25.7 Million Runs at a ClientHello

Sun, 08 Mar 2026 00:00:00 +0000

Most web traffic is TLS now, which for a passive analyzer means most of the interesting bytes are gone. One field survives: the Server Name Indication in the ClientHello. It is sent in cleartext, in every TLS version, before encryption starts, and it answers the question you usually have - what was this connection to?

Getting it out means parsing four levels of nested, attacker-supplied length fields. It is the most structurally complex hand-rolled parser in packeteer, and the one I trusted least.

An OOM in My Own pcapng Reader, Found on the First Fuzz Run

Thu, 22 Jan 2026 00:00:00 +0000

packeteer reads and writes pcapng, so it can open a capture somebody else made. That sentence is the whole threat model: a capture file is untrusted input, and the reader is the code that touches it first.

I had written the reader, tested it, and used it. Then I wired up libFuzzer harnesses for every hand-rolled decoder in the project, plus the pcapng reader and the full summarize_packet() pipeline. The reader harness found a bug on its first run.

Writeups on srdusr

25.7 Million Runs at a ClientHello

An OOM in My Own pcapng Reader, Found on the First Fuzz Run