Broadband RF scanner revisited
I have previously blogged about doing RF surveys using software defined radio. The most interesting aspect to me has been to inventory the business of the different WiFi channels, in order to not clash with neighbouring access points.
I’ve now written better software for doing these surveys.
2.4GHz is a mess (overlapping channels), has much less spectrum, and goes through walls more than 5GHz worth. There’s also a bunch of other crap on 2.4GHz polluting the airwaves, including microwave ovens. So if you’ve thought about this at all, you know to stay off of 2.4GHz.
It’s tempting to get a QuadRF in order to add more dimensions to the 5GHz RF survey, but so far I’ve resisted buying this particular toy.
I’m plotting the spectrum power in both dB and linear. With linear scale the busyness really pops.
2.4GHz
As expected, this is a mess:
There’s even a bunch of noise between the channels. Is it microwaves? Or someone running the 1/5/9/13 channel split? No, if anything it looks like channel 14, which is not legal here.
5GHz
Background traffic
Busy
As a power WiFi user I started using U-NII-3 channels (149-165) as soon as they Continue reading
SONiC Deep Dive: Intra-Switch Inter-VLAN Routing and Packet Forwarding
The title of this section might seem a little
overwhelming, but it reflects the focus of the chapter. The SONiC Redis
database programming pipeline is examined through the configuration of two
Layer-2 VLANs, VLAN 10 and VLAN 20, together with their respective Layer-3
routing interfaces.
VLAN 10 and VLAN 20 represent two separate
Layer-2 broadcast domains, with each VLAN associated with its own IP subnet.
VLAN 10 uses the 10.0.10.0/24 subnet, while VLAN 20 uses the 10.0.20.0/24
subnet. Because the two hosts belong to different broadcast domains and IP
subnets, communication between them requires Layer-3 routing. In this example,
the routing is performed locally by Leaf-1 through the routing interfaces
configured for the two VLANs.
Figure 5-15 depicts the basic building blocks
and IP addressing scheme used in this example. PC1, with IP address
10.0.10.101/24, belongs to VLAN 10 and is connected to the Leaf-1 Ethernet0
interface. PC2, with IP address 10.0.20.101/24, belongs to VLAN 20 and is
connected to the Leaf-1 Ethernet1 interface. The routing interfaces for VLAN 10
and VLAN 20 use IP addresses 10.0.10.1/24 and 10.0.20.1/24, respectively.
The Continue reading
NB587: US Calls for CyberSec Privateers; Oracle To Rent Out Quantum Computers
Take a Network Break! Our red alert goes to cluster of CVEs for Canonical’s LXD Linux Container system. On the news side, Palo Alto Networks adds AI-powered security evaluations as a service engagement, SonicWall introduces an endpoint security agent for SMBs, and the White House outlines a plan to authorize private companies to conduct cyber... Read more »New Tool – Juniper Protect-RE Filter Generator
Also new on the Network Tools page: a Juniper Protect-RE Filter Generator — builds the lo0.0 input firewall filter every RE-bound packet passes through, regardless of which interface or destination address it actually arrived on.
Check the protocols you run, list trusted sources where it matters, and get a complete, correctly-ordered config — anti-spoofing and fragment discard first, then source-restricted NTP/RADIUS/SNMP/BGP, then OSPF/VRRP, then management access, a blanket TCP SYN/FIN/RST flood policer, type-restricted rate-limited ICMP, dual-style traceroute support (UDP and Windows’ ICMP-based tracert), optional BFD, and a logged, counted catch-all discard at the end.
The Never-Ending IPv6 Loopback Prefix Saga
Remember the sage advice to simplify your life and use the IPv6 /64 prefixes everywhere? Not only does it make your life simpler (and wastes immesuarably less address space than the crazy “let’s assign /64 to every device” stupidity), it also reduces the hardware requirements in your high-speed routers layer-3 switches. You see, doing lookups on 64 bits uses half the silicon it takes to do lookups on 128 bits.
Alas, some people never got the memo. OSPFv3 standard clearly states in one of the bullets in section 4.4.3.9 that the loopback prefixes should always be advertised as /128s regardless of what’s configured on the interface.
SONiC Deep Dive: Binding Interface to Vlan
Step 3: Associate Ethernet0 to
VLAN 10
After configuring VLAN 10 and
bringing up interface Ethernet0, the next step is to make Ethernet0 an untagged
member of VLAN 10.
GONFIG_DB and APPL_DB
Figure 5-11 gives a conceptual view of the Redis database updates
resulting from the SONiC command:
sudo config vlan member add 10
Ethernet0 --untagged
The command defines our intent: Ethernet0 should participate in VLAN
10 as an untagged (access) port. For an untagged VLAN member, frames received
from the host arrive without an 802.1Q tag and are associated with VLAN 10
based on the port's VLAN membership. In the opposite direction, frames
transmitted from VLAN 10 toward Ethernet0 are sent without an 802.1Q tag.
The command updates several related entries in CONFIG_DB. The
PORT|Ethernet0 entry contains the port's access VLAN configuration:
PORT|Ethernet0
access_vlan = 10
The VLAN|Vlan10 entry represents the VLAN itself and contains a
members@ field that records Ethernet0 as a member:
VLAN|Vlan10
members@ = Ethernet0
vlanid = 10
The @ character in members@ is part of the SONiC CONFIG_DB schema
convention. The members@ value is a configuration representation of the
relationship between the VLAN and its members.
The Continue reading
Mengenal Black-throated Boatbill: Burung Langka dari Papua
Burung black throated boatbill merupakan salah satu jenis burung eksotis yang menjadi kebanggaan Papua. Saat ini, keberadaan black throated boatbill semakin menarik perhatian para pencinta burung dan peneliti burung di Indonesia maupun dunia. Keunikan perilaku, habitat, dan ciri fisik burung ini membuatnya layak untuk dipahami lebih dalam. Artikel ini akan mengupas secara lengkap berbagai aspek mengenai black throated boatbill, mulai dari karakteristik, habitat, hingga upaya pelestariannya di masa kini.
Karakteristik Fisik Black-throated Boatbill
Black throated boatbill memiliki ciri khas yang mudah dikenali, terutama warna hitam pekat pada bagian tenggorokannya yang menjadi asal nama burung ini. Selain itu, burung ini memiliki bentuk paruh yang unik menyerupai dayung atau “boatbill,” yang memudahkan mereka dalam mencari makan. Ukuran tubuh black throated boatbill tidak terlalu besar, dengan panjang sekitar 12-14 cm. Warna bulunya umumnya didominasi oleh perpaduan antara hijau zaitun pada bagian punggung dan kuning cerah di bawah tubuh.
Bentuk paruh unik ini berfungsi sangat efektif dalam mencari serangga kecil dan larva di batang pohon maupun daun. Black throated boatbill juga dikenal memiliki postur ramping dan gerakan yang lincah saat terbang di hutan-hutan lebat Papua.
Habitat dan Persebaran Black-throated Boatbill di Papua
Black throated boatbill dapat dijumpai hampir di seluruh wilayah hutan dataran rendah Continue reading
Misteri Fenomena Crystal Reinforcement Lattice pada Ice Shelf
Fenomena crystal reinforcement lattice pada dasar lapisan es di kutub menjadi salah satu topik yang paling mencuri perhatian dalam penelitian perubahan iklim dan dinamika es saat ini. Struktur kristal unik ini ditemukan di bawah lapisan es laut, yang berperan penting dalam mempertahankan stabilitas dan kekuatan lapisan es tersebut. Pada periode terbaru, pemahaman mengenai crystal reinforcement lattice semakin berkembang, membuka wacana baru tentang bagaimana interaksi kimia dan fisika pada tingkat mikro dapat memengaruhi ketahanan dan masa depan es kutub di tengah krisis iklim global.
Apa Itu Crystal Reinforcement Lattice pada Ice Shelf?
Secara sederhana, crystal reinforcement lattice adalah struktur kristal yang terbentuk secara alami di bawah lapisan es laut, khususnya pada bagian basal ice shelf, yakni di perbatasan antara es dan laut cair. Struktur ini berfungsi sebagai sistem penguat internal yang memperkuat lapisan es dari dalam. Pembentukan lattice ini melibatkan proses kristalisasi ulang dan interaksi molekuler air laut dengan es yang jauh lebih kompleks daripada yang dipahami sebelumnya.
Penemuan crystal reinforcement lattice sendiri memunculkan harapan baru dalam memahami mekanisme alami pelindung bagi ice shelf dari keretakan dan kerusakan akibat meningkatnya suhu dan arus laut yang kuat. Dalam konteks riset es laut yang saat ini sedang berlangsung, fenomena ini dianggap sebagai jawaban Continue reading
TNO068: Packet Pushers Assemble! Bridging the Telemetry Divide
Today, several members of our Packet Pushers podcast team assemble to discuss whether the grass is greener on the NetOps or DevOps side of the telemetry fence. William of The Cloud Gambit, Scott of Total Network Operations, and Ned and Kyler of Day Two DevOps discuss the difficulties and differences of getting telemetry and state... Read more »How Cloudflare detects MCP traffic and helps secure it
Most companies designed their resource permissions with a human user in mind. A senior engineer may be able to deploy to production, query a sensitive database, or revoke another user's access. Those privileges come with risk, but that risk has traditionally been bounded by two assumptions: the engineer will use human judgment, and the engineer can only act at human speed.
An engineer who sees an unexpected result will usually stop and reconsider their actions. Any human being can only click, type, and review so much in a single day. The introduction of AI agents changes both thresholds. Their decisions are nondeterministic, and they can take the same action (or invoke the same tool) indefinitely, without getting tired or stopping for lunch. A plausible — but incorrect — decision can become thousands of incorrect actions before a human notices.
Today, we're announcing new Cloudflare One capabilities to identify inspected MCP traffic, show which users and servers are generating it, and control direct connections on managed network paths. Combined with MCP Server Portals, these controls help administrators see whether agents are using an approved path, or somehow bypassing it.
Model Context Protocol (MCP) servers give agents a common way to Continue reading
Secure all your internal vibe-coded applications — in one click
AI has enabled employees across every team to build applications faster than ever before.
But that speed is also what's keeping every CISO up at night: any employee can build an application, deploy it to the public Internet, and accidentally expose internal work or company data.
Today, we're launching new tools to make it easy to keep your applications hosted on Workers private. You can now apply Cloudflare Access directly to a Worker or to every Worker in your account, so that your applications are behind your company login by default, without relying on each developer to set that up themselves.
You can now:
- Set a policy at the account level to ensure that all preview and production deployments are behind your company login by default.
- Set a policy on a single application to ensure authentication is enforced on every domain associated with it, no matter how it's deployed.
- See exactly who visits your application. Get every authenticated user’s email, name, and groups directly in your code — no JWT (JSON Web Token) validation required.
- Deploy an internal platform where every deployment is private by default. We've open-sourced an example: an internal static site platform where every Worker Continue reading
Hedge Classics 17: Strong Opinions Loosely Held
Strong opinions loosely held? This is probably not as good of an idea as it seems. Instead of producing confidence, it might produce overconfidence. Michael Natkin joins Tom and Russ to discuss the problems with this mantra.
download
Total eclipse of the Internet: traffic impacts in Iceland, Spain, and Portugal
At a time when looking down at our devices is a ritual in daily life, a natural phenomenon that demands our attention communally upward is a welcome event. On Wednesday, August 12, a total solar eclipse swept from the North Atlantic across Europe, moving over Iceland and northern Spain and Portugal, with a deep partial eclipse over the rest of Western Europe, all near local sunset. This was the first total solar eclipse to cross mainland Europe in twenty years, and it drew millions outdoors to witness the moon pass between Earth and the sun.
As we saw during the 2026 World Cup and the last total eclipse in 2024, online behavior is noticeably affected when an event at this scale takes place. In this blog post, we’ll use data from Cloudflare Radar to examine how Internet traffic shifted alongside the moon and the sun.
Internet traffic dips align precisely with maximum obscuration
In the figure above, we measured HTTP request volume in five-minute buckets across the affected countries on eclipse day, and compared it to a normal-day baseline. Each row is a country (except for Alaska) and each column is a five-minute slice of August 12, Continue reading
New Tool – IPsec VPN Configuration Generator (Multi-Vendor, Policy vs Route-Based Interop)
Added a new one to the Network Tools page: an IPsec VPN Configuration Generator for Cisco IOS/IOS-XE, ASA, FortiGate, Palo Alto, Juniper SRX, strongSwan/VyOS, UniFi, and pfSense/OPNsense.
The reason I built this instead of just pointing at vendor docs is the case that actually breaks real deployments: pairing a policy-based peer with a route-based one. A route-based side (VTI/tunnel interface) defaults to a catch-all 0.0.0.0/0 ↔ 0.0.0.0/0 selector, since routing decides what enters the tunnel. A policy-based peer negotiates specific proxy-IDs per subnet pair, pulled straight from its ACL. Put those two together unmodified and phase 2 negotiation just fails — no useful error, just a tunnel that won’t come up.
LIU020: Ricki Cook: Reaching the Top and Walking Away
What do you do when you get your dream job and it’s not as fulfilling as you thought it would be? Ricki Cook speaks with Alexis and Kevin about navigating between career achievement and personal satisfaction. Ricki discusses his transition from traditional network architecture to touring systems engineering, the realities of maintaining real-time networks under... Read more »Certificate Transparency Monitoring is now generally available
Since we launched Certificate Transparency Monitoring in public beta in 2019, we've been emailing subscribers whenever a new TLS certificate appears in a public Certificate Transparency (CT) log for one of their domains. Today, it's turned on for more than 650,000 customer domains. It's an early warning that someone, somewhere, has issued a certificate for a hostname in your zone, giving you a chance to spot a mis-issued certificate early.
It's a useful signal, but it had a noise problem, and we felt it ourselves. Cloudflare issues a large volume of certificates on your behalf: Universal SSL renewals, certificates from Advanced Certificate Manager, and backup certificates. All of them are logged to public CT logs by design, because a certificate that isn't logged won't be trusted by major browsers like Google Chrome and Apple's Safari. So the same transparency that lets you monitor for mis-issuance also surfaces every certificate we issue for you.
And issuance isn't a one-time event. Certificates are short-lived and renew automatically: a single Universal SSL certificate can renew as often as every 60 days, up to about six times a year. That cadence is set to increase, with the CA/Browser Forum having voted to cut Continue reading
MTU Path Test — Find Where a Path Silently Fragments, Hop by Hop
MTU problems are some of the most annoying things to troubleshoot in networking, because they’re usually silent. Small packets sail through fine, everything looks healthy, and then someone complains that a specific app is slow or hanging — and it turns out one link in the path, three hops in, has an MTU 8 bytes smaller than everyone assumed. GRE, IPsec, PPPoE, a VPN overlay, a jumbo-frame config that only got applied to half the path, a VLAN tag quietly adding 4 bytes nobody accounted for, or just two vendors defining and displaying “MTU” differently (L2 vs. L3, tagged vs. untagged) — any of these can quietly clip your effective MTU, and standard ping/traceroute won’t tell you where.
Worth Reading: LLM Prompts for Network Engineers
Tony Mattke put together a long list of recommendations that might help you get more out of your LLM tokens.
Definitely worth reading instead of yelling at the stupid AI.