Prepare to Converge: Aligning the Priorities of Networking and Security
The convergence of cybersecurity and networking into a cloud-first operating model is essential. But this means that both network and security teams will need to learn how to collaborate much more closely.CVE-2022-47929: traffic control noqueue no problem?
USER namespaces power the functionality of our favorite tools such as docker, podman, and kubernetes. We wrote about Linux namespaces back in June and explained them like this:
Most of the namespaces are uncontroversial, like the UTS namespace which allows the host system to hide its hostname and time. Others are complex but straightforward - NET and NS (mount) namespaces are known to be hard to wrap your head around. Finally, there is this very special, very curious USER namespace. USER namespace is special since it allows the - typically unprivileged owner to operate as "root" inside it. It's a foundation to having tools like Docker to not operate as true root, and things like rootless containers.
Due to its nature, allowing unprivileged users access to USER namespace always carried a great security risk. With its help the unprivileged user can in fact run code that typically requires root. This code is often under-tested and buggy. Today we will look into one such case where USER namespaces are leveraged to exploit a kernel bug that can result in an unprivileged denial of service attack.
Enter Linux Traffic Control queue disciplines
In 2019, we were exploring leveraging Linux Traffic Control's queue Continue reading
Design Clinic: Small-Site IPv6 Multihoming
I decided to stop caring about IPv6 when the protocol became old enough to buy its own beer (now even in US), but its second-system effects keep coming back to haunt us. Here’s a question I got for the February 2023 ipSpace.net Design Clinic:
How can we do IPv6 networking in a small/medium enterprise if we’re using multiple ISPs and don’t have our own IPv6 Provider Independent IPv6 allocation. I’ve brainstormed this with people far more knowledgeable than me on IPv6, and listened to IPv6 Buzz episodes discussing it, but I still can’t figure it out.
Design Clinic: Small-Site IPv6 Multihoming
I decided to stop caring about IPv6 when the protocol became old enough to buy its own beer (now even in US), but its second-system effects keep coming back to haunt us. Here’s a question I got for the February 2023 ipSpace.net Design Clinic:
How can we do IPv6 networking in a small/medium enterprise if we’re using multiple ISPs and don’t have our own IPv6 Provider Independent IPv6 allocation. I’ve brainstormed this with people far more knowledgeable than me on IPv6, and listened to IPv6 Buzz episodes discussing it, but I still can’t figure it out.
Tech Bytes: Fortinet’s FortiRecon Customizes Digital Risk Protection (Sponsored)
On today's Tech Bytes podcast we discuss security reconnaissance with sponsor Fortinet. We drill into FortiRecon, a service that can provide critical information, personalized for your organization, about potential threats to company assets, employees, and customers.
The post Tech Bytes: Fortinet’s FortiRecon Customizes Digital Risk Protection (Sponsored) appeared first on Packet Pushers.
Tech Bytes: Fortinet’s FortiRecon Customizes Digital Risk Protection (Sponsored)
On today's Tech Bytes podcast we discuss security reconnaissance with sponsor Fortinet. We drill into FortiRecon, a service that can provide critical information, personalized for your organization, about potential threats to company assets, employees, and customers.MacOS Ventura 13.1 Breaks Wireshark
If you recently updated your Mac to Ventura 13.1 or 13.2, and you had installed Wireshark previously, then you may be having some trouble. If you open Wireshark, you will likey see the message “You don’t have permission to capture on local interfaces” and “You can fix this by installing ChmodBPF“. Even after installing this […]
The post MacOS Ventura 13.1 Breaks Wireshark appeared first on Packet Pushers.
Network Break 415: WAN Update Severs Microsoft Cloud Services; Intel To Wind Down Network ASIC Biz
Take a Network Break! This week we discuss new capabilities in Juniper's Astra data center automation software; a major Microsoft outage that affected Outlook, Teams, and more; reports that Intel will discontinue selling the Tofino programmable ASIC; a heap of financial results; and more.
The post Network Break 415: WAN Update Severs Microsoft Cloud Services; Intel To Wind Down Network ASIC Biz appeared first on Packet Pushers.
Network Break 415: WAN Update Severs Microsoft Cloud Services; Intel To Wind Down Network ASIC Biz
Take a Network Break! This week we discuss new capabilities in Juniper's Astra data center automation software; a major Microsoft outage that affected Outlook, Teams, and more; reports that Intel will discontinue selling the Tofino programmable ASIC; a heap of financial results; and more.Dictionary : Watermelon Project
Define Watermelons
Cisco Certification Changes of Changes
Continous delivery of updates to certification programs
Response: Free College Algebra Course (with Python Code!)
It’s been a long time since I was using mathematics in my daily life. I’d like to think I managed to retaine much of the basic principles but I not easily able to apply it. For example, having some knowledge of Fourier Transforms and Antenna Physics has been hugely useful in understanding wireless propagation in […]
Navigating the Global Technology Skills Gap with AI-Moderated Upskilling
The future workforce is already here, and it is more than ready to adapt – the vast majority of workers simply need the tools to upskill efficiently.netlab Release 1.5.0: Larger Lab Topologies
netlab release 1.5.0 includes features that will help you start very large lab topologies (someone managed to run over 90 Mikrotik routers on a 24-core server):
- You can start libvirt virtual machines in batches to reduce the CPU overload that causes startup failures on large topologies.
- You can combine virtual machines and containers in the same lab, further reducing the memory footprint for devices available as true containers (Linux hosts, Cumulus/FRR routers, Arista cEOS)
- Use custom management network IP subnet if you’re running out of management IP addresses
To get more details and learn about additional features included in release 1.5.0, read the release notes. To upgrade, execute pip3 install --upgrade networklab.
New to netlab? Start with the Getting Started document and the installation guide.
netlab Release 1.5.0: Larger Lab Topologies
netlab release 1.5.0 includes features that will help you start very large lab topologies (someone managed to run over 90 Mikrotik routers on a 24-core server):
- You can start libvirt virtual machines in batches to reduce the CPU overload that causes startup failures on large topologies.
- You can combine virtual machines and containers in the same lab, further reducing the memory footprint for devices available as true containers (Linux hosts, Cumulus/FRR routers, Arista cEOS)
- Use custom management network IP subnet if you’re running out of management IP addresses
To get more details and learn about additional features included in release 1.5.0, read the release notes. To upgrade, execute pip3 install --upgrade networklab.
New to netlab? Start with the Getting Started document and the installation guide.