What Syscall-Layer Tooling Misses in P2P Infrastructure

An analysis reveals that syscall-layer detection fails to capture network resource-exhaustion attacks on blockchain node infrastructure due to structural limitations. Key issues include the absence of a counting window, CPU-cost field, and frame parser, while TLS captures ciphertext. Five techniques were reproduced against actual consensus clients, none of which can be defined as technique-attributable rules. One technique partially triggers on a legitimate snapshot restore, mimicking an attack.