We rewrote our TCP discovery workflow around raw sockets, TPACKET_V3 rings, cBPF filtering, and Go assembly for checksums.
The blog post breaks down the architecture, kernel integrations, and performance lessons from turning an overnight connect()-based scan into a sub-second SYN sweep.