Bind before connect]() Original publisher: [Read original article]() Author: Marek Published: 2014-04-02T22:00:00Z Content type: tutorial Language: en Sources: [Marek Majkowski]() Topics: [Linux Kernel](), [TCP/IP](), [API](), [Code](), [Python]() Tags: [article](), [linux](), [linux-kernel](), [nat](), [port](), [python](), [socket](), [tcp-ip]() ### AI overview This article explains how the Linux kernel allocates source ports for TCP/IP connections, including ephemeral port selection, port reuse, connection limits, and the bind-before-connect technique. ### Source excerpt Bind before connect A TCP/IP connection is identified by a four element tuple: {source IP, source port, destination IP, destination port}. To establish a TCP/IP connection only a destination IP and port number are needed, the operating system automatically selects source IP and port. This article explains how the Linux kernel does the source port allocation. Ephemeral port range To establish a connection BSD API requires two steps: first you need to create a socket, then call on it. ## Fun with The Great Firewall DevFeed: [Fun with The Great Firewall]() Original publisher: [Read original article]() Author: Marek Published: 2013-07-10T22:00:00Z Content type: opinion Language: en Sources: [Marek Majkowski]() Topics: [Firewall](), [tor](), [TCP/IP]() Tags: [firewall](), [iptables](), [payload](), [port](), [servers](), [ssl](), [tcp-ip](), [tor]() ### AI overview The article describes observations of how China's Great Firewall probes and blocks Tor bridges. It reports that detected Tor bridges may have their IP-and-port tuples blocked for hours, while later probing behavior appeared to vary over time and was not fully understood. ### Source excerpt Fun with The Great Firewall I was playing with the Tor Project and decided to understand how the Chinese block Tor servers. Philipp Winter wrote an amazing paper on that subject. He noticed The Great Firewall of China is actively scanning services and if it detects a Tor bridge it blocks the ip:port tuple for a few hours. TCP/IP When a port gets censored "ACK" packets are dropped by the GFW. Most importantly and . ## Stripping layer 2 in pcap DevFeed: [Stripping layer 2 in pcap]() Original publisher: [Read original article]() Author: Marek Published: 2013-01-28T23:00:00Z Content type: tutorial Language: en Sources: [Marek Majkowski]() Topics: [Network](), [TCP/IP](), [Code](), [Decoding]() Tags: [code](), [decoding](), [network](), [tcp-ip]() ### AI overview The article explains why extracting IP headers from captured TCP/IP packets requires removing the layer 2 header first. It discusses data-link types, hardcoded offsets, VLAN headers, and differing strategies for decoding packet layouts. ### Source excerpt Stripping layer 2 in pcap Say you want to sniff TCP/IP packets on your network. That's pretty easy, right? Use , receive packets from the network interface and we're done. But before you can extract the IP header from a received packet you need to strip layer 2 header. It's not that easy. tries to help only a bit - it is possible to get the data link type of the network interface. But this is useless without the knowledge of how to extract IP from given data link type. ## SSL fingerprinting for p0f DevFeed: [SSL fingerprinting for p0f]() Original publisher: [Read original article]() Author: Marek Published: 2012-06-16T22:00:00Z Content type: article Language: en Sources: [Marek Majkowski]() Topics: [SSL](), [HTTP](), [TCP/IP](), [browser](), [Chrome](), [Firefox]() Tags: [chrome](), [compression](), [firefox](), [handshake](), [handshakes](), [http](), [ssl](), [tcp-ip](), [tls]() ### AI overview The article describes SSL/TLS fingerprinting for p0f. It explains how client cipher suites, extensions, ordering, protocol versions, and other handshake details can identify SSL clients such as browsers, and discusses a p0f module that matches generated fingerprints against predefined signatures. ### Source excerpt SSL fingerprinting for p0f In January Lcamtuf announced a complete rewrite of his passive fingerprinting tool p0f. Historically p0f was a low-level tool focused on fingerprinting layer 4, mostly and TCP/IP packets. The new version of p0f is different: not only it can look at low level packets, but also it is capable of fingerprinting higher-level application protocols. Currently it is able to do HTTP fingerprinting and the author suggests other protocols might soon follow. ## ReactOS 0.3.14 Released DevFeed: [ReactOS 0.3.14 Released]() Original publisher: [Read original article]() Published: 2012-02-08T00:00:00Z Content type: release Language: en Sources: [Front Page on ReactOS Website]() Topics: [ReactOS](), [networking](), [TCP/IP](), [lwIP]() Tags: [free](), [lwip](), [open-source](), [os](), [react](), [reactos](), [release](), [tcp-ip](), [win32](), [winapi]() ### AI overview ReactOS 0.3.14 was released with networking, user-interface, kernel-testing, and build-toolchain improvements. The release adds a TCP/IP driver built around lwIP, wireless networking support, theme support, and MSVC-based builds. ### Source excerpt The ReactOS team is proud to announce the release of ReactOS 0.3.14. This version includes a significant amount of changes including both user visible and architectural improvements. Also included in this release is the valuable work accomplished as part of the Google Summer of Code 2011 event, of which ReactOS was a mentoring project. One of the more significant sets of improvements was to ReactOS' networking stack. As part of the GSoC, ReactOS gained a new TCP/IP driver built around the LwIP project. ## ReactOS Newsletter: Wireless Networking and USB Driver Progress DevFeed: [ReactOS Newsletter: Wireless Networking and USB Driver Progress]() Original publisher: [Read original article]() Published: 2012-01-24T00:00:00Z Content type: article Language: en Sources: [Front Page on ReactOS Website]() Topics: [ReactOS](), [Networks](), [Network](), [Operating system](), [DHCP](), [TCP/IP](), [USB](), [systems]() Tags: [dhcp](), [free](), [kernel](), [network](), [open-source](), [os](), [react](), [reactos](), [tcp-ip](), [usb](), [win32](), [winapi]() ### AI overview ReactOS development updates include support for joining open and WEP-encrypted wireless networks, along with ongoing work on USB host-controller and device drivers. WPA and WPA2 support was not yet implemented, and several USB features remained incomplete. ### Source excerpt Wireless Cameron Gutman has spent the last month or so adding the pieces needed to support wireless network cards to ReactOS. A good portion of the work entailed writing the NDIS protocol driver (ndisuio) that handles sending wireless NDIS object identifier (OID) messages. These messages handle querying network drivers about their status and capabilities and also set the receiving mode the device should operate in. In addition to the kernel side, a user mode utility is needed to let end users actually make these requests. ## Accepted Summer of Code Projects DevFeed: [Accepted Summer of Code Projects]() Original publisher: [Read original article]() Published: 2011-04-26T00:00:00Z Content type: release Language: en Sources: [Front Page on ReactOS Website]() Topics: [ReactOS](), [TCP/IP](), [lwIP](), [Shell](), [ui](), [Testing](), [Font](), [Streams]() Tags: [free](), [lwip](), [open-source](), [os](), [react](), [reactos](), [shell](), [tcp-ip](), [testing](), [user-interface](), [win32](), [winapi]() ### AI overview The ReactOS project accepted six Summer of Code projects covering TCP/IP stack work using lwIP, a new Explorer shell, theme support, audio stream mixing, kernel-mode testing, and a GDI font driver. ### Source excerpt The ReactOS project has accepted six entries from the submitted projects, covering a wide range of functionality. The completion of some would have immediate, user visible effects on ReactOS, while others are more long term. TCP/IP Driver Rewrite of the current TCP/IP stack using the lwIP library. Student: Claudiu Mihail Mentor: Art Yerkes Completion of Explorer_New Complete the implementation of a new explorer shell for ReactOS. Student: Andrew Green Mentor: Aleksey Bragin Theme Support Implement the theme service for the user interface. ## ReactOS Newsletter 75: Bitmap Drawing and LiveCD Networking Updates DevFeed: [ReactOS Newsletter 75: Bitmap Drawing and LiveCD Networking Updates]() Original publisher: [Read original article]() Published: 2010-08-07T00:00:00Z Content type: news Language: en Sources: [Front Page on ReactOS Website]() Topics: [ReactOS](), [Network](), [networking](), [GUI](), [TCP/IP](), [DHCP](), [win32]() Tags: [compression](), [data-structures](), [dhcp](), [free](), [graphics](), [network](), [networking](), [open-source](), [os](), [react](), [reactos](), [tcp-ip](), [win32](), [winapi]() ### AI overview ReactOS Newsletter 75 reports development progress on bitmap drawing and LiveCD networking. It describes work to improve device-independent and device-dependent bitmap conversion, address legacy data-structure support, and fix bugs affecting TCP/IP, NDIS, and DHCP device detection so the LiveCD can get online. ### Source excerpt Starcraft 2 came out. Enough said. Bitmap Drawing Bitmaps are more or less the primary medium through which the Win32 subsystem draws things. However, the term refers to more than just the widely used format for images and the like. That format is generally considered a device independent bitmap (DIB). With a device independent version there of course exists a device dependent one, which is the format that a particular graphics device supports for drawing.