SO LONG, AND THANKS FOR ALL THE FISH: HOW TO ESCAPE THE LINUX NETWORKING STACK

Summary from the TLDR Dev newsletter

Cloudflare uses soft-unicast to share IP addresses across machines, pushing the limits of the Linux networking stack. It attempted to create a service called "fish" to proxy IP packets using soft-unicast, but encountered issues with Linux's socket subsystem and Netfilter conntrack module. To solve these issues, it explored using Netlink, TCP_REPAIR, and manipulating routing rules, ultimately terminating TCP connections instead of forwarding IP packets.