Network Layer Confusion

The talk opens with the observation that network layers are easy for application engineers to forget, and that many surprises sit at the boundaries between them. It climbs from the physical medium through Ethernet framing, MAC learning on switches, and ARP, showing that addresses are not reliable identities and that switches and ARP responders accept whatever they are told.

The middle section covers IP routing. Routing amounts to handing a packet to a neighbouring device by its MAC address, so a host can be made to carry traffic meant for another machine. The speaker demonstrates a layer 2 chat that never touches layer 3, and notes that some VPNs leave traffic to link-local routes unencrypted, which an attacker can exploit. The focus then shifts to HTTP request smuggling, where a front-end proxy and a back-end server disagree about where one request ends, letting a request reach an internal system that the front end would block. The example used is a patched build of Varnish.

The closing advice is to assume that anything sent on a local network can be observed, and to enable managed-switch protections such as DHCP snooping and ARP inspection. Requests that pass through a supposedly trusted intermediary should still be treated as untrusted input. The speaker argues that framing confusion is a recurring class of bug, and that newer protocols such as HTTP/2 and QUIC change its shape rather than remove it.