Skip to content

Build a TCP/IP Stack

Build a userspace TCP/IP stack on top of a TUN device: parse IP and UDP headers, implement TCP's three-way handshake, sliding window, retransmission, congestion control, and connection state machine. Same architecture as gVisor, lwIP, slirp4netns.

advanced14 lessons4 chapters14 graded exercisesPython
Start course — it’s freeWork in your own editor

No sign-up needed for lesson 1 · certificate on completion · sign up to save progress

What you’ll have built

Chapter by chapter. Every step is a graded exercise.

  • Frames & IP
  • UDP & TCP Basics
  • Reliability & Flow Control
  • Production Concerns
Starts in Python — solve in the language you choose in the editor, same tests either way.

Curriculum

4 chapters, 14 lessons. Each lesson is a short read, one graded exercise, and a quiz.

  1. 1The Layered Network ModelRead · exercise · quiz
  2. 2IPv4 HeadersRead · exercise · quiz
  3. 3TUN/TAP DevicesRead · exercise · quiz
  4. 4ARP — Address Resolution ProtocolRead · exercise · quiz
  5. 5ICMP Echo — PingRead · exercise · quiz
Loading reference solution…
Going further

When the tests are green, keep going.

Read

  • TCP/IP Illustrated, Volume 1 (W. Richard Stevens) — the book on the protocol.
  • TCP/IP Illustrated, Volume 2 (Wright + Stevens) — the BSD kernel implementation, line-by-line. Use this if you want to know what real silicon does.
  • The Linux kernel's net/ipv4/tcp.c — modern, optimized, but readable.
  • RFC 9293 (the modern TCP spec, supersedes RFC 793).

Build next

  • Real packet path: open a TUN device, parse IPv4 + TCP headers, plug them into the state machine you wrote.
  • Karn/Jacobson RTT: smoothed RTT + RTTVAR estimator, dynamic RTO.
  • SACK (selective acknowledgement, RFC 2018): fast recovery from packet loss without retransmitting everything after a hole.
  • Congestion control: TCP Reno, then CUBIC, then BBR. Each is its own paper.
  • TLS 1.3 on top — see Build TLS 1.3 in our catalog.

Continue with our courses

  • Build TLS 1.3 — TCP gives you a reliable byte stream; TLS turns it into a private one.
  • Build a VPN Tunnel — your TCP/IP stack inside a userspace VPN endpoint, like Tailscale's userspace mode.