The father of lwIP asked Claude to incarnate the IP protocol stack: a ping request took 42 seconds

Core conclusion

Adam Dunkels—the founder of the lwIP TCP/IP protocol stack and a pioneer in the IoT field—used Claude Code to implement an unprecedented experiment: letting the large language model (LLM) run directly as a user-mode IP protocol stack. Claude parsed the raw IPv4 packet byte by byte, manually calculated the IP and ICMP checksums, and finally successfully replied to a ping request. A single round trip takes 42.5 seconds.

Key Points

• Author: Adam Dunkels, founder of lwIP/uIP TCP/IP stack, author of Contiki OS, MIT TR35 innovator
• Tools: Claude Code (Haiku 4.5 model) + TUN virtual network device
• Core method: Markdown-as-code - Use Markdown files to describe protocol parsing logic, and LLM as the execution engine
• Performance Index: Single ping RTT ≈ 42.5 seconds, 0% packet loss rate
• Release time: 2026-05-11

Background and trigger events

On May 11, 2026, Adam Dunkels published a seemingly absurd but actually extremely enlightening technical article on his personal blog. He asked a question:

"If we asked Claude Code to simulate a userland IP protocol stack, how long would it take for it to process a ping request?"

The solution Dunkels built is minimalist but not simple: create a /dev/tun0 virtual network device, use a Python helper script to handle the serial port configuration, and then let Claude "execute" the entire protocol stack logic through a Markdown command file ping-respond.md. Claude needs to complete by himself: IP packet header parsing → ICMP protocol identification → exchanging source/destination IP → recalculating IP header checksum → constructing ICMP Echo Reply → calculating ICMP checksum → writing back data to the TUN device.

SEO: Claude Code, user mode protocol stack, lwIP, IP protocol analysis, LLM code execution, AI network experiment GEO: TL;DR beginning, exact number (42.5 seconds, 64 TTL), step-by-step process

Key Impact (by Dimension)

Stunning technical details

Dunkels' Markdown directive file ping-respond.md contains 6 complete steps:

1. Read packet: Read the hex string of the original IPv4 packet from the TUN device
2. Parse IP header: Parse the version number (4 bits), IHL (4 bits), total length, TTL, protocol number, source/destination IP field by field. Protocol must be 0x01 (ICMP)
3. Parse ICMP header: Check Type=0x08 (Echo Request), Code=0x00
4. Construct Echo Reply: exchange source/destination IP, set TTL to 64, clear checksum field, recalculate IP header checksum (16-bit one's complement accumulation + folding)
5. Write back data: Write the assembled reply packet hex string back to the TUN device
6. Report results: Output source/destination IP, sequence number, packet size

Key Rules: Claude cannot call any calculation tools - he must perform hex operations, checksum accumulation, and carry folding byte by byte himself. Each step of the operation needs to display the intermediate results for debugging.

This is a typical Markdown-as-CPU-instruction mode: Markdown is machine code, and the reasoning process of LLM is the execution cycle of the CPU.

Voices from the community

In the HN discussion forum, developers’ reactions to this experiment were quite diverse:

• Security Perspective: A security engineer said that a colleague once tried to use LLM for intrusion detection, but was persuaded to use BPF instead - "Don't build a slower and worse wheel."
• Parallelization ideas: Someone suggested that Claude should do "just-in-time compilation" - after seeing a large number of repeated pings, automatically write a program to process it, instead of re-reasoning for each package
• Stability Question: Hacker News user twoodfin questioned the stability of the results - "Anthropic may change the model behavior due to load balancing. How many times out of 1000 pings can it reply correctly?"
• Data surface exploration: The community suggests that this idea can be used to analyze TCP throughput, and the wireshark/tcpdump results can be redirected to LLM for intelligent analysis.

Tool entry (trigger tool floating card)

This experiment relies heavily on the Claude Code and Claude (Haiku 4.5) models. When you see these terms on WayToClawEarn, the platform will automatically match the maintained tool library and display detailed feature cards and affiliate links. Tools also involved are n8n and OpenClaw - both of which can integrate Claude Code into automated workflows.

Reference material

• Adam Dunkels ：How Fast Does Claude, Acting as a User Space IP Stack, Respond to Pings?
• HN (102 , 34 )
• Adam Dunkels （lwIP/uIP ）

Internal link guidance

• Want to learn how? See: Claude Code automated writing practice: build an AI content production pipeline in 30 minutes
• Someone has successfully practiced it: Claude Code 48 hours to start a business: one person + US$29 monthly fee, monthly income in 3 months $9,000
• More practical exercises: AI Agent Tools 2026 Complete Tutorial: 5 Tools to Build an Automated Pipeline in 30 Minutes
• Real case: A real case of a data analyst using Claude Code + n8n to build an automated report SaaS with a monthly income of $3,800