I build things that live in the parts of the stack most engineers don't touch — kernel networking, QUIC/HTTP3 edge proxies, eBPF-based packet filtering. When something is slow, broken, or under attack, I want to understand exactly why and fix it at the right layer.
Currently at CloudArmour — eBPF/Kernel DDoS mitigations, NAT/WireGuard infrastructure, nftables firewall tooling. Also writing about it — 44 articles on Hashnode & Medium.
A deep dive into how XDP programs parse raw packets from ctx->data, covering Ethernet, IPv4, IPv6, and next protocol headers with practical parsing patterns.
When software can't keep up with traffic, the bottleneck isn't always threads or hot paths — sometimes it's the NIC itself. A deep dive into receive queues, RSS, RPS, and RFS and why they matter for high-throughput Linux networking.
The bottleneck in Linux networking is often the per-packet cost, not the bandwidth. A walkthrough of how GRO, GSO, TSO, and LRO reduce that cost by coalescing and segmenting at the right layer.
Both nftables and NeuroWall (eBPF/XDP) blocked the attack — but the cost was not the same. A real benchmark under ~128K pkt/s SYN flood reveals what enforcing the same policy at different points in the Linux packet path actually costs.