Cloudflare is faster than Netskope and Zscaler across LATAM
This post is also available in Español and Português.
Last CIO Week, we showed you how our network stacks up against competitors across several countries. We demonstrated with our tests that Cloudflare Access is 38% faster than ZScaler (ZPA) worldwide.
Today we wanted to focus on LATAM and show how our network performed against Zscaler and Netskope in Argentina, Brazil, Chile, Colombia, Costa Rica, Ecuador, Mexico, Peru, Uruguay and Venezuela.
With 47 data centers across Latin America and Caribbean, Cloudflare has the largest number of SASE Points of Presence across all vendors, meaning we can offer our Zero Trust services closer to the end user and reduce unwanted latency.
We’ve run a series of tests comparing our Zero Trust Network Access product against Zscaler and Netskope’s comparable products.
For each of these tests, we used 95th percentile Time to First Byte and Response tests, which measure the time it takes for a user to make a request, and get the start of the response (Time to First Byte), and the end of the response (Response). These tests were designed with the goal of trying to measure performance from an end-user perspective.
In this blog we’re going to talk about Continue reading
Small Site EBGP-Only Design
One of my subscribers found an unusual BGP specimen in the wild:
- It was a small site with two core switches and a WAN edge router
- The site had VPN concentrators running in virtual machines
- The WAN edge router was running BGP across WAN IPsec tunnels
- The VPN concentrators were running BGP with core switches.
So far so good, and kudos to whoever realized BGP is the only sane protocol to run between virtual machines and network core. However, the routing in the network core was implemented with EBGP sessions between the three core devices, and my subscriber thought the correct way to do it would be to use IBGP and OSPF.
Small Site EBGP-Only Design
One of my subscribers found an unusual BGP specimen in the wild:
- It was a small site with two core switches and a WAN edge router
- The site had VPN concentrators running in virtual machines
- The WAN edge router was running BGP across WAN IPsec tunnels
- The VPN concentrators were running BGP with core switches.
So far so good, and kudos to whoever realized BGP is the only sane protocol to run between virtual machines and network core. However, the routing in the network core was implemented with EBGP sessions between the three core devices, and my subscriber thought the correct way to do it would be to use IBGP and OSPF.
RSAC 2023 interview: Tigera talks cloud-native security on theCUBE
During RSA Conference 2023, Utpal Bhatt sat down with SiliconANGLE & theCUBE host, John Furrier, to talk cloud-native security. Watch the full interview below.
Here’s a sneak peak of what’s inside…
“Cloud-native applications have fundamentally changed how security gets done. There are a lot of challenges that cloud-native applications bring to the table, given their large attack surface. You have attack vectors in your coding, CI/CD pipeline, deployment, and runtime. And I think that’s what organizations are realizing, that hey, this is fundamentally a different kind of architecture and we need to look at it differently.” —Utpal Bhatt, CMO at Tigera
“Cloud-native applications have fundamentally changed how security gets done. And there are a lot of challenges that cloud-native applications bring to the table, which is what organizations are realizing. If you think about organizations moving into the cloud, the majority have traditionally done a lift and shift. But now they’re recognizing that in order to get the economics right, they need to start developing cloud-native technologies, which are highly distributed, ephemeral, and transient. So all your standard security tools just really don’t work in that environment because you have a really large Continue reading
U.S. Firms Face Daunting Challenges with 3G Network Shutdowns Internationally
Slow speeds, security issues, and a higher cost of doing business exist as countries take different tacks on wireless network evolutions.HS047: Architect/Engineers/Operations, Career Progression and Liability
What are these roles and how do they fit into a strategy ? Who solves problems, designs solutions, and tests to make sure that’s workable ? How do we create/train people for these roles ? What about professional liability ?
The post HS047: Architect/Engineers/Operations, Career Progression and Liability appeared first on Packet Pushers.
HS047: Architect/Engineers/Operations, Career Progression and Liability
What are these roles and how do they fit into a strategy ? Who solves problems, designs solutions, and tests to make sure that’s workable ? How do we create/train people for these roles ? What about professional liability ?
What you can’t do with Kubernetes network policies (unless you use Calico)
Kubernetes documentation clearly defines what use cases you can achieve using Kubernetes network policies and what you can’t. You are probably familiar with the scope of network policies and how to use them to secure your workload from undesirable connections. Although it is possible to cover the basics with Kubernetes native network policies, there is a list of use cases that you cannot implement by just using these policies.
You can refer to the Kubernetes documentation to review the list of “What you can’t do with network policies (at least, not yet)”.
Here are some of the use cases that you cannot implement using only the native network policy API (transcribed from the Kubernetes documentation):
- Forcing internal cluster traffic to go through a common gateway.
- Anything TLS related.
- Node specific policies.
- Creation or management of “Policy requests” that are fulfilled by a third party.
- Default policies which are applied to all namespaces or pods.
- Advanced policy querying and reachability tooling.
- The ability to log network security events.
- The ability to explicitly deny policies.
- The ability to prevent loopback or incoming host traffic (Pods cannot currently block localhost access, nor do they have the ability to block access from Continue reading
How we built Network Analytics v2
Network Analytics v2 is a fundamental redesign of the backend systems that provide real-time visibility into network layer traffic patterns for Magic Transit and Spectrum customers. In this blog post, we'll dive into the technical details behind this redesign and discuss some of the more interesting aspects of the new system.
To protect Cloudflare and our customers against Distributed Denial of Service (DDoS) attacks, we operate a sophisticated in-house DDoS detection and mitigation system called dosd. It takes samples of incoming packets, analyzes them for attacks, and then deploys mitigation rules to our global network which drop any packets matching specific attack fingerprints. For example, a simple network layer mitigation rule might say “drop UDP/53 packets containing responses to DNS ANY queries”.
In order to give our Magic Transit and Spectrum customers insight into the mitigation rules that we apply to their traffic, we introduced a new reporting system called "Network Analytics" back in 2020. Network Analytics is a data pipeline that analyzes raw packet samples from the Cloudflare global network. At a high level, the analysis process involves trying to match each packet sample against the list of mitigation rules that dosd has deployed, so that it can Continue reading
Heavy Networking 677: US Networking User Association – Meetups For Network Engineers
You ever want a group of fellow networking nerds to hang with once in a while? The US Networking User Association might be exactly what you’re looking for. With local networking user groups popping up in various places all over the US and soon other countries, the USNUA is fostering community and knowledge sharing for networkers everywhere. On today's Heavy Networking we speak with Jason Gintert and Chris Kane, two of the folks behind the USNUA organization, to discuss what the USNUA is, and how you can work with them to get a NUG started in your area.
The post Heavy Networking 677: US Networking User Association – Meetups For Network Engineers appeared first on Packet Pushers.
Heavy Networking 677: US Networking User Association – Meetups For Network Engineers
You ever want a group of fellow networking nerds to hang with once in a while? The US Networking User Association might be exactly what you’re looking for. With local networking user groups popping up in various places all over the US and soon other countries, the USNUA is fostering community and knowledge sharing for networkers everywhere. On today's Heavy Networking we speak with Jason Gintert and Chris Kane, two of the folks behind the USNUA organization, to discuss what the USNUA is, and how you can work with them to get a NUG started in your area.Effects of the conflict in Sudan on Internet patterns
On Saturday, April 15, 2023, an armed conflict between rival factions of the military government of Sudan began. Cloudflare observed a disruption in Internet traffic on that Saturday, starting at 08:00 UTC, which deepened on Sunday. Since then, the conflict has continued, and different ISPs have been affected, in some cases with a 90% drop in traffic. On May 2, Internet traffic is still ~30% lower than pre-conflict levels. This blog post will show what we’ve been seeing in terms of Internet disruption there.
On the day that clashes broke out, our data shows that traffic in the country dropped as much as 60% on Saturday, after 08:00 UTC, with a partial recovery on Sunday around 14:00, but it has consistently been lower than before. Although we saw outages and disruptions on major local Internet providers, the general drop in traffic could also be related to different human usage patterns because of the conflict, with people trying to leave the country. In Ukraine, we saw a clear drop in traffic, not always related to ISP outages, after the war started, when people were leaving the country.
Here’s the hourly perspective of Sudan’s Internet traffic over the past weeks as seen Continue reading
Heavy Wireless 001: Are We Ready For Wi-Fi 7?
Welcome to the Heavy Wireless podcast! For this inaugural episode we look at the Wi-Fi 7 standard (802.11be). With consumer products expected to ship in 2023, now's the time to explore what the latest advances mean for enterprise and consumer markets. Host Keith Parsons welcomes David D. Coleman to discuss key features including 320 Mhz channels, 4K QAM, and Multi-Link Operation (MLO).
The post Heavy Wireless 001: Are We Ready For Wi-Fi 7? appeared first on Packet Pushers.