So long, and thanks for all the fish: how to escape the Linux networking stack

Cloudflare’s post on 29 October 2025 explains how, to push the Linux networking stack beyond its design, the team built a dedicated egress service called SLATFATF, or “fish”, to proxy IP packets using soft-unicast address space and lease those addresses. The piece details the collision between Linux’s socket subsystem and the Netfilter conntrack module when using per-client addresses, prompting experiments with NAT rewrites and the rejection of new connections when port slices are exhausted.

To avoid burdening the firewall, they also explored approaches such as Netlink-based conntrack management and, more recently, the TCP_REPAIR socket option, along with TCP Fast Open to create “connected” sockets that skip the traditional handshake under certain conditions.

The authors describe how local routing rules and marked packets were used to route traffic back to the fish interface, and how binding sockets in parallel with packet forwarding created tricky edge cases where two connections could appear to share the same 5-tuple. Ultimately, they terminated TCP connections for WARP and moved toward a model that offers greater visibility and simpler observability, while noting the performance impact remains small. according to The Cloudflare Blog