@@ -4,7 +4,7 @@ use crossbeam::channel::{self, Receiver, Sender};
 use dashmap::DashMap;
 use log::{debug, error, info, warn};
 use serde_json::json;
-use std::fs::OpenOptions;
+use std::fs::{File, OpenOptions};
 use std::io::Write;
 use std::sync::atomic::{AtomicBool, AtomicU64, Ordering};
 use std::sync::{Arc, RwLock};
@@ -101,6 +101,30 @@ impl ProcessDetectionStatus {
 static QUIC_CONNECTION_MAPPING: LazyLock<Mutex<HashMap<String, String>>> =
     LazyLock::new(|| Mutex::new(HashMap::new()));
 
+/// Maximum QUIC connection ID mappings to prevent unbounded growth.
+const MAX_QUIC_MAPPINGS: usize = 10_000;
+
+/// Maximum queued packets before backpressure drops packets.
+/// At ~1500 bytes per packet, 10,000 packets ≈ 15 MB of buffer.
+const MAX_PACKET_QUEUE: usize = 10_000;
+
+/// Maximum tracked connections to prevent memory exhaustion from port scans
+/// or connection floods.
+const MAX_CONNECTIONS: usize = 50_000;
+
+/// Open or create a file for appending with restrictive permissions (0o600 on Unix).
+///
+/// Ensures log files containing connection metadata are not world-readable.
+fn open_log_file(path: &str) -> std::io::Result<File> {
+    let file = OpenOptions::new().create(true).append(true).open(path)?;
+    #[cfg(unix)]
+    {
+        use std::os::unix::fs::PermissionsExt;
+        let _ = file.set_permissions(std::fs::Permissions::from_mode(0o600));
+    }
+    Ok(file)
+}
+
 /// Helper function to log connection events as JSON
 fn log_connection_event(
     json_log_path: &str,
@@ -213,11 +237,8 @@ fn log_connection_event(
         }
     }
 
-    // Write to file
-    if let Ok(mut file) = OpenOptions::new()
-        .create(true)
-        .append(true)
-        .open(json_log_path)
+    // Write to file (restrictive permissions: 0o600 on Unix)
+    if let Ok(mut file) = open_log_file(json_log_path)
         && let Ok(json_str) = serde_json::to_string(&event)
     {
         let _ = writeln!(file, "{}", json_str);
@@ -265,10 +286,7 @@ fn log_pcap_connection(pcap_path: &str, conn: &Connection) {
         }
     }
 
-    if let Ok(mut file) = OpenOptions::new()
-        .create(true)
-        .append(true)
-        .open(&json_path)
+    if let Ok(mut file) = open_log_file(&json_path)
         && let Ok(json_str) = serde_json::to_string(&event)
     {
         let _ = writeln!(file, "{}", json_str);
@@ -549,7 +567,7 @@ impl App {
         connections: Arc<DashMap<String, Connection>>,
     ) -> Result<()> {
         // Create packet channel
-        let (packet_tx, packet_rx) = channel::unbounded();
+        let (packet_tx, packet_rx) = channel::bounded(MAX_PACKET_QUEUE);
 
         // Start capture thread
         self.start_capture_thread(packet_tx)?;
@@ -592,6 +610,18 @@ impl App {
                     *current_interface.write().unwrap() = Some(device_name.clone());
                     *linktype_storage.write().unwrap() = Some(linktype);
 
+                    // Drop CAP_NET_RAW now that the socket is open (Linux only)
+                    #[cfg(all(target_os = "linux", feature = "landlock"))]
+                    {
+                        if let Err(e) =
+                            crate::network::platform::sandbox::capabilities::drop_cap_net_raw()
+                        {
+                            warn!("Failed to drop CAP_NET_RAW in capture thread: {}", e);
+                        } else {
+                            debug!("Dropped CAP_NET_RAW in capture thread");
+                        }
+                    }
+
                     // Check if PKTAP is active (linktype 149 or 258)
                     #[cfg(target_os = "macos")]
                     {
@@ -678,9 +708,17 @@ impl App {
                                     });
                                 }
 
-                                if packet_tx.send(packet).is_err() {
-                                    warn!("Packet channel closed");
-                                    break;
+                                match packet_tx.try_send(packet) {
+                                    Ok(()) => {}
+                                    Err(crossbeam::channel::TrySendError::Full(_)) => {
+                                        stats
+                                            .packets_dropped
+                                            .fetch_add(1, Ordering::Relaxed);
+                                    }
+                                    Err(crossbeam::channel::TrySendError::Disconnected(_)) => {
+                                        warn!("Packet channel closed");
+                                        break;
+                                    }
                                 }
                             }
                             Ok(None) => {
@@ -767,6 +805,17 @@ impl App {
         thread::spawn(move || {
             info!("Packet processor {} started", id);
 
+            // Drop CAP_NET_RAW immediately as this thread doesn't need it (Linux only)
+            #[cfg(all(target_os = "linux", feature = "landlock"))]
+            {
+                if let Err(e) = crate::network::platform::sandbox::capabilities::drop_cap_net_raw()
+                {
+                    warn!("Failed to drop CAP_NET_RAW in processor thread {}: {}", id, e);
+                } else {
+                    debug!("Dropped CAP_NET_RAW in processor thread {}", id);
+                }
+            }
+
             // Wait for linktype to be available
             let parser = loop {
                 if let Some(linktype) = *linktype_storage.read().unwrap() {
@@ -1403,7 +1452,7 @@ impl App {
                     );
                 }
 
-                thread::sleep(Duration::from_secs(10));
+                thread::sleep(Duration::from_secs(5));
             }
         });
 
@@ -1696,6 +1745,11 @@ fn update_connection(
                 key, conn_id_hex
             );
         } else {
+            // Prevent unbounded growth of QUIC connection ID mappings
+            if mapping.len() >= MAX_QUIC_MAPPINGS {
+                debug!("QUIC mapping limit reached, clearing old entries");
+                mapping.clear();
+            }
             // New QUIC connection ID, create mapping
             mapping.insert(conn_id_hex.clone(), key.clone());
             debug!(
@@ -1705,6 +1759,16 @@ fn update_connection(
         }
     }
 
+    // Prevent unbounded growth from port scans or connection floods.
+    // Only limit new connections; existing ones always get updated.
+    if !connections.contains_key(&key) && connections.len() >= MAX_CONNECTIONS {
+        debug!(
+            "Connection limit reached ({}), dropping new connection: {}",
+            MAX_CONNECTIONS, key
+        );
+        return;
+    }
+
     connections
         .entry(key.clone())
         .and_modify(|conn| {
 
@@ -134,7 +134,14 @@ fn main() -> Result<()> {
     // This must be done BEFORE Landlock is applied so the file exists when adding rules
     if let Some(ref pcap_path) = config.pcap_export_file {
         let jsonl_path = format!("{}.connections.jsonl", pcap_path);
-        if let Err(e) = std::fs::File::create(&jsonl_path) {
+        if let Err(e) = std::fs::File::create(&jsonl_path).and_then(|f| {
+            #[cfg(unix)]
+            {
+                use std::os::unix::fs::PermissionsExt;
+                f.set_permissions(std::fs::Permissions::from_mode(0o600))?;
+            }
+            Ok(f)
+        }) {
             warn!("Failed to pre-create sidecar JSONL file: {}", e);
         }
     }
 
@@ -14,6 +14,10 @@ const EXTENSION_BIT_BYTE: usize = 5; // Byte 5, bit 0x10
 /// uTP header size (BEP 29)
 const UTP_HEADER_LEN: usize = 20;
 
+/// Maximum DHT method name length. Standard methods are short
+/// (e.g., "ping", "find_node", "get_peers", "announce_peer").
+const MAX_DHT_METHOD_LEN: usize = 64;
+
 // --- TCP: Peer Handshake ---
 
 /// Check if the payload starts with a BitTorrent peer handshake.
@@ -135,6 +139,9 @@ fn extract_dht_method(payload: &[u8]) -> Option<String> {
 
     let len_str = std::str::from_utf8(&payload[after..len_end]).ok()?;
     let str_len: usize = len_str.parse().ok()?;
+    if str_len > MAX_DHT_METHOD_LEN {
+        return None;
+    }
     let str_start = len_end + 1;
     let str_end = str_start + str_len;
     if str_end > payload.len() {
 
@@ -1,5 +1,8 @@
 use crate::network::types::{DnsInfo, DnsQueryType};
 
+/// Maximum DNS name length per RFC 1035 section 2.3.4
+const MAX_DNS_NAME_LEN: usize = 253;
+
 pub fn analyze_dns(payload: &[u8]) -> Option<DnsInfo> {
     if payload.len() < 12 {
         return None;
@@ -50,6 +53,11 @@ pub fn analyze_dns(payload: &[u8]) -> Option<DnsInfo> {
                 name.push_str(label);
             }
 
+            // Enforce RFC 1035 maximum name length
+            if name.len() > MAX_DNS_NAME_LEN {
+                break;
+            }
+
             offset += 1 + label_len;
         }
 
@@ -115,3 +123,61 @@ pub fn analyze_dns(payload: &[u8]) -> Option<DnsInfo> {
 
     Some(info)
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_empty_payload_safe() {
+        assert!(analyze_dns(&[]).is_none());
+    }
+
+    #[test]
+    fn test_short_payload_safe() {
+        assert!(analyze_dns(&[0; 5]).is_none());
+    }
+
+    #[test]
+    fn test_dns_name_length_limit() {
+        // Build a DNS packet with many 63-byte labels (exceeding 253 chars)
+        let mut payload = vec![0u8; 12]; // DNS header
+        // Set qdcount = 1
+        payload[5] = 1;
+        // Add 10 labels of 63 bytes each (630+ chars total, exceeds 253)
+        for _ in 0..10 {
+            payload.push(63); // label length
+            payload.extend_from_slice(&[b'a'; 63]);
+        }
+        payload.push(0); // null terminator
+        payload.extend_from_slice(&[0, 1, 0, 1]); // QTYPE A, QCLASS IN
+
+        let info = analyze_dns(&payload).unwrap();
+        if let Some(name) = &info.query_name {
+            // Name should be truncated near the RFC limit, not the full 630+ chars
+            assert!(name.len() <= MAX_DNS_NAME_LEN + 63 + 1);
+        }
+    }
+
+    #[test]
+    fn test_normal_dns_query() {
+        // Build a simple query for "example.com"
+        let mut payload = vec![0u8; 12]; // DNS header
+        payload[5] = 1; // qdcount = 1
+        // "example" label
+        payload.push(7);
+        payload.extend_from_slice(b"example");
+        // "com" label
+        payload.push(3);
+        payload.extend_from_slice(b"com");
+        // null terminator
+        payload.push(0);
+        // QTYPE A (1), QCLASS IN (1)
+        payload.extend_from_slice(&[0, 1, 0, 1]);
+
+        let info = analyze_dns(&payload).unwrap();
+        assert_eq!(info.query_name, Some("example.com".to_string()));
+        assert_eq!(info.query_type, Some(DnsQueryType::A));
+        assert!(!info.is_response);
+    }
+}
@@ -1,6 +1,10 @@
 use crate::network::types::{HttpsInfo, TlsInfo, TlsVersion};
 use log::debug;
 
+/// Maximum TLS extensions to parse. Defense-in-depth against crafted packets
+/// with many zero-length extensions designed to waste CPU.
+const MAX_TLS_EXTENSIONS: usize = 100;
+
 pub fn is_tls_handshake(payload: &[u8]) -> bool {
     if payload.len() < 5 {
         return false;
@@ -252,8 +256,13 @@ fn parse_server_hello(data: &[u8], info: &mut TlsInfo) {
 
 fn parse_extensions(data: &[u8], info: &mut TlsInfo, is_client_hello: bool) {
     let mut offset = 0;
+    let mut extensions_parsed = 0;
 
     while offset + 4 <= data.len() {
+        extensions_parsed += 1;
+        if extensions_parsed > MAX_TLS_EXTENSIONS {
+            break;
+        }
         let ext_type = u16::from_be_bytes([data[offset], data[offset + 1]]);
         let ext_len = u16::from_be_bytes([data[offset + 2], data[offset + 3]]) as usize;
 
 
@@ -291,6 +291,13 @@ mod tests {
         pkt
     }
 
+    #[test]
+    fn test_empty_payload_safe() {
+        // This simulates a potential DoS attack with an empty packet
+        // Should return None, not panic
+        assert!(analyze_mqtt(&[]).is_none());
+    }
+
     #[test]
     fn test_connect_v311() {
         let pkt = build_connect(b"MQTT", 4, "my-client");
 
@@ -184,6 +184,16 @@ mod tests {
         attr
     }
 
+    #[test]
+    fn test_empty_payload_safe() {
+        assert!(analyze_stun(&[]).is_none());
+    }
+
+    #[test]
+    fn test_short_payload_safe() {
+        assert!(analyze_stun(&[0x00, 0x01]).is_none());
+    }
+
     #[test]
     fn test_binding_request() {
         let packet = build_stun_packet(0, 0x0001, &[]);
 
@@ -66,8 +66,13 @@ pub fn apply_landlock(config: &SandboxConfig) -> Result<LandlockResult> {
     // We need read access to /proc for process identification
     let read_access = AccessFs::from_read(abi);
 
-    // Build filesystem access rights for writing
-    let write_access = AccessFs::from_all(abi);
+    // Build filesystem access rights for writing (principle of least privilege)
+    // RustNet only needs to create regular files, write/append to them, and traverse dirs.
+    let write_access = AccessFs::WriteFile
+        | AccessFs::ReadFile
+        | AccessFs::ReadDir
+        | AccessFs::MakeReg
+        | AccessFs::Truncate;
 
     // Start building the ruleset
     let ruleset = Ruleset::default()
 
@@ -20,7 +20,7 @@
 //! - Older kernels: Graceful degradation (sandbox not applied)
 
 #[cfg(feature = "landlock")]
-mod capabilities;
+pub mod capabilities;
 #[cfg(feature = "landlock")]
 mod landlock;
 
 
@@ -1041,6 +1041,7 @@ pub struct TrafficSample {
     pub tx_bytes_per_sec: u64,
     pub connection_count: usize,
     // Network health metrics
+    pub packets_per_sec: u64,
     pub packet_loss_pct: f32,
     pub avg_rtt_ms: Option<f64>,
 }
@@ -1081,6 +1082,7 @@ impl TrafficHistory {
             rx_bytes_per_sec,
             tx_bytes_per_sec,
             connection_count,
+            packets_per_sec: total_packets,
             packet_loss_pct,
             avg_rtt_ms,
         };
@@ -1091,6 +1093,11 @@ impl TrafficHistory {
         self.samples.push_back(sample);
     }
 
+    /// Get the latest packets/sec value, or 0 if no samples
+    pub fn get_latest_packets_per_sec(&self) -> u64 {
+        self.samples.back().map(|s| s.packets_per_sec).unwrap_or(0)
+    }
+
     /// Get RX bytes/sec values for sparkline (newest last), smoothed with moving average
     pub fn get_rx_sparkline_data(&self, count: usize) -> Vec<u64> {
         let raw: Vec<u64> = self