Stevens Knowledge Hub
Protocol education and analysis platform in the W. Richard Stevens tradition: annotated PCAP decode, guided reading, learning paths, protocol playground, multiplayer analysis sessions, legacy hall.
--- title: "Stevens Knowledge Hub" summary: "Protocol education and analysis platform in the W. Richard Stevens tradi…" stack: ["Next.js", "React", "TypeScript", "Node TS API", "Python Scapy / pyshark", "PostgreSQL", "S3", "Docker", "LLM explanations"] relevance: "The book I learned from, rebuilt as software." featured: true section: work ---
SURFACES
PCAP explainer
Upload a capture, get a Stevens-style annotated decode: sequence, window, RTT, retransmit pathology.
Guided annotation reader
Margin notes attached to byte ranges — the printed-page reading experience, live.
Learning paths
Interactive progressions from framing to congestion control.
Protocol playground
Construct packets, mutate fields, watch the stack react.
Multiplayer sessions
Two or more analysts annotating the same capture in real time.
Legacy hall
A quiet section honoring W. Richard Stevens and the books.
The premise
TCP/IP Illustrated taught by showing the bytes. Every claim in the book is backed by a capture printed on the page, and the reader is never asked to accept a description of the protocol in place of the protocol itself.
A printed capture cannot be replayed. You cannot change a flag and watch what breaks, and the capture on the page is never the capture you are debugging at the time. This is that method rebuilt as software that runs.
Decode before explanation
The decode path is deterministic and it comes first. A capture is parsed in Python — Scapy and pyshark — into a normalized per-packet structure: framing, addressing, sequence and acknowledgment state, window, options, and timing relative to the first packet of the flow. Nothing in that path is generated.
The annotation layer sits above it and attaches notes to byte ranges rather than to packets. That is the detail which makes the printed-page reading experience possible: a margin note points at the four bytes it is actually about, the way a figure caption in the book points into the hex dump above it.
Where the model sits
LLM explanations are an interpretive layer over a decode that has already happened. The model receives the parsed structure, never the raw bytes, and its output is rendered as commentary beside the decode rather than in place of it.
The boundary is the point. A wrong explanation is then a wrong sentence next to correct bytes, which a reader can catch. A model inside the decode path would produce plausible packets instead, and a plausible packet is unfalsifiable to the person who came here to learn what a real one looks like.
Storage split
Captures are objects; everything derived from them is relational. Uploaded PCAPs live in S3-compatible object storage, and PostgreSQL holds flows, decoded packet metadata, annotations and session state. The split keeps analytic queries — every flow in the corpus that stalled on a zero window — off the object store.
Open questions
The multiplayer analysis sessions are the least settled surface. Two analysts annotating one capture is straightforward; what is not is deciding whose interpretation is authoritative when they disagree, and whether a session leaves behind a document or a transcript.