Adam Dunkels has demonstrated that Claude Code, Anthropic's coding assistant, can function as a user-space IP stack, responding to ICMP echo requests (pings) with a round-trip time of approximately 45 seconds. The experiment uses a custom prompt (ping-respond.md) that instructs Claude to read raw IPv4 packets from a TUN device, parse them byte by byte, construct a valid ICMP echo reply, and write it back—all without external libraries or scripts.
How it works
The setup involves a TUN device (/dev/tun0) and a thin Python helper that handles terminal settings. The prompt defines a six-step process:
- Read a packet: Claude reads a hex-encoded packet from the TUN device via a FIFO command.
- Parse the IPv4 header: It extracts fields including version, IHL, total length, protocol (must be 0x01 for ICMP), source and destination IPs.
- Parse the ICMP header: It checks for type 0x08 (echo request) and code 0x00.
- Construct the echo reply: Claude swaps source and destination IPs, sets TTL to 64, recomputes the IP header checksum, changes the ICMP type to 0x00 (echo reply), and recomputes the ICMP checksum. All arithmetic is done manually in the model's reasoning—no Python,
bc, or calculator tools. - Write the reply: The assembled hex packet is written back to the TUN device.
- Report: Claude prints a summary of the transaction.
Performance
Using Claude Haiku 4.5, the round-trip time for a single ping was 42,593 ms (about 42.6 seconds). This is far slower than a kernel-level IP stack (microseconds) but demonstrates that an LLM can correctly implement network protocol logic end-to-end. The author notes that Haiku 4.5 is a fast model, implying slower models would yield even longer response times.
Tradeoffs
- Latency: 45 seconds per packet makes this impractical for real networking. The model must parse, compute checksums, and generate output for each packet.
- Token cost: Each ping response consumes a large number of tokens for reasoning and output.
- Correctness: The prompt enforces strict validation—Claude must reject malformed packets or non-ICMP traffic. The demonstration shows correct checksum computation and packet assembly.
- Single-packet only: The prompt processes one packet per invocation. Continuous operation would require repeated invocations.
When to use it
This is not a production networking solution. It is a proof-of-concept showing that LLMs can perform low-level protocol processing when given precise instructions. Potential applications include:
- Testing LLM reasoning on structured binary data
- Educational demonstrations of network protocol mechanics
- Exploring LLM capabilities in systems programming tasks
Bottom line
Claude Code can act as a user-space IP stack, correctly parsing IPv4 and ICMP headers and generating valid replies, but with a 45-second latency per packet. The experiment highlights both the potential and the severe performance limitations of using LLMs for real-time systems tasks.