"This is some Jane Street sh*t." That was the reaction from a Director of Engineering at a Fortune 500 company. Firewalls that decide on application data, like an HTTP header rather than only an IP address and a port, almost always run that decision in a userspace proxy. The packet gets copied out of the kernel, the TCP stream gets rebuilt, the inspection engine runs, and the result gets copied back down. It works, and it costs milliseconds per request. We thought that layer could be faster and ...