PAQET

role: "client"                    # "client" or "server"

log:
  level: "none"                   # none, debug, info, warn, error, fatal

network:
  interface: "eth0"               # Network interface name
  guid: ""                        # Windows NPF GUID (Windows only)
  ipv4:
    addr: "192.168.1.100:0"       # IP:Port (port 0 = random ephemeral)
    router_mac: "aa:bb:cc:dd:ee:ff"
  ipv6:
    addr: "[2001:db8::1]:0"
    router_mac: "aa:bb:cc:dd:ee:ff"
  pcap:
    sockbuf: 4194304              # Ring buffer size (bytes)
  tcp:
    local_flag: ["PA"]            # TCP flags for outgoing packets
    remote_flag: ["PA"]           # TCP flags for incoming packets

listen:                           # Server only
  addr: "0.0.0.0:9999"            # Listen address

server:                           # Client only
  addr: "10.0.0.1:9999"           # Server address

socks5:                           # Client only
  - listen: "127.0.0.1:1080"
    username: ""                  # Optional auth
    password: ""

forward:                          # Client only
  - listen: "127.0.0.1:8080"
    target: "192.168.2.1:80"
    protocol: "tcp"               # "tcp" or "udp"

transport:
  protocol: "kcp"
  conn: 1                         # Parallel KCP connections (1-256)
  tcpbuf: 8192                    # Application TCP buffer (bytes)
  udpbuf: 4096                    # Application UDP buffer (bytes)
  kcp:
    mode: "fast"                  # normal, fast, fast2, fast3, manual
    nodelay: 0                    # Manual mode only
    interval: 30                  # Manual mode only (ms)
    resend: 2                     # Manual mode only
    nocongestion: 1               # Manual mode only
    wdelay: true                  # Manual mode only
    acknodelay: false             # Manual mode only
    mtu: 1350                     # Max transmission unit (50-1500)
    rcvwnd: 512                   # Receive window (1-32768)
    sndwnd: 512                   # Send window (1-32768)
    dshard: 0                     # FEC data shards (0 = disabled)
    pshard: 0                     # FEC parity shards
    block: "aes"                  # Encryption algorithm
    key: "your-secret-key"        # Encryption key
    smuxbuf: 4194304              # SMUX receive buffer (bytes)
    streambuf: 2097152            # Per-stream buffer (bytes)

network:
  interface: "eth0"        # Linux
  # interface: "en0"       # macOS
  # interface: "Ethernet"  # Windows (name only, GUID required)
  guid: "\\Device\\NPF_{...}" # Windows NPF GUID

# Linux/macOS
ip link show                    # or: ifconfig

# Windows
paqet iface                     # Lists interfaces with GUIDs

ipv4:
  addr: "192.168.1.100:0"        # IP:Port
  router_mac: "aa:bb:cc:dd:ee:ff" # Gateway MAC

# Linux
ip neigh show | grep $(ip route | grep default | awk '{print $3}')

# macOS
arp -a $(netstat -rn | grep default | head -1 | awk '{print $2}')

# Windows
arp -a <gateway_ip>

tcp:
  local_flag: ["PA"]    # Flags for client→server packets
  remote_flag: ["PA"]   # Flags for server→client packets

pcap:
  sockbuf: 4194304    # 4MB (client default)
  # sockbuf: 8388608  # 8MB (server default)

kcp:
  mode: "fast"    # normal, fast, fast2, fast3, manual

nodelay: 1    # 0 or 1

interval: 10    # 10-5000 milliseconds

resend: 2    # 0, 1, or 2

nocongestion: 1    # 0 or 1

wdelay: false    # true or false

acknodelay: true    # true or false

mtu: 1350    # 50-1500 bytes

rcvwnd: 512    # 1-32768
sndwnd: 512    # 1-32768

dshard: 0    # Data shards (0 = disabled, default)
pshard: 0    # Parity shards

transport:
  tcpbuf: 8192    # Min: 4096 bytes
  udpbuf: 4096    # Min: 2048 bytes

kcp:
  smuxbuf: 4194304      # 4MB default
  streambuf: 2097152    # 2MB default

Example server (100 connections, 10 streams each):
PCAP: 8MB
SMUX: 4MB × 100 = 400MB
Streams: 2MB × 10 × 100 = 2GB
Total: ~2.4GB

kcp:
  block: "aes"        # Encryption algorithm
  key: "your-key"     # Any length (derived via PBKDF2)

./paqet secret

transport:
  conn: 1    # 1-256 parallel KCP connections

# Socket buffer limits (max values)
sysctl -w net.core.rmem_max=268435456
sysctl -w net.core.wmem_max=268435456

# Socket buffer defaults (IMPORTANT: applications use these!)
sysctl -w net.core.rmem_default=16777216
sysctl -w net.core.wmem_default=16777216

# TCP buffer sizes: min default max
# The middle value is the DEFAULT - must be large enough!
sysctl -w net.ipv4.tcp_rmem="4096 8388608 268435456"
sysctl -w net.ipv4.tcp_wmem="4096 8388608 268435456"

# UDP buffers (critical for KCP)
sysctl -w net.core.netdev_max_backlog=65536

# Connection tracking (if using iptables)
sysctl -w net.netfilter.nf_conntrack_max=1000000

cat >> /etc/sysctl.conf << 'EOF'
net.core.rmem_max=268435456
net.core.wmem_max=268435456
net.core.rmem_default=16777216
net.core.wmem_default=16777216
net.ipv4.tcp_rmem=4096 8388608 268435456
net.ipv4.tcp_wmem=4096 8388608 268435456
net.core.netdev_max_backlog=65536
EOF

sysctl -p

# Enable offloading
ethtool -K eth0 tso on gso on gro on

# Ring buffers
ethtool -G eth0 rx 4096 tx 4096

ulimit -n 65535

# Pin to specific cores
sudo taskset -c 0,1 ./paqet run -c config.yaml

# NUMA binding
sudo numactl --cpunodebind=0 --membind=0 ./paqet run -c config.yaml

#!/bin/bash
PORT=9999

# Bypass connection tracking
iptables -t raw -A PREROUTING -p tcp --dport $PORT -j NOTRACK
iptables -t raw -A OUTPUT -p tcp --sport $PORT -j NOTRACK

# Drop kernel RST packets (kernel sends RST for packets it doesn't recognize)
iptables -t mangle -A OUTPUT -p tcp --sport $PORT --tcp-flags RST RST -j DROP

#!/usr/sbin/nft -f

table inet paqet {
    chain prerouting {
        type filter hook prerouting priority raw; policy accept;
        tcp dport 9999 notrack
    }
    chain output {
        type filter hook output priority mangle; policy accept;
        tcp sport 9999 tcp flags rst drop
    }
}

log:
  level: "none"    # none, debug, info, warn, error, fatal

sudo ./paqet ping -c client.yaml

sudo ./paqet dump -p 9999           # Capture on port
sudo ./paqet dump -i eth0 -p 9999   # Specific interface
sudo ./paqet dump -p 9999 -v        # Verbose

./paqet iface    # Lists interfaces with GUIDs (Windows)

./paqet secret    # Generates secure random key

# Test different sizes until one works
ping -M do -s 1472 <server_ip>   # Test 1500 byte path
ping -M do -s 1372 <server_ip>   # Test 1400 byte path

# Check current socket buffer sizes
ss -tnm | grep -A2 ":443" | head -10

# Look for rbXXXXX (receive buffer) - if it's small (e.g., rb87380 = 87KB), that's the problem
# Should be rb8388608 (8MB) or larger

journalctl -u paqet --since "1 hour ago" | grep -i "buffer"
# If output shows "No buffer space available" → Apply OS tuning

ss -tnm | grep -A2 ":443"
# Should show: rb8388608 or larger

cat /proc/net/snmp | grep Tcp
# RetransSegs should be much smaller than OutSegs

grep -E "snd_wnd|rcv_wnd|data_shard|parity_shard|^nc:" /opt/paqet/config.yaml
# If any match → fix the key names

# Find path MTU
ping -M do -s 1372 <server_ip>  # Test 1400 byte path

# Verify both configs use same MTU
grep "mtu:" /opt/paqet/config.yaml