kcp-go is a production-grade, high-performance reliable UDP library for Go, implementing the KCP (KCP Protocol) ARQ protocol. It provides a stream-based interface (net.Conn) over UDP with low latency, high throughput, and packet-level control. The library is widely used in gaming, streaming, and network acceleration (e.g., kcptun). Architecturally, it is layered: an application layer using net.Conn, a session layer (sess.go) managing encryption, FEC, and connection lifecycle, a pure protocol state machine (kcp.go) handling ARQ, retransmission, and congestion control, and a transport layer using raw UDP sockets. The data pipeline for outgoing packets is: App Write -> KCP Send -> KCP flush -> FEC Encode -> Encrypt -> UDP Socket. Incoming: UDP Socket -> Decrypt -> FEC Decode -> KCP Input -> App Read. Key features include: reliable ARQ with fast retransmit, Forward Error Correction (FEC) using Reed-Solomon codes, packet-level encryption (AES, TEA, Salsa20, etc., plus AEAD support), platform-specific optimizations (sendmmsg/recvmmsg on Linux), a global timer scheduler to avoid per-session goroutines, and a buffer pool to minimize GC pressure. The codebase demonstrates exceptional craftsmanship with hand-optimized CFB encryption (8x loop unrolling), a generic ring buffer with dynamic resizing, and an auto-tuning FEC decoder that adapts to peer parameters.
Flannel is a layer 3 network fabric designed for Kubernetes that provides overlay networking between hosts. It runs a flanneld agent on each node to allocate subnet leases from a preconfigured address space using either Kubernetes API or etcd for storage. Traffic is forwarded via pluggable backend mechanisms including VXLAN, UDP, IPsec, host-gw, WireGuard, and cloud-specific integrations like Tencent VPC. The architecture separates concerns into backend management, subnet allocation, traffic management (iptables/nftables), and routing, with a plugin system enabling extensibility. Key entry points include the main daemon (main.go), backend registration system, subnet watchers, and traffic manager interfaces. The system handles IP address allocation, encapsulation, decapsulation, and traffic masquerading to enable pod-to-pod communication across nodes in a cluster.
nDPI is a production-grade open-source deep packet inspection (DPI) library written in C, developed primarily by ntop.org. It identifies hundreds of network protocols by inspecting packet payloads using static signatures, heuristics, state machines, and machine learning classifiers. The library extracts rich metadata (TLS fingerprints, DNS queries, HTTP headers, etc.), computes flow risks (malware, DGA, obfuscation, anomalies), and supports output serialization in JSON, CSV, or TLV formats. It is designed to be embedded into network monitoring applications such as ntopng, nProbe, and Wireshark (via a Lua extcap plugin), and also ships as a standalone CLI tool (ndpiReader) and Python bindings. The codebase is well-structured with a modular dissector pattern, extensive fuzzing infrastructure, and a comprehensive test suite. While the primary focus is on library reuse, it also contains research-grade components like DGA detection models (scikit-learn/TensorFlow) and time-series anomaly detection, giving it a hybrid character leaning heavily toward a software library.
iPXE is an open-source network boot firmware that provides a full PXE implementation with enhanced capabilities. It operates as a pre-boot environment, replacing or supplementing traditional BIOS/UEFI PXE ROMs. The firmware supports booting over HTTP/HTTPS, iSCSI, Fibre Channel over Ethernet (FCoE), AoE, InfiniBand, and wireless networks, with full TLS 1.2 support including modern cipher suites (ECDHE, GCM, X25519, P-256/P-384). It includes a built-in command-line shell, scripting engine, interactive menus, and extensive hardware drivers for network cards, USB controllers, and storage devices across x86, ARM, RISC-V, LoongArch, and s390x architectures. The architecture is modular and table-driven: drivers, protocols, commands, and startup functions are registered via compile-time tables (e.g., `__pci_driver`, `__net_protocol`, `__command`), enabling a highly configurable build. The core uses an interface/refcount pattern for object-oriented-like composition, with reference-counted objects and asynchronous data transfer via `struct interface`. The codebase is well-structured with clear separation between architecture-specific code (under `src/arch/`), platform interfaces (EFI, BIOS, Linux userspace, SBI), and generic core logic. A comprehensive test suite (over 50 unit tests plus Wycheproof vectors) validates cryptographic primitives, network protocols, and data structures. Key entry points include `src/core/main.c` (generic boot flow), EFI application entry (`efiprefix.c`), BIOS PXE ROM entry, and Linux userspace binary. The firmware is typically embedded into option ROMs, UEFI drivers, or bootable images. External dependencies are minimal—the firmware runs directly on hardware or under a hypervisor, relying only on platform firmware services (UEFI, BIOS, SBI) for low-level operations.
Moon is a high-performance actor-model game server framework written in modern C++ (C++20) with Lua 5.4/5.5 as its embedded scripting engine. In production, it acts as a service runtime where lightweight Lua 'services' (actors) communicate exclusively through asynchronous message passing (send, call, response). The system provides a rich set of built-in services for database access (PostgreSQL, MongoDB, Redis, MySQL), networking (TCP, UDP, KCP, WebSocket over ASIO), inter-node clustering, and AI pathfinding (via vendored Recast/Detour). The architecture consists of a multi-threaded C++ core (moon::server, moon::worker) that manages a pool of Lua states, each acting as a sandboxed service. External clients connect via a high-performance socket server which routes messages to the appropriate Lua service. Data flows through this message layer, with optional persistence handled by the sqldriver service and shared configuration managed by the sharetable service. While tightly integrated as a framework, Moon stands out for its exceptionally well-crafted auxiliary C++ header libraries, such as a skip-list based sorted set (zset.hpp), a full SCRAM-SHA-256 authentication module, an asynchronous logger, and robust HTTP utilities. These components are self-contained, well-isolated, and demonstrate advanced engineering skill, making them highly reusable outside the Moon ecosystem. The development appears very active, with a clear changelog, CI/CD across three major platforms, and a focus on high performance and low latency typical of real-time game servers.
Rats Search is a decentralized BitTorrent search engine implemented as a Qt6/C++ desktop application with a headless server mode. It crawls the BitTorrent DHT network to discover torrent metadata, indexes it using Manticore Search (a Sphinx-compatible full-text database), and provides a full-featured GUI for searching, downloading, and managing torrents. The application also includes a P2P replication layer for synchronizing databases between peers, a REST/WebSocket API for remote control, and support for torrent creation, seeding, and metadata export. The codebase is well-layered (domain, data, services, net, ui, rest) with clear separation of concerns, extensive unit and integration tests (15+ test files), and a professional CMake build system with CI for Windows, macOS, and Linux. A legacy Electron/Node.js version (v1.x) is preserved in the `legacy/` directory but is not actively developed. The project demonstrates high craftsmanship in its data layer (hash-based row IDs, safe SphinxQL query builders, resumable database dumps) and service architecture (cancel tokens, progress reporting, event-driven updates via Qt signals). However, the main window (`mainwindow.cpp`) exceeds 2400 lines, and the presence of the legacy codebase adds maintenance overhead.
Whois is a Go library and command-line tool for performing WHOIS queries on domain names, IP addresses (IPv4 and IPv6), and ASNs. The library handles the complexity of WHOIS referral chains, server-specific quirks (such as those for ARIN and GoDaddy), and provides configurable options for timeout, dialer (for proxy support), and referral control. The CLI tool provides a user-friendly interface for querying WHOIS information and optionally outputting parsed JSON results using the whois-parser package. The project is actively maintained with regular commits, CI/CD workflows, and versioned releases.
ascii-chat is a production-grade terminal-based video conferencing application that converts live video and audio streams into real-time ASCII art rendered in the terminal. It operates in multiple modes: server (multi-client host), client (connect to server), mirror (local preview), discovery (peer-to-peer session participant), and discovery-service (session registry and NAT traversal relay). The system uses a custom binary protocol (ACIP) over TCP/WebSocket/WebRTC, with end-to-end encryption (Ed25519 + X25519 + XSalsa20-Poly1305) and support for SSH/GPG key authentication. A companion web client compiled via WebAssembly mirrors functionality in the browser. The codebase includes a standalone reusable C library (libasciichat) with a comprehensive platform abstraction layer (POSIX/Windows/WASM), a declarative options registry that auto-generates man pages and shell completions, SIMD-accelerated ASCII rendering (AVX2, NEON, SVE, SSE2), lock-free data structures, and a sophisticated logging system with crash-safe mmap output. The architecture is modular and cross-platform, with extensive unit, integration, and E2E test coverage across Linux, macOS, Windows, and WebAssembly targets.
zrok is a production-grade, self-hostable secure resource sharing platform built on OpenZiti overlay networking. It enables users to share web services, files, TCP/UDP tunnels, and VPN connections through firewalls and NAT without requiring inbound connectivity. The system supports both public and private sharing modes, OAuth authentication (GitHub, Google, OIDC), and includes a full REST API (v2), a CLI tool (`zrok2`), a React web console, a background agent daemon with gRPC remote control, and SDKs in Go, Python, and Node.js. Architecturally, zrok follows a controller-agent pattern. The controller is a Go REST server that manages accounts, environments, shares, accesses, frontends, namespaces, organizations, and bandwidth limits. It uses SQLite3 or PostgreSQL for persistence with versioned migrations, and integrates with InfluxDB for usage metrics and RabbitMQ (AMQP) for dynamic proxy mapping updates. The agent runs as a background process on the user's machine, managing child processes for each share/access and exposing a gRPC API for remote management. Frontend proxies (public, dynamic, socks, Caddy) handle incoming traffic with OAuth, basic auth, and interstitial pages. Key entry points include the CLI commands under `cmd/zrok2/` (e.g., `share`, `access`, `enable`, `admin`), the controller REST handlers in `controller/`, the agent gRPC service in `agent/agentGrpc/`, and the SDK packages in `sdk/golang/sdk`, `sdk/python/src/zrok2`, and `sdk/nodejs/sdk`. The system also includes a canary testing framework for continuous health validation and a comprehensive metrics/limits engine for bandwidth enforcement. External dependencies include OpenZiti (overlay network), InfluxDB (metrics), RabbitMQ (messaging), Caddy (optional web server), and various OAuth providers. The project is actively maintained with frequent commits, automated CI/CD, and multi-platform release pipelines (Linux, macOS, Windows, Docker).
Stats is a native macOS menu bar system monitor that provides real-time hardware and software metrics for CPU, GPU, RAM, Disk, Network, Battery, Sensors (temperature/voltage/fan), Bluetooth, and Clock. Built entirely in Swift with AppKit, it uses private IOKit, SMC, and IOReport APIs to collect system data, and offers highly customizable widgets (mini, line/bar/pie charts, tachometer, text, etc.) drawn directly in the menu bar. The architecture is modular: each monitored subsystem lives in its own 'Module' directory with a consistent structure (main.swift, readers, popup, settings, notifications, portal). A shared 'Kit' framework provides reusable components including a reader base class with interval management and history persistence via bundled LevelDB, a thread-safe key-value store wrapper, and a set of custom drawing chart widgets. The app also supports remote monitoring via an optional cloud service (System Stats), privileged helper for fan control, macOS widget extensions, and extensive localization (40+ languages). The codebase demonstrates strong engineering practices with clean abstractions, encapsulation, and reusability, though some modules exhibit boilerplate duplication and the project relies on several deprecated or private APIs that may require updates for future macOS releases.
This repository provides a collection of shell scripts to automate the setup and management of an IPsec VPN server on Linux. It supports multiple VPN protocols (IPsec/L2TP, IPsec/XAuth, IKEv2) and a wide range of Linux distributions including Ubuntu, Debian, CentOS, Rocky Linux, AlmaLinux, Oracle Linux, and Alpine Linux. The main entry point is `vpnsetup.sh`, which detects the OS and runs the appropriate installer. The project also includes helper scripts for user management, IKEv2 certificate handling, upgrades, and uninstallation. Additionally, it offers an Azure ARM template for cloud deployment. The code is well-structured with OS-specific installers, common bash utility functions, and extensive documentation in multiple languages. It is a mature, widely-used DevOps tool for system administrators.
Kubenurse is a Kubernetes DaemonSet that monitors network connectivity within a cluster by performing periodic checks on API server access (direct and DNS), service/ingress reachability, and inter-node communication. It exports detailed Prometheus metrics including request duration histograms, error counters, and a neighbourhood incoming checks gauge. The architecture uses a controller-runtime client for Kubernetes API discovery, implements an efficient O(N) neighbourhood filtering algorithm based on SHA256 hashing to avoid quadratic scaling, and leverages Go's httptrace package for granular connection metrics. The application features graceful shutdown, TLS support, readiness probes that respect node schedulability, and extensive configuration via environment variables or Helm values.
nettrace is a Linux network diagnostic tool based on eBPF that traces network packet lifecycle, performs fault diagnosis, and monitors network abnormalities. The architecture centers around a main CLI application (nettrace.c) that loads and attaches eBPF programs (primarily in src/progs/kprobe.c) to kernel functions and tracepoints. As packets traverse the network stack, eBPF programs capture event data sent to user space via perf buffers, where it's processed by analysis.c for diagnostic rule matching and formatted by output.c for display. Key features include basic packet tracing, diagnostic mode with automated problem identification, drop monitoring, socket tracking, and latency/RTT analysis. The tool relies on external dependencies like libbpf, libelf, and bpftool for eBPF program loading and compilation.
Deskflow is a free and open-source keyboard and mouse sharing utility (software KVM without video) that allows one computer's keyboard, mouse, and trackpad to control multiple computers over a network. It uses a client-server architecture with a core process handling input forwarding and network protocol, a daemon for Windows service/UAC support, and a Qt-based GUI for configuration. The system supports TLS encryption, clipboard sharing, and multiple platforms including Windows, macOS, Linux (X11 and Wayland). It implements a custom binary protocol with version negotiation (1.0-1.8) and provides platform-specific backends for input capture and injection. The codebase is well-structured with clean abstractions, extensive unit tests, and CI/CD pipelines, though it carries some legacy code from its Synergy/Barrier origins.
Xray-core is a production-grade network proxy framework written in Go. It implements a wide range of proxy protocols (VMess, VLESS, Shadowsocks, Trojan, Hysteria, WireGuard, SOCKS, HTTP) and transport layers (TCP, WebSocket, gRPC, KCP, SplitHTTP, HTTPUpgrade, QUIC) with advanced obfuscation techniques (Noise, Sudoku, XMC, Realm) for censorship circumvention. The architecture is modular, with pluggable inbound/outbound handlers, a rule-based router with domain/IP/port/protocol matching, a DNS subsystem supporting multiple upstreams (DoH, DoQ, TCP, UDP, FakeDNS), and an observatory for health-based load balancing. Configuration is via JSON/protobuf, and runtime management is exposed through gRPC APIs. The codebase is extensive, well-tested (unit and integration scenarios), and leverages Go's concurrency primitives heavily for performance. However, it includes experimental transports and deprecated features (e.g., legacy Shadowsocks, xtls security), indicating ongoing evolution and some technical drift in the ecosystem.
Sniffnet is a cross-platform desktop GUI application for real-time network traffic monitoring and analysis, written in Rust using the Iced framework. It captures packets via pcap (live or from PCAP files) and also supports IPFIX flow collection over UDP. The application parses Ethernet, IP, TCP/UDP, ICMP, IGMP, ARP, and VLAN headers using a dedicated packet-parser library. It enriches captured traffic with geolocation (MaxMind GeoLite2 and IPinfo MMDB databases), ASN lookups, service identification (from a port-to-service map derived from nmap-services), and local process identification (via the listeners crate). The GUI provides multiple pages: an overview with live traffic charts and donut charts, an inspect page with a filterable and sortable connection table, a notifications page for alerts (thresholds, favorites, IP blacklists), and settings pages for themes, filters, and export. The application supports 25 languages, custom themes, and thumbnail mode for minimal monitoring. It is packaged for Linux (deb, rpm, AppImage), macOS (dmg), and Windows (msi), with CI/CD pipelines for cross-compilation and code signing.
Lan Mouse is a cross-platform software KVM switch that enables sharing a single mouse and keyboard across multiple computers on a local network, inspired by Apple's Universal Control. It is implemented as a Rust daemon with a GTK4/Libadwaita GUI frontend and a CLI interface, supporting Linux (Wayland, X11), macOS, and Windows. Communication between peers uses DTLS/TLS encryption with self-signed certificate fingerprint authentication over UDP/TCP. Input capture and emulation are abstracted via traits with platform-specific backends (libei, layer-shell, X11, CoreGraphics, Windows input APIs), and client discovery relies on mDNS/DNS. The architecture features a central service orchestrator managing capture, emulation, state, and IPC with the frontend over Unix sockets (or TCP on Windows). The codebase demonstrates solid Rust practices, async patterns with Tokio, and clean trait design for platform abstraction. While functionally complete, there are known caveats around compositor support, scancode mappings, and some memory leaks, reflecting ongoing development effort.
Firezone is a zero-trust network access platform providing secure remote access through VPN-like tunnels. The production system consists of a cloud-based management portal (Elixir/Phoenix), data-plane components (Rust gateways and relays), and native clients for macOS/iOS, Android, Windows, and Linux. The portal manages multi-tenant accounts, identity (OIDC, SAML, email OTP, X.509), access policies, device posture, and logs. It exposes a REST API (PortalAPI) for CRUD operations and WebSocket channels for real-time client/gateway connectivity. The Rust core (connlib) handles ICE/STUN/TURN connectivity, WireGuard tunnels, and eBPF-accelerated packet routing. PostgreSQL is used for persistence with logical replication for change data capture, Oban for background job processing, and Redis for caching/presence. External dependencies include identity providers (Entra, Okta, Google Workspace), device management systems (Intune, Defender, SentinelOne, etc.), log sinks (Splunk, Datadog, Elastic, S3), and billing (Stripe). The architecture separates the web admin interface (PortalWeb), REST API (PortalAPI), and internal ops (PortalOps) into distinct endpoints. Data-plane components (gateway, relay) communicate via WebSockets with the API to receive policy updates. Clients connect to relays using ICE/STUN/TURN. The system uses Phoenix PubSub for real-time updates and Postgres logical replication to propagate changes to connected clients and gateways. Key entry points: PortalWeb.Endpoint (admin UI), PortalAPI.Endpoint (REST/WebSocket for clients and gateways), PortalOps.Endpoint (ops dashboard). Rust binaries: firezone-gateway, firezone-relay, firezone-headless-client, firezone-gui-client. Mobile apps: Firezone iOS/macOS (Swift), Firezone Android (Kotlin).
Netis Cloud Probe is a production-grade network packet capture and forwarding system designed to monitor traffic without requiring dedicated TAP or SPAN hardware. It consists of a high-performance C capture engine (cpworker), a Go daemon (cpdaemon) that manages worker processes and communicates with a central policy manager (CPM), and a Go CLI (cpctl) for manual control. The system supports multiple capture sources (libpcap, DPDK, pcap files) and output sinks (GRE, VXLAN, ZMQ, rotating files) with a configurable execution model (real-time or pipelined using a lock-free SPSC ring buffer). Configuration reload is handled via a state-machine protocol, enabling hot-swapping of tasks without packet loss. The codebase is multi-language (C, Go) with CMake and Mage build systems, comprehensive unit and integration tests, and bilingual documentation (English, Chinese). It is actively maintained with a recent commit and continuous integration.
Proxelar is a high-performance, scriptable local traffic workbench for HTTP, HTTPS, and WebSocket debugging. It functions as a man-in-the-middle (MITM) proxy that can capture, inspect, intercept, modify, replay, and export traffic across multiple protocols (HTTP/1.1, HTTP/2, HTTP/3, WebSocket, SOCKS5, DNS, UDP, and WireGuard). The system is built as a Rust workspace with four crates: `proxelar-cli` (binary with TUI, terminal, and web GUI interfaces), `proxyapi` (core proxy engine with TLS interception, Lua scripting, addon system, route rules, and session export/import), `proxelar-proto` (transport-neutral HTTP core with sans-I/O parsers for HTTP/1 and HTTP/2), and `proxyapi_models` (shared data types for headers, sessions, and captured exchanges). It supports forward and reverse proxy modes, declarative JSON routing rules, Lua addons with SHA-256 verification, and exports to HAR, curl, and raw formats. The architecture is modular with clean dependency direction, extensive integration tests, performance benchmarks, and property-based testing. It is a production-quality developer tool comparable to mitmproxy or Charles Proxy, with a focus on performance, correctness, and extensibility.