PhysWall · The Physical-Logic Gateway · four-dimensional gap decomposition

Every switch counts bytes exactly. Nobody compares that to what the security layer sees.

A physics engine, and a verification tool enforced on top of it. PhysWall inverts a closed, published, non-linear physical law at a single measurement point — and refuses when the inverse is not unique. Seven laws, one engine, and the same refusal in all of them.

Every switch counts bytes exactly. The security layer sees a sample. Nobody compares the two — and the difference is bytes that crossed the wire and were never inspected.

See it worked through →

⚠ This tool computes in your browser, and JavaScript is off. The controls below will move and nothing will happen: the chart stays empty and no verdict is produced. The text on this page describes what the tool would show, and it is describing something that is not there.

HELD — THE ENGINE RUNS, THE MEASUREMENT HAS NOT

There is no tool on this page, and that is not an oversight. The command has never been run against a switch. Everything the engine has been shown is numbers we invented.

Every other page here rests on a source with no interest in whether we succeed — USGS, NOAA, a published standard. This one would rest on us. So it stays held until one real interface has been read.

⚠ THERE IS NO FORM ON THIS PAGE

Every other tool here takes your numbers. This one does not, and that is the point.

The engine has never been shown a real measurement. A box to type into would invite you to trust a figure from something that has only ever seen numbers we invented, and no label undoes that.

WORKED, ON NUMBERS WE MADE UP

the interface counter says   1,000,000,000 octets
unicast packets                  1,000,000
flow export sampling             1 in 100

The framing correction first, which is arithmetic and not a judgement:

18 bytes per frame x 1,000,000 frames
  = 18,000,000 octets of layer 2

so at most 982,000,000 octets of IP
payload crossed that interface

That is 1.4% before a single byte is missing.

AND THEN THE SAMPLING BAND

relative SD = sqrt((N-1)/n) x sqrt(1 + CV^2)
            = sqrt(99/1,000,000) x sqrt(2)
            = 0.0141

three sigma = +/- 41,622,749 octets

THREE READINGS, THREE VERDICTS

flow says 982,000,000   CONSISTENT
                        inside the band

flow says 500,000,000   UNACCOUNTED
                        482 million octets crossed
                        and reached no collector

sampling rate unknown   UNDECIDABLE
                        no band, so no verdict --
                        only a difference

UNDECIDABLE is the one that matters. Without a sampling rate a measurement looks exactly like a clean one, and calling that CONSISTENT would be the worst thing this page could do.

⚠ Every figure above was invented by us. No interface has been read.

⚠ The framing overhead holds for Ethernet with a standard preamble, and does not carry over to jumbo frames or tunnelled traffic. The sampling formula only holds at a fixed rate, and does not apply to adaptive sampling. This page makes no claim about those.

AND WHY IT IS HELD

The question this answers, why the naive subtraction fails, the five verdicts and what would take it off hold are on the page that introduces it.

They are not repeated here. Reading the same paragraph twice teaches that one of the two was not worth reading — and this page has what the other does not: the engine, run through.

What this is, and what would release it →

Developed and architected by Gadi Zion