MPLS Fast Reroute

BGP Optimal Route Reflection

Arches and Pipes

Weekend Reads 113018

You might not know the name, but you probably haven’t missed their work — highly targeted credit card skimming attacks, hitting Ticketmaster and British Airways, as well as consumer electronics giant Newegg and likely many more sites that have been silently hacked to scrape consumer credit card data at the checkout. —Zack Whittaker @Tech Crunch

Given this level of concentration, the notion of a “free and open” internet now seems almost quaint. Most information transmitted online today is sieved through a few large search engines, social media networks, and streaming video services. These firms may collectively be referred to as “edge companies”: they provide online content or services over a network, but they do not own the network themselves. —Travis Kavulla @American Affairs

Google is increasingly divided over supporting the news industry, either through direct funding, or with a set of initiatives directly aimed at improving publishers’ bottom line. —Frederic Filloux @Monday Note

To hear the moans on Wall Street, you’d think the end of the world is no longer coming—it has arrived. Successive waves of selling have pushed share prices down this year. To about where they were at the beginning of the year. Hardly a catastrophe for investors. Continue reading

History of Networking: JR Rivers on Linux Based Routing

Lessons from Andromeda

A common complaint I hear among network engineers is that the lessons and techniques used by truly huge scale networks simply are not applicable to more “standard scale” networks. The key point, however, is balance—to look for the ideas and concepts that are interesting and at least somewhat novel, and then see how they might be applied to products and systems in all networks. Learning concepts can help you understand design patterns you might encounter almost anywhere. One recent paper, for instance, details Andromeda, a large scale networking system designed and operated by Google, one of the few truly huge networks in the world—

Andromeda is designed around a flexible hierarchy of flow processing paths. Flows are mapped to a programming path dynamically based on feature and performance requirements.

While the paper describes the general compute environment, and the forwarding process on individual nodes, the most interesting part from a network engineering perspective is hoverboard. While this concept behind hoverboard has been implemented in previous systems, it is usually hidden under the covers of a vertically integrated system, and therefore not normally something you see the inner workings of. To understand hoverboard, you have to begin with a little theory Continue reading

Post and Bikes

Attitude and Gratitude

I don’t often let my studies in philosophy and worldview creep into these pages intentionally. I don’t think it can be helped, of course, because the more I study philosophy, the more I see just how practical it is (contrary to popular belief). On the other hand, sometimes an observation about our world jumps out at me so strongly that I cannot help but to post about it here. If you don’t want to hear this, I give you permission to stop reading now.

Today, in the U.S., is what is called “Black Friday.” The name derives from a major stock market crash in the 1850’s, but was eventually applied to the combined shopping and football crowds the day after Thanksgiving by the Philadelphia Police, and now, finally to the general shopping day after Thanksgiving in the U.S.

Thanksgiving is all about giving thanks. About gathering family and friends, and appreciating community, and people, and the shared blessings of homes and meals together. It is interesting that Thanksgiving and Black Friday are juxtaposed in just this way. The family right up against the commercial, the quietness of the home against the loudness of the market. Maybe Continue reading

The Network Collective: State of Exhaustion

On the ‘net: Network Operating Systems

For those with a long memory—no, even longer than that—there were once things called Network Operating Systems (NOS’s). These were not the kinds of NOS’s we have today, like Cisco IOS Software, or Arista EOS, or even SONiC. Rather, these were designed for servers. The most common example was Novell’s Netware. These operating systems were the “bread and butter” of the networking world for many years. @ECI

Policy at the Edge

CAA Records and Site Security

The little green lock—now being deprecated by some browsers—provides some level of comfort for many users when entering personal information on a web site. You probably know the little green lock means the traffic between the host and the site is encrypted, but you might not stop to ask the fundamental question of all cryptography: using what key? The quality of an encrypted connection is no better than the quality and source of the keys used to encrypt the data carried across the connection. If the key is compromised, then entire encrypted session is useless.

So where does the key pair come from to encrypt the session between a host and a server? The session key used for symmetric cryptography on each session is obtained using the public key of the server (thus through asymmetric cryptography). How is the public key of the server obtained by the host? Here is where things get interesting.

The older way of doing things was for a list of domains who were trusted to provide a public key for a particular server was carried in HTTP. The host would open a session with a server, which would then provide a list of domains where Continue reading

Throw Away the Key

Thinking Differently

History of Networking: Bob Hinden on IPv6

Research: Measuring IP Liveness

Of the 4.2 billion IPv4 addresses available in the global space, how many are used—or rather, how many are “alive?” Given the increasing usage of IPv6, it might seem this is an unimportant question. Answering the question, however, resolves to another question that is actually more important: how can you determine whether or not an IP address is in use? This question might seem easy to answer: ping every address in the address space. This, however, turns out to be the wrong answer.

Scanning the Internet for Liveness. SIGCOMM Comput. Commun. Rev. 48, 2 (May 2018), 2-9. DOI: https://doi.org/10.1145/3213232.3213234

This answer is wrong because a substantial number of systems do not respond to ICMP requests. According to this paper, in fact, some 16% of the hosts they discovered that would respond to a TCP SYN, and another 2% that would respond to a UDP packet shaped to connect to a service, do not respond to ICMP requests. There are a number of possible reasons for this situation, including hosts being placed behind devices that block ICMP packets, hosts being configured not to respond to ICMP requests, or a server sitting behind a PAT or CGNAT Continue reading

Wheel and Sky

Weekend Reads 110818

KrebsOnSecurity recently had a chance to interview members of the REACT Task Force, a team of law enforcement officers and prosecutors based in Santa Clara, Calif. that has been tracking down individuals engaged in unauthorized “SIM swaps” — a complex form of mobile phone fraud that is often used to steal large amounts of cryptocurrencies and other items of value from victims. Snippets from that fascinating conversation are recounted below, and punctuated by accounts from a recent victim who lost more than $100,000 after his mobile phone number was hijacked. @Krebs on Security

PortSmash, as the new attack is being called, exploits a largely overlooked side-channel in Intel’s hyperthreading technology. A proprietary implementation of simultaneous multithreading, hyperthreading reduces the amount of time needed to carry out parallel computing tasks, in which large numbers of calculations or executions are carried out simultaneously. The performance boost is the result of two logical processor cores sharing the hardware of a single physical processor. The added logical cores make it easier to divide large tasks into smaller ones that can be completed more quickly. —Dan Goodin @ARS Technica

Security researchers have unveiled details of two critical vulnerabilities in Bluetooth Low Energy (BLE) chips embedded Continue reading

Network Troubleshooting Webinar on Safari Books

I just redid my slides for the network troubleshooting seminar I teach on Safari Books from time to time. This new set of slides should make for a better webinar. The outline now covers—

Segment 1: Foundations
Length: 50 minutes

• MTTR, MTBM, MTBM
• Resiliency in terms of troubleshooting
• Positive feedback loops
• Automated processes and fragility
• The troubleshooting process
• Avoiding the narrows
• Using models to dive deeper
• Using abstraction to counter the combinatorial explosion
• When abstractions leak
• What, how, and why models

10 Minute Break

Segment 2: Process
Length: 50 minutes

• The theory of half split, as seen from search trees
• Putting it together: a simple troubleshooting loop and the half-split
• Using manipulability theory to prove it
• Observations on observations

10 Minute Break

Segment 3: Examples
Length: 50 minutes

• The EIGRP case
• The BGP case
• IS-IS and BFD

10 minute final Question and Answer Period

You can register here. Note the name of the seminar is changing, so the URL might change, as well.

DDoS Mitigation Strategies