Woven Information Packets Overview

• Woven Information Packets are a family of techniques that interleave multiple logical data units or subspaces while preserving recovery properties.
• They manifest in diverse applications such as NDN Interest bundling, covert traffic embedding, and mathematical frameworks in Hilbert spaces.
• Tiny Packet Programs demonstrate in-band execution of embedded instructions for low-latency state collection and efficient network operations.

Searching arXiv for the topic and cited papers to ground the article in current records. “Woven Information Packets” is not a single standardized construct but a family of technically distinct ideas that share a common structural motif: multiple logical units are interleaved into a larger carrier and later recovered, or multiple structured families are mixed while preserving recoverability. In the cited literature, the expression is used for link-layer Interest bundling in Named Data Networking, covert embedding of secret traffic inside visible traffic, a Hilbert-space generalization of woven frames via information packets, and an interpretation of packet-carried tiny programs that stitch dataplane state across hops (Rahman et al., 2021, Shahini et al., 9 Nov 2025, Christensen et al., 9 Sep 2025, Jeyakumar et al., 2014).

1. Terminological scope

In networking, “weaving” denotes sender-side composition and receiver-side recovery. In BLEnD, multiple sequential Interests are encoded into one transmission unit at the sender’s link adaptation layer and decoded back into individual Interests at the receiver. In CYPRESS, fragments of a secret packet are embedded into legitimate packets generated by visible users, rather than transmitted as new packets. In the Tiny Packet Programs interpretation, packets carry tiny straight-line programs that read or conditionally modify switch state and return per-hop results to end-hosts. In harmonic analysis, the term is formalized differently: information packets are families of subspaces admitting unconditional decompositions, and weaving requires that every admissible mixture remains an information packet (Rahman et al., 2021, Shahini et al., 9 Nov 2025, Christensen et al., 9 Sep 2025, Jeyakumar et al., 2014).

Setting	What is woven	Preserved property
BLEnD for NDN over wireless	Multiple Interests into one bundle Interest frame	One-Interest–one-Data semantics
CYPRESS covert channels	Secret packet segments into regular packets	No new packets for secret traffic
Hilbert-space theory	Mixed collections of subspaces	Unconditional decomposition; in examples, frame bounds
Tiny Packet Programs	Tiny programs and per-hop state into packets	Line-rate forwarding with bounded instruction budget

This suggests that the phrase functions less as a single term of art than as a reusable metaphor for controlled interleaving under recovery constraints. The precise meaning therefore depends on the surrounding domain: NDN link adaptation, covert storage channels, frame theory, or dataplane programmability.

2. Link-layer weaving in Named Data Networking

BLEnD introduces Interest bundling for NDN over half-duplex wireless links, motivated by the asymmetry between small Interest packets and large Data packets. On IEEE 802.11 links, small signaling frames and large data frames incur comparable contention and medium-access overheads, so frequent Interest transmissions consume airtime that could otherwise serve Data. The paper models channel occupancy as

$$C_{\mathrm{no\,bundle}} = N_I \cdot c_I + N_D \cdot c_D,$$

with $N_I \approx N_D$ under one-Interest–one-Data semantics. BLEnD reduces the number of Interest transmissions by bundling multiple Interests at the link while leaving upper-layer NDN behavior unchanged (Rahman et al., 2021).

The implementation is confined to the NFD face subsystem’s GenericLinkService. The sender-side link adaptation layer bundles several sequential Interests into a single “bundle” Interest frame, while the receiver-side link adaptation layer unbundles that frame into the original sequence before passing them to the local forwarder. Application, transport, NFD, PIT/FIB, caching, and security therefore continue to see ordinary Interests and ordinary Data. This locality of modification is central to the design: preserving one-Interest–one-Data semantics without changing the forwarding plane or packet-processing logic above the link adaptation layer.

BLEnD uses a 64-bit BundleTag (bTAG) TLV. At transport, the upper 32 bits carry a boolean RTx flag and the lower 32 bits carry the current congestion window $\mathrm{cwnd}$. At the sender’s link layer, the same bTAG is rewritten so that field1 stores the bundle start sequence $SS$ and field2 stores the end sequence $ES$. The sender maintains an Encoding Information Table (EIT) with per-Name state

$\langle \text{Name}, BI, LSS, LES \rangle,$

while the receiver maintains a Decoding Information Table (DIT) with per-Name state

$\langle \text{Name}, PSS, PES \rangle.$

Non-retransmitted Interests are bundled according to a fixed bundle interval $BI$, with bundle size

$k = ES - SS + 1 = \min(\mathrm{cwnd}, BI).$

Retransmissions are encoded as singleton bundles so that loss recovery is not delayed.

The receiver reconstructs each Interest with the appropriate Name plus sequence suffix, preserves lifetime, and forwards each to PIT/FIB as an independent Interest. In infrastructure Wi-Fi, the bundle carries only the NONCE of the first Interest, and the receiver assigns that same NONCE to all reconstructed Interests in the bundle. The paper states that PIT operation, Interest aggregation, and caching remain correct because NDN uses Name and selectors to key PIT entries and NONCE primarily for loop detection, and there is no loop in a consumer–AP infrastructure hop. Gap filling provides robustness against bundle loss: when a later bundle is received after an earlier bundle was missed, the decoder emits Interests from $PES+1$ through $N_I \approx N_D$0 to fill the missing range. The paper notes that this cannot eliminate the idle period created by bundle loss, and suggests future sender-side rate-based detection or dynamic adjustment of $N_I \approx N_D$1.

The size and throughput models make the intended gain explicit. The encoded bundle size is

$N_I \approx N_D$2

and the simplified throughput model is

$N_I \approx N_D$3

Channel occupancy with bundling becomes

$N_I \approx N_D$4

Because MAC overhead dominates $N_I \approx N_D$5 for small Interests, moderate $N_I \approx N_D$6 reduces uplink contention and frees airtime for Data.

The evaluation used ndnSIM v2.7 in a one-hop infrastructure Wi-Fi scenario, downloading a 100 MB file with 1460-byte Data payloads, PHY rates of 11 Mbps and 24 Mbps, and AIMD or CUBIC congestion control. Baseline goodput without bundling was 4.4 Mbps on 802.11b and 9.7 Mbps on 802.11n. With $N_I \approx N_D$7, BLEnD achieved goodput improvements of 32.57% and 37.03% for AIMD on 802.11b and 802.11n, and 31.9% and 35.33% for CUBIC on the same PHYs. The paper also reports that increasing the RTT variance multiplier $N_I \approx N_D$8 from 4 to 10 or 20 reduced retransmission spikes and modestly improved goodput; for 802.11n with $N_I \approx N_D$9 and a 100 MB file, CUBIC’s RTx count dropped from 2567 to 1982 with $\mathrm{cwnd}$0 and to 1616 with $\mathrm{cwnd}$1, while goodput increased from 13.10 to 13.20–13.25 Mbps. Multi-hop use is described as hop-local and feasible without BI synchronization across hops, with possible accumulation of gains when each hop independently reduces signaling contention.

3. Secret communication woven into visible traffic

CYPRESS uses “mounting packets from secret entities on regular packets” to realize covert communication through storage channels rather than timing channels. Secret packets are fragmented into small segments, and those segments are embedded in unused or malleable fields of legitimate packets generated by visible users. The prototype operates primarily at L3–L4, including IPv4, TCP, and ICMP, and is aware of L2 for addressing and forwarding. The stated objective is to transmit a separate network traffic without generating new packets for it (Shahini et al., 9 Nov 2025).

The architecture is organized around paired compromised or administratively deployed gateways, termed cGateways. Sender-side fusion embeds segments into visible packets; receiver-side extraction recovers segments and reconstructs secret packets. Protocol-specific covert channels are encapsulated as pluggable handlers within the Packet Moderation Set (PMS). Each handler consists of a match-signature, a packet-moderator, and a carrier-cost. Match-signatures identify packets eligible for embedding, such as non-SYN TCP packets or ICMP echo requests. Packet-moderators read or write bytes at designated carry-targets, including IPv4 fields such as identification, fragmentation offset, options, header checksum, TTL, and flags; TCP sequence number, acknowledgment number, window size, options, and header checksum; and ICMP payloads. The carrier-cost is experimentally derived from synchronization overhead, recovery complexity, and stability impact.

The system uses a transmission queue for secret packets, a receive buffer for extracted segments, and 3-byte synchronization headers consisting of an 8-bit code and 16-bit data. These headers are prepended to some segments to signal handler choice, carry-target, segment boundaries, and exclusion of non-carrier packets. The control plane selects handlers at run time using four criteria: cost, recovery requirements, carrier size, and number of fusion operations per packet. The scheduler prioritizes low-$\mathrm{cwnd}$2 channels, avoids augmented correction when possible, prefers larger-capacity fields, and limits itself to one handler per packet.

Fusion begins when a secret packet reaches the sender cGateway and is queued. When an eligible visible packet arrives on the fusion path, the PMS identifies candidate handlers and the scheduler chooses one. The next bytes of the secret packet are fragmented to match the chosen carry-target, a synchronization header is prepended when needed, and the secret segment may optionally be encrypted with AES-256-CBC. The moderator overwrites the relevant fields, and the packet is forwarded as a normal visible packet. On the receiving side, the PMS searches incoming packets on the extraction path for the appropriate handler, extracts and optionally decrypts the segment, updates synchronization state, appends the bytes to the receive buffer, and forwards the reconstructed secret packet once enough segments have been collected. Destructive fields are repaired before visible packets continue onward, so non-cGateways do not observe invalid packets.

Reliability is handled primarily through transport semantics rather than explicit covert-layer ECC. The paper assumes no packet loss or reordering in its experiments, but states that the synchronization-header mechanism can be extended with additional codes for such cases. Corrupted packets are retransmitted through CYPRESS. Optional encryption is negotiated covertly: each cGateway generates a 2048-bit RSA key pair, the cGateway with the larger numeric right-most 32 bits of its MAC address generates a random 16-byte symmetric key, encrypts it with the peer’s RSA public key, and transmits it covertly. Synchronization headers remain plaintext so that extraction logic can parse them.

The reported performance centers on bandwidth, stability, and detectability. In a network of ten visible users connected to the Internet, CYPRESS achieved more than 1.6 MB/s of secret bandwidth. The paper states that increasing the number of visible users improved bandwidth and stability more than increasing per-user bandwidth, because distribution across more carrier packets reduced impact per packet. Across 40 sessions with constant secret payload and bandwidth, normalized packet ratios at the secret user converged toward the base non-covert throughput as visible users increased. Detection-oriented evaluations reported that Zeek generated very few warnings relative to total packets and did not reliably detect a malicious stream, NetworkMiner failed to recover embedded files from PCAPs in all tests, and VirusTotal with Snort and Suricata engines reported zero detections of embedded malware.

CYPRESS is also presented as a bypass mechanism for NATs, firewalls, IP-based restrictions, and segmentation policies. Experiments include covert initiation of inbound TCP connections into NAT-protected networks, and cross-segment communication by weaving secret traffic into allowed flows. The paper simultaneously frames these capabilities as dual-use and enumerates defensive responses: statistical anomaly detection on header distributions, cross-layer coherence checks, stripping or standardizing IPv4/TCP options, aggressive header sanitization, ICMP payload restrictions, minimal-options policies, and dedicated covert-channel signatures.

4. Formalization in Hilbert spaces

In the mathematical literature, “woven information packets” refers to a generalization of woven frames. Let $\mathrm{cwnd}$3 be a separable Hilbert space. A frame $\mathrm{cwnd}$4 satisfies

$\mathrm{cwnd}$5

for some $\mathrm{cwnd}$6. Fusion frames replace vectors by closed subspaces $\mathrm{cwnd}$7 with weights $\mathrm{cwnd}$8 and satisfy

$\mathrm{cwnd}$9

Against this background, an information packet is defined as a set of closed subspaces $SS$0 such that every $SS$1 admits an unconditionally convergent expansion

$SS$2

This construction includes frames and fusion frames as special cases (Christensen et al., 9 Sep 2025).

The weaving notion is then transferred from vectors to subspaces. For fixed $SS$3, the $SS$4 information packets $SS$5, $SS$6, are woven if for every partition $SS$7 of $SS$8, the mixed collection

$SS$9

is again an information packet. Equivalently, for any choice of labels $ES$0, the single packet $ES$1 is an information packet. The paper emphasizes that the packet-level definition itself does not impose inequalities, but in the explicit wavelet and Gabor constructions the mixed unions are actual frames with universal bounds, so unconditional convergence and numerical stability follow uniformly across all mixtures.

The main constructive results are given in $ES$2 for wavelet and Gabor systems. For wavelets, with

$ES$3

the paper assumes that $ES$4 is bounded, compactly supported in an interval $ES$5 of finite length, and satisfies near-zero power bounds

$ES$6

on a neighborhood of $ES$7. For any $ES$8, $ES$9, and

$\langle \text{Name}, BI, LSS, LES \rangle,$0

the collections

$\langle \text{Name}, BI, LSS, LES \rangle,$1

are woven information packets for any $\langle \text{Name}, BI, LSS, LES \rangle,$2. More strongly, for any choice of labels $\langle \text{Name}, BI, LSS, LES \rangle,$3, the corresponding mixed wavelet system is a frame with uniform bounds independent of the choice. An explicit example uses

$\langle \text{Name}, BI, LSS, LES \rangle,$4

for which the standard wavelet system is a frame with bounds

$\langle \text{Name}, BI, LSS, LES \rangle,$5

and the $\langle \text{Name}, BI, LSS, LES \rangle,$6-subsampled system has bounds

$\langle \text{Name}, BI, LSS, LES \rangle,$7

For Gabor systems,

$\langle \text{Name}, BI, LSS, LES \rangle,$8

the paper gives a woven construction for each fixed $\langle \text{Name}, BI, LSS, LES \rangle,$9. With $\langle \text{Name}, PSS, PES \rangle.$0 bounded and compactly supported in an interval $\langle \text{Name}, PSS, PES \rangle.$1, $\langle \text{Name}, PSS, PES \rangle.$2 on $\langle \text{Name}, PSS, PES \rangle.$3, and $\langle \text{Name}, PSS, PES \rangle.$4, define

$\langle \text{Name}, PSS, PES \rangle.$5

Then the collections

$\langle \text{Name}, PSS, PES \rangle.$6

are woven information packets, and any mixed Gabor system obtained by selecting one translation class per $\langle \text{Name}, PSS, PES \rangle.$7 is a frame with uniform bounds. The key limitation is the density condition: a necessary condition for $\langle \text{Name}, PSS, PES \rangle.$8 to be a frame is $\langle \text{Name}, PSS, PES \rangle.$9, so after thinning the time lattice by a factor of $BI$0, one needs $BI$1. Accordingly, the paper proves that no single fixed Gabor frame can produce woven information packets simultaneously for all $BI$2, in contrast to the wavelet case.

5. Tiny Packet Programs as packet-level weaving

A different networking interpretation identifies Woven Information Packets with Tiny Packet Programs (TPPs): packets carrying embedded, straight-line, tiny programs that execute in-band on switches and accumulate per-hop state. The stated aim is to provide low-latency visibility and limited actuation for dataplane tasks such as congestion control, measurement, troubleshooting, and verification, without relying on slow control-plane interfaces. Switches execute at line rate, while end-hosts perform the complex computation and policy logic (Jeyakumar et al., 2014).

A TPP is identified either by Ethernet ethertype 0x6666 or by a UDP packet to destination port 0x6666. The packet format includes a TPP header, a fixed-size instruction list, preallocated packet memory for per-hop results, and optionally an encapsulated payload. The memory model is unified memory-mapped I/O spanning per-switch state, per-port/link state, per-queue state, per-packet metadata, and stage-local registers. Hop-addressed packet memory is written using offsets of the form [Packet:Hop[k]], allowing each traversed switch to deposit its local data into a designated packet region.

The instruction set is deliberately small. The paper describes LOAD, STORE, PUSH, CSTORE, and CEXEC as the operative primitives, with an instruction budget of at most five instructions per packet. LOAD copies from switch memory into packet memory. STORE copies from packet memory into switch memory. PUSH appends switch data into packet memory using a stack pointer, though in hardware it is serialized into equivalent LOADs with explicit hop addressing. CSTORE performs a conditional write based on a compare-and-swap style condition. CEXEC conditionally enables subsequent instructions. Execution occurs within standard match-action pipelines through a distributed TCPU, in which each pipeline stage has minimal execution units capable of operating on the subset of state visible at that stage. The switch guarantees packet-consistent reads of per-packet metadata, and packet memory writes are ordered in program order.

The paper presents several concrete packet-level programs. A micro-burst detection example pushes switch ID, queue size, and output port into per-hop packet memory, producing 54 bytes of overhead for a five-hop path. For congestion control, an RCP*-style design uses per-hop measurements and conditional updates, with the control equation

$BI$3

and $BI$4-fair aggregation

$BI$5

Other examples include NetSight-style packet histories, CONGA*-style load balancing, and low-overhead bitmap-sketch measurement.

Implementation on a NetFPGA 10 Gb/s platform used four ports and a four-stage pipeline per port. The prototype synthesized at 160 MHz, with a distributed TCPU using 64 kbit BRAM and 8 registers at each stage, for a total of 1 Mbit RAM and 128 registers. Measured per-stage latency was 2 cycles on NetFPGA for a typical 4-instruction TPP, with CSTORE adding 1 extra cycle. Relative to a baseline router, hardware overheads were reported as +21.6% slices, +21.6% slice registers, +30.1% LUTs, and +24.5% LUT-FF pairs. The paper also gives ASIC-feasibility estimates, arguing that even worst-case conditional-operation overheads remain within forwarding-time budgets.

Security is organized around trusted switches and a trusted end-host software layer. Ingress ports or hypervisors filter unauthorized TPPs, TPP-CP allocates address ranges and permissions per application, and static analysis checks that a TPP’s read/write behavior stays within its authorization. Many deployments are expected to disable writes and retain only read-only visibility. The design is thus intentionally narrower than Active Networks: no loops, bounded instruction budget, and operations chosen to fit line-rate ASIC execution.

6. Comparative themes, misconceptions, and open questions

Across these literatures, the phrase “Woven Information Packets” refers to distinct mechanisms rather than a common protocol, theorem, or implementation. A frequent misconception is to treat the term as if it named one canonical architecture. The sources instead describe four separate constructs: NDN Interest bundling, covert packet fusion, subspace weaving in Hilbert spaces, and in-band tiny packet programs (Rahman et al., 2021, Shahini et al., 9 Nov 2025, Christensen et al., 9 Sep 2025, Jeyakumar et al., 2014).

Several recurrent design principles nevertheless appear. First, weaving is local to a specific representation layer. BLEnD confines bundling and unbundling to the link adaptation layer beneath NFD. CYPRESS confines embedding and extraction to paired cGateways and protocol-specific handlers. Woven information packets in frame theory are defined at the level of subspaces and mixed systems. TPPs operate at the dataplane packet and switch-state interface. This suggests that the term consistently denotes controlled restructuring below a preserved higher-level abstraction.

Second, each work specifies a preservation target. BLEnD preserves one-Interest–one-Data semantics, transport feedback, PIT/FIB behavior, caching, and security. CYPRESS preserves the appearance of ordinary visible traffic and avoids generating new packets for secret communication. The Hilbert-space construction preserves unconditional decomposability, and in the explicit examples uniform frame bounds. TPPs preserve line-rate forwarding through a bounded instruction set and a distributed execution model. In all four cases, weaving is valuable only insofar as recovery or stability survives the interleaving operation.

Third, each domain exposes a characteristic trade-off. In BLEnD, larger $BI$6 reduces signaling contention but increases potential idle gaps after bundle loss. In CYPRESS, higher secret bandwidth implies more modifications or larger-capacity carriers, which may increase IDS anomalies. In the wavelet and Gabor setting, broad weaving flexibility is constrained by support conditions and, for Gabor systems, by lattice density. In TPPs, richer programmability is deliberately curtailed by the constraint of at most five instructions per packet. This suggests that “weaving” is systematically balanced against robustness, detectability, or execution cost.

Open questions are domain-specific. BLEnD identifies adaptive bundling, proactive gap detection, cross-hop coordination, and richer bTAG metadata as future directions. CYPRESS points to protocol coverage, explicit handling of loss and reordering, and the impact of aggressive traffic normalization. The mathematical theory leaves open questions on explicit bounds, alternative partitions, fusion-frame status of the constructed subspaces, and extensions to higher-dimensional structured systems. TPPs leave open issues of event-driven notification, heterogeneous vendor mappings, and production deployment in multi-tenant environments. The common implication is that woven constructions are most mature when the carrier structure, recovery procedure, and admissible perturbations are tightly characterized.