DutchOven

Application-scoped Windows network brownouts for deterministic red-team validation.

Native C  •  Windows Filtering Platform  •  IPv4 + IPv6  •  Dynamic cleanup

Read the accompanying blog post →

Quick start • Profiles • CLI • How it works • Build • BOF • Validation

[!CAUTION] Controlled environments only. Run DutchOven only on systems you own or are explicitly authorized to assess. It changes live Windows network policy and requires an elevated Administrator token. Review SECURITY.md before use.

What is DutchOven?

DutchOven is a deliberately small Windows red-team primitive that places explicit executable paths behind a deterministic network gate. During each period, matching applications are blocked for a bounded interval and allowed to pass for the remainder.

The result is a repeatable brownout, not a service stop or permanent firewall rule. It creates a controlled way to measure retry logic, buffering, health-state transitions, delayed delivery, and recovery behavior while a process remains alive.

Design choice	Operator value
Application-scoped WFP filters	Limits the experiment to paths supplied by the operator
Timed block/pass duty cycle	Produces measurable degradation instead of only online/offline states
Atomic IPv4 and IPv6 changes	Keeps both address families on the same schedule
Dynamic WFP session	Removes filters and the generated sublayer when the engine session closes
Native C implementation	No Go, .NET, service installation, or custom driver dependency
Explicit targets only	No product enumeration, process guessing, or embedded target database

DutchOven gates new outbound connection authorization. An existing connection that WFP has already authorized is not retroactively terminated; use a fresh canary connection or independently force the target to reconnect when validating an uninterrupted long-lived flow.

Quick start

Open an elevated PowerShell window.

Validate the resolved target and timing without changing WFP:

.\dutchoven.exe --app 'C:\Path\To\Target.exe' --dry-run

Run the default brownout profile:

.\dutchoven.exe --app 'C:\Path\To\Target.exe'

That is the complete minimum invocation. --app is the only required flag. The default profile blocks the target for 1.5 seconds in every 5-second period and exits after one minute.

Use Ctrl+C to stop early. DutchOven removes active filters before closing its WFP session; the dynamic session is the cleanup backstop if the process is interrupted.

Operation profiles

Profiles bake in useful schedules so operators do not need to specify every timing value.

Profile	Block	Pass	Period	Duration	Intended use
light	0.5 s	4.5 s	5 s	60 s	Low-impact retry observation
brownout	1.5 s	3.5 s	5 s	60 s	Balanced default experiment
heavy	3.5 s	1.5 s	5 s	60 s	Queue and recovery-pressure testing
blackout	5 s	0 s	5 s	30 s	Short, bounded full interruption

Select a profile with one optional flag:

.\dutchoven.exe --app 'C:\Path\To\Target.exe' --profile heavy

CLI reference

dutchoven --app <absolute.exe> [--app <absolute.exe> ...] [options]

Flag	Required	Description
--app <absolute.exe>	Yes	Target executable path; repeat for multiprocess applications
--profile <name>	No	light, brownout, heavy, or blackout
--period-ms <ms>	No	Override the complete block/pass period
--block-ms <ms>	No	Override the blocked portion of each period
--duration-ms <ms>	No	Override the bounded total runtime
--warmup-ms <ms>	No	Allow traffic before the first block interval
--dry-run	No	Validate and print configuration without opening WFP
--json	No	Emit configuration and state transitions as JSON Lines
--help	No	Print command help

Print the build version with dutchoven version.

Advanced timing flags override the selected profile regardless of argument order:

.\dutchoven.exe `
  --app 'C:\Path\To\Target.exe' `
  --period-ms 8000 `
  --block-ms 2000 `
  --duration-ms 120000 `
  --warmup-ms 5000

JSON Lines are intended for test harnesses and evidence collection:

.\dutchoven.exe --app 'C:\Path\To\Target.exe' --profile heavy --json

Timing limits are enforced by the parser:

• Period: 100–60000 ms
• Block: 1 ms through the complete period
• Duration: at least one period, at most 900000 ms (15 minutes)
• Warmup: at most 60000 ms
• Targets: at most 16 explicit local executable paths

How it works

explicit executable path
          │
          ▼
   WFP application ID
          │
          ├── ALE_AUTH_CONNECT_V4 ──┐
          └── ALE_AUTH_CONNECT_V6 ──┤── BLOCK / PASS schedule
                                    │
                                    └── dynamic WFP session cleanup

1. DutchOven resolves each supplied executable into a WFP application identity.
2. It opens a non-persistent, dynamic WFP engine session and creates a generated sublayer.
3. At the beginning of a block interval, IPv4 and IPv6 filters are added in one transaction.
4. At the beginning of a pass interval, those filters are removed in one transaction.
5. At completion or normal interruption, DutchOven removes any active filters and closes the engine.

Windows targets are resolved as Unicode and canonicalized to their long path before DutchOven asks WFP for an application identity. This prevents an 8.3 path alias such as ADMINI~1 from silently creating a filter that cannot match the process's long-form image identity.

The console prints state transitions with wall-clock and schedule-relative timestamps:

Targets: 1
  C:\Path\To\Target.exe
Schedule: block=1500ms pass=3500ms period=5000ms duration=60000ms warmup=0ms
Profile: brownout
Mode: brownout
BLOCK cycle=1 filters=2 wall_ms=1786973903811 elapsed_ms=0
PASS cycle=1 wall_ms=1786973908813 elapsed_ms=5000
...
CLEAN filters=0 session=closed cycles=12 wall_ms=1786973963812 elapsed_ms=60000

Build

The default Linux build exercises parsing and dry-run behavior. The live WFP gate requires the native Windows cross-build.

make check
make release

make check runs the portable tests, cross-builds the Windows artifacts, and verifies the BOF import contract. make release produces stripped release artifacts and SHA256SUMS under artifacts/v<version>/.

Primary outputs:

Artifact	Purpose
build/dutchoven	POSIX parser and dry-run binary
build/dutchoven_tests	Core unit tests
build-windows/dutchoven.exe	Native Windows WFP gate
build-windows/dutchoven_tests.exe	Native Windows test binary
build-windows/windows_canary.exe	Routed integration-test canary
bof/dutchoven.x64.o	Versioned x64 Beacon Object File
artifacts/v<version>/	Stripped release EXE, BOF, and checksums

The Windows executable links only against Windows system libraries: fwpuclnt, rpcrt4, and advapi32.

Beacon Object File