Introduction to Expanse Network Stack

If you've ever worked with data diodes or Cross Domain Solutions, you know the fundamental challenge: traditional network protocols like TCP require bidirectional communication. The three-way handshake, acknowledgments, flow control -- all of it depends on being able to send data in both directions. But data diodes are, by design, unidirectional. They physically prevent reverse data flow. So how do you bridge that gap?

That's where the Expanse Network Stack (ENS) comes in.

The Problem with Data Diodes

Data diodes are brilliant for high security environments. They take the traditional (often mandated) air-gapped network design and allows it to benefit from all the things the internet has to offer, without compromising security and while maintaining air-gap.

They create a hardware-enforced one-way communication channel that's physically impossible to bypass. Want to protect your air-gapped network from remote attacks? A data diode ensures that even if an attacker compromises your software, they can't establish a reverse connection; the hardware literally won't allow it.

But here's the thing: most of the applications and protocols we use every day assume they can talk back and forth. TCP connections need handshakes. HTTP requests expect responses. Even simple file transfers often rely on acknowledgment mechanisms. When you drop a data diode into your network, all of that breaks. No session control, no acknowledgements, not even ARP responses.

You could, of course, just use raw UDP and send data one way. That works for simple use cases. But what if you need to transfer files reliably? What if you want to bridge a TCP connection? What if you need to handle multiple concurrent streams, reorder packets that arrive out of sequence, or manage data flow rates?

Enter Expanse Network Stack

ENS is our proprietary software suite that solves these problems. It's a collection of modular, interoperable command-line utilities that you can chain together using standard Unix pipes. Think of it like building blocks: you combine the pieces you need to create exactly the data flow pipeline your application requires.

Born from GNURadio style modularity and with terminology borrowed from the SDR world, the stack is organized into three main categories:

Sources convert raw data into ENS packets. Tools like

ens-tcp-server

accept TCP connections and packetize the data.

ens-file-reader

reads files and prepares them for transmission.

ens-http-server

accepts HTTP uploads. Each source generates unique stream IDs and segments data based on your network's MTU.

Sinks do the reverse: they take ENS packets and reconstruct the original data.

ens-tcp-client

rebuilds TCP streams and forwards them to target servers.

ens-file-writer

reconstructs files.

ens-stdout

outputs data to standard output for further processing.

Manipulators sit in the middle, processing packets as they flow through the pipeline.

ens-reorderer

handles out-of-order packets (essential when using UDP) and uses a min-heap to prioritize packets in a FIFO manner.

ens-buffer

improves performance by buffering data.

ens-rate-limiter

controls transmission speeds. These tools let you optimize your data flows for reliability and performance. These tools are especially useful in unidirectional environments where your receiver can't communicate back to inform you they are overwhelmed by the traffic.

(Don't worry this is not an all-encompasing list of tools)

The whole system uses our custom packet format with a header that includes stream IDs, sequence numbers, and control flags. This allows multiple concurrent streams to flow through the same diode link, with proper ordering and error handling.

Why This Matters

Here's what makes ENS special: it's included with every Expanse Data Diode purchase, at no additional cost.

In the data diode industry, this is practically unheard of. Most vendors treat their software as a premium add-on. Want documentation? That's a six-figure consulting contract. Need software tools? That's a separate licensing fee, often with annual renewals and metered restrictions. Want to actually understand how their system works? The internals are proprietary, locked down, and treated as trade secrets.

We take a different approach. ENS is well documented, and available to all our customers. You get full access to our community of users, full documentation, and a complete software suite that actually works. No hidden fees, no licensing games, and no expertise required.

Part of a Larger Mission

ENS is part of Domain Systems' broader effort to drive costs down and accessibility up. The data diode market has historically been dominated by vendors who charge premium prices and lock customers into expensive support contracts. We believe that security shouldn't be a luxury reserved for organizations with massive budgets.

Our mission is to make hardware-enforced network security accessible to a wider customer audience. That means:

• Transparent pricing without hidden fees
• Complete software suite included with hardware purchase
• Full documentation that actually helps you succeed
• Open architectures that you can understand and build from
• Support that's actually useful, not just a revenue stream

ENS embodies this philosophy. It's a complete solution that enables you to build real-world applications on top of data diode hardware. Whether you're transferring files, bridging TCP connections, or building custom data flows, ENS gives you the building blocks you need.

The Bottom Line

Data diodes provide unmatched security through hardware-enforced unidirectional communication but without specialized software, their use is severely limited. ENS bridges that gap, providing the tools you need to make data diodes actually useful in real-world deployments.

If you're evaluating data diode solutions, ask the other vendors about their software. Ask about documentation. Ask about licensing. Then compare that to what you get with every Expanse Data Diode purchase. The difference is in the philosophy behind how we do business.