mhtirogla
Home
Systems
API
Pricing
About
Log in
← Back
Home
›
Systems
›
Networking and edge
stateful-firewall
stateful packet firewall
nftables, pf
System
Techniques · 1
Primitives · 17
stateful-firewall
Packet classification
networking · medium: Multi-field rule matching (tuple space search, decision trees) and flow caches
Bytecode interpreter
compilers · low: Register/stack VM dispatch loop for executing compiled plans or rules (SQLite VDBE, nftables)
RCU (read-copy-update)
concurrency · low: Readers access shared data with no locks or atomic writes; writers publish a new copy and free the old one after a grace period.
›
Connection tracking
networking · low: Per-flow state table (5-tuple, TCP state, timeouts) for stateful packet handling
Ebpf xdp
networking · low: EBPF programs at the XDP/tc hooks for in-kernel packet processing at line rate
Internet checksum
networking · low: Ones-complement IP/TCP/UDP checksum, incremental update (RFC 1624) and offload
Ip fragment reassembly
networking · low: Reassemble IP fragments with timeouts and overlap/DoS protection
Longest prefix match
networking · low: IP prefix lookup structures (DIR-24-8, Poptrie, LC-trie) for routes, ACLs and geo-IP
Network address translation
networking · low: NAT mapping tables, endpoint-independent mapping/filtering, hairpinning and port allocation
Syn cookies
networking · low: Stateless SYN handling that encodes connection state in the initial sequence number
Hierarchical timing wheel
systems · low: Timers bucketed by expiry into wheels of slots, coarser wheels for far deadlines: O(1) insert and cancel for millions of timeouts.
›
Interval tree
data-structures · low: Index of ranges that answers "which intervals overlap this point or range?" in O(log n + k); static sorted-array form is the compact, cache-friendly choice.
›
Swiss table
data-structures · low: Open-addressing hash table that filters 8-16 slots at once with 1-byte hash tags and SIMD, giving fast lookups at 87.5 % load.
›
Packet header parsing
networking · low: Parse graph state machines for Ethernet, IP, TCP and UDP headers in hardware and software
Tcam ternary matching
networking · low: TCAM ternary match tables: priorities, range expansion, power and capacity trade-offs
LRU and CLOCK
systems · low: LRU evicts the least recently used entry via hash map plus linked list; CLOCK approximates it with a reference bit, so hits take no lock.
›
Memory ordering
concurrency · low: What Relaxed, Acquire, Release and SeqCst atomics actually guarantee, what they cost on x86 and ARM, and which one each pattern needs.
›
+ 1 more primitives
System
Techniques · 1
Primitives · 17
stateful-firewall
Packet classification
networking · medium: Multi-field rule matching (tuple space search, decision trees) and flow caches
Bytecode interpreter
compilers · low: Register/stack VM dispatch loop for executing compiled plans or rules (SQLite VDBE, nftables)
RCU (read-copy-update)
concurrency · low: Readers access shared data with no locks or atomic writes; writers publish a new copy and free the old one after a grace period.
›
Connection tracking
networking · low: Per-flow state table (5-tuple, TCP state, timeouts) for stateful packet handling
Ebpf xdp
networking · low: EBPF programs at the XDP/tc hooks for in-kernel packet processing at line rate
Internet checksum
networking · low: Ones-complement IP/TCP/UDP checksum, incremental update (RFC 1624) and offload
Ip fragment reassembly
networking · low: Reassemble IP fragments with timeouts and overlap/DoS protection
Longest prefix match
networking · low: IP prefix lookup structures (DIR-24-8, Poptrie, LC-trie) for routes, ACLs and geo-IP
Network address translation
networking · low: NAT mapping tables, endpoint-independent mapping/filtering, hairpinning and port allocation
Syn cookies
networking · low: Stateless SYN handling that encodes connection state in the initial sequence number
Hierarchical timing wheel
systems · low: Timers bucketed by expiry into wheels of slots, coarser wheels for far deadlines: O(1) insert and cancel for millions of timeouts.
›
Interval tree
data-structures · low: Index of ranges that answers "which intervals overlap this point or range?" in O(log n + k); static sorted-array form is the compact, cache-friendly choice.
›
Swiss table
data-structures · low: Open-addressing hash table that filters 8-16 slots at once with 1-byte hash tags and SIMD, giving fast lookups at 87.5 % load.
›
Packet header parsing
networking · low: Parse graph state machines for Ethernet, IP, TCP and UDP headers in hardware and software
Tcam ternary matching
networking · low: TCAM ternary match tables: priorities, range expansion, power and capacity trade-offs
LRU and CLOCK
systems · low: LRU evicts the least recently used entry via hash map plus linked list; CLOCK approximates it with a reference bit, so hits take no lock.
›
Memory ordering
concurrency · low: What Relaxed, Acquire, Release and SeqCst atomics actually guarantee, what they cost on x86 and ARM, and which one each pattern needs.
›
Slab allocator
systems · low: Pre-carve pages into equal-size slots per size class with an in-place free list: O(1) alloc and free, no external fragmentation, cache-warm reuse.
›
Copy for AI
Similar systems
Share the most building blocks with this one.
nat-gateway
24 %
sdn
22 %
l4-load-balancer
20 %
ngfw
20 %
packet-processor
17 %