Work
Each project comes with a design document and tests. Where the trade-off matters, the same policy is built in more than one dataplane, so the choice is measured rather than guessed.
01 Fabric
GPU fabric
Designs a rail-optimized, non-blocking two-tier RoCEv2 fabric and turns one JSON spec into cabling, FRR, QoS intent and per-host NCCL setup. Refuses specs that break the design rules. Python, C and Go ports produce byte-identical output.
RDMA security
Parses the InfiniBand transport header and checks transport type, partition key, peer and queue pair. Counts ECN marks and CNPs per sender and queue pair. Built as a kernel module, in XDP and in DPDK.
Collective transport
Design documents for an OCCL-NET collective network plugin and the OCP Multipath Reliable Connection (MRC) API, covering how the transport maps onto RDMA hardware.
02 Datapath
DPU offload
A proactive OpenFlow 1.3/1.4 and gRPC agent for the BlueField eSwitch. It compiles wildcard rules into mlx5 hardware-steering template tables with async commits, rollback and a journal, and gates traffic until every rule is in hardware.
Hardware offload
An offload architecture in which one control path (OpenFlow, OVS, rte_flow) runs on BlueField, Pensando and Intel hardware. Flows the hardware cannot take stay in software instead of being dropped.
NFV on DPU
Places a session border controller’s DPDK media pipeline on DPU-emulated virtio VFs. Classification, NAT hits, IPsec and DoS move to the eSwitch and Arm cores, and media stays in the pod.
03 Workloads
AI workload security
eBPF container security for AI workloads. 22 BPF LSM programs and 4 cgroup socket programs enforce exec, read-only model, secret and egress allowlists, block escapes, and learn policy from audit mode.
Network functions
A stateful firewall, an IPv4 NAT gateway, a SYN filter and a runtime rule manager, each written as a netfilter kernel module, in XDP/TC and in DPDK. Rule updates are atomic, so no packet sees a half-updated rule set.
Edge protection
An XDP ingress firewall with IPv4/IPv6 LPM blocklists, every XDP verdict as a rule action, a per-source SYN-flood guard, and rule reload without detaching.
Also built
Infrastructure services
An authoritative and caching-forwarder DNS server in C11 with only libc. It serves UDP and TCP with EDNS(0), and is tested with unit, fuzz and end-to-end tests under sanitizers.
Rust and DPDK
Safe Rust bindings over DPDK rte_flow that install a hardware rule and read its counters, with RAII teardown of flows.
Applied AI
Answers calls for a home-service business around the clock. It books visits, transfers emergencies to the on-call technician and texts the owner a summary of each call, using speech-to-speech AI.
Bring a workload and a target. In one call, we'll help you work out where the time goes and which layer to fix first.
Book a technical call