0.8 The Go labs: build the network tools yourself

Reading about a protocol teaches you its shape. Writing a program that speaks it shows you the details: the bytes, the timeouts, the error codes, the states. From Part 3 onwards, many chapters end with a "Build it in Go" section: a small, complete program (usually 50–200 lines) that turns the chapter into something you can run, break, and extend.

Why Go

Go's standard library contains a complete network stack API (net, net/netip, crypto/tls, net/http) with no extra dependencies. Its goroutines make "one connection per goroutine" natural. And it's the language much of today's network infrastructure is written in: Kubernetes, Docker, Caddy, Traefik, CoreDNS, Consul, Prometheus, and most Envoy control planes. You don't need to know Go well to start. Each lab explains what's specific to Go, and the Go guide covers the language itself.

Setup (5 minutes)

# Install Go 1.22 or newer (the labs were tested with Go 1.26):
#   macOS:  brew install go        Linux: https://go.dev/doc/install
go version

# One module holds every lab; each lab is a folder with a main.go
mkdir -p ~/netlabs && cd ~/netlabs
go mod init netlabs
mkdir dnsquery            # then save the lab's code as dnsquery/main.go
go run ./dnsquery example.com

Labs marked (Linux) use Linux-only kernel features. On macOS, run them in a container. This works even on Docker Desktop:

docker run --rm -it --cap-add NET_ADMIN -v "$PWD":/labs -w /labs golang:1.26 bash
apt-get update && apt-get install -y iproute2 tcpdump   # ss, tc, tcpdump inside the container

What Go's net package does underneath

Every lab uses a few calls. Knowing what each one asks the kernel to do connects the code to the chapters:

Three Go defaults that matter later: TCP connections have TCP_NODELAY on (Nagle off, Chapter 26), TCP keepalives on (every 15 s), and listeners set SO_REUSEADDR, so a restarted server can rebind its port even while old connections sit in TIME_WAIT (Chapter 23).

To see the system calls any lab makes, build it and trace it:

go build -o /tmp/lab ./dialcheck
strace -f -e trace=network /tmp/lab example.com:443     # Linux

Index of the Go labs in this guide

Larger projects that build on these, such as an L4 load balancer, a TLS reverse proxy, a WAF, and a DDoS-resistant edge proxy, are in the Go 120-day plan, Weeks 5–17. The individual chapters link to them.