Users connect to near-Earth orbit satellites through a user terminal, which then connects to the internet via ground gateways. Drawing on existing research [3], our preliminary analysis of these programs and configurations suggests that the network stack architecture is somewhat similar to DPDK [4], mainly relying on a user-space C++ program to bypass the kernel for handling network packets. During the analysis, DARKNAVY stumbled upon a program labeled Ethernet Data Recorder, which naturally raises suspicions of a backdoor capturing user data.