FINDING · EVALUATION
Replaying 94 million TCP SYN packets from 6.4 million unique client IPs at ~41,000 packets/second, the Cirripede registration server (quad-core Xeon E5530, 12 GB RAM) achieved a 97% detection rate — 1,038,689 out of 1,069,318 embedded registrations — with average CPU utilization of 56% (max 73%) and average memory of 1.1 GB (max 1.6 GB). The 3% miss rate was caused entirely by network-layer packet reordering, not server capacity.
From 2011-houmansadr-cirripede — Cirripede: Circumvention Infrastructure using Router Redirection with Plausible Deniability · §6.1 · 2011 · Computer and Communications Security
Implications
- ISN-based covert registration is viable at Internet backbone scale on commodity hardware; design the registration state machine to tolerate out-of-order SYN delivery to close the 3% gap.
- Memory growth is proportional to registered-client state, not total traffic volume — set registration TTLs aggressively to bound memory under adversarial re-registration floods.
Tags
Extracted by claude-sonnet-4-6 — review before relying.