Getting Structured Output from Network Devices with Ansible

This post is part of an ongoing series on Ansible, and you can find all the other posts in the series here.

In the previous parts of this series, we built an OSPF network with Ansible, and then wrote a few checks to make sure it's healthy. One of those checks counted the OSPF neighbors on each router, by running show ip ospf neighbor and counting the lines that contain the word FULL. It works, but it's a bit broken. We're treating the output as plain text and searching through it, so we're relying on the router always formatting the output in exactly the same way.

The output of a show command is designed for humans to read, not for machines. What we really want is structured data, such as a list of neighbors, where each neighbor has its own neighbor ID, state, and interface that we can work with directly, just like the facts and variables we've been using throughout the series.

In this part, we'll look at how to parse command output into structured data using the cli_parse module and a library of ready-made templates called ntc-templates. We'll parse show ip ospf neighbor, compare the plain Continue reading

Pre and Post Checks with Ansible

This post is part of an ongoing series - see all the posts below.

Ansible Course

In the previous part, we wrote two checks for our OSPF network. One makes sure every router has all of its OSPF neighbours, and the other makes sure every router can reach every other router's loopback. They're useful on their own, but they're even more useful when you run them around a change.

The idea is that before making a change, you check that the network is healthy. If it isn't, you stop, since there's no point making a change on a network that's already broken. It also means that if something goes wrong later, you know it wasn't already broken before you started. Then, after the change, you run the same checks again to make sure everything is still healthy.

Most of us already do this manually. Before a change, we log in and save the output of a few show commands, and afterwards, we run them again and compare. In this part, we'll let Ansible do it for us, by reusing the playbooks we've already written, rather than copying them into every change playbook.

We're continuing with the same lab and Continue reading

Why I Created “Inside AI Agent Systems: From Components to Platforms”

4 real? Tracking exploitation and patching of eMudhra’s weak keys

On October 19, 2026, we learned about eMudhra’s eight shockingly weak keys: where eMudhra was trusted to pick a 115-digit number for their virtual combination lock protecting the Internet, they picked the number 4. Not even four digits, just the number 4. The other seven keys were similarly weak: 56, 66, 115, 155, 156, 230 and 237.

The next day, we wrote a blog post on the immediate action we took to mitigate this leak, and what customers needed to do on their end to stay secure. Now, we are sharing a more in-depth follow up on the evidence we’ve seen of exploitation, and the progress seen on visitors patching their systems.

Let's start with the scale of the problem. A certificate authority (CA) with weak keys this serious is unprecedented, and the potential consequences are significant. While there have been plenty of compromised certification authorities in the past (such as DigiNotar, TÜRKTRUST, and TrustWave), access to their keys has always been contained to a degree; these incidents gave a limited set of attackers or organizations the ability to issue fraudulent certificates. The eMudhra incident is fundamentally different; the affected intermediate private keys could be recovered almost Continue reading

Cloudflare services for private origins is now generally available

Today, Cloudflare services for private origins is generally available. Point a proxied DNS record at a private IP, and Cloudflare reaches the origin over your existing Cloudflare One connection. Your origin stays private, while web application firewall (WAF), caching, bot management, and Workers work just as they do for public origins.

In June, we launched this capability in closed beta to address a problem we kept hearing from customers: Their internal APIs, AI agent backends, MCP servers, and operational tools weren’t built to face the Internet, but those services still need to accept requests from partners, customers, or agents over the Internet. Before the beta, putting Cloudflare in front of these services meant exposing a public IP, opening a firewall port, or running cloudflared alongside the origin.

Those requirements often left private applications without the same protections and controls they used for public applications, including WAF, bot management, rate limiting, caching, traffic acceleration, rewrites, and Workers.

What is generally available today

During the closed beta, eligible customers requested access through their account team. Today, we’re opening access beyond that beta group.

Point a proxied A or AAAA record at a private IP, and Cloudflare’s application services work Continue reading

Worth Reading: Network Labs on a Budget

The Packet Pushers newsletter dropped into my Inbox this morning, and it included a lovely Network Labs on a Budget article by Suresh Vinasiththamby, explaining how you can build a virtual lab on a mini-PC (exactly what I’m using for my netlab server) using EVE-NG, CML, or the containerlab/netlab combo.

On a tangential note: I’m busy getting various netlab features to work with netmiko, so something had to give (= blog posts).

When Novel Becomes Normal

Imagine your product strategy team gets stuck on a positioning problem. Somebody opens an AI chat window and asks for an unconventional angle. The model comes back with a concept nobody in the room has thought about in years. Maybe it’s the Lindy effect or Chesterton’s fence or something borrowed from evolutionary biology. The room loves it. It feels fresh and a little clever. Three months later a competitor walks onto a keynote stage with the same framing. How did that happen? Did someone leak the deck?

You’ve probably felt a smaller version of this. You learn a new word and it shows up in three articles that same week. The linguist Arnold Zwicky named this on Language Log in 2005. He called it the frequency illusion, though you may know it by its folk name, the Baader-Meinhof phenomenon. Once you notice something, you think it’s everywhere. Most of the time it isn’t. Your attention changed. The world didn’t. When the coincidences really start piling up, some people reach for something grander. Great minds think alike. Ideas are in the air. Maybe there’s a universal consciousness out there that we’re all dipping into. Or maybe it’s as bland as Continue reading

Cloudflare DDoS Threat Report 2026 Q3: More swarms, fewer giants

Welcome to the 26th edition of Cloudflare's DDoS Threat Report. This edition covers the third quarter of 2026 — July, August, and September — and returns the series to its quarterly cadence following the combined H1 2026 volume. The analysis is produced by Cloudforce One, Cloudflare's Threat Intelligence organization, providing a comprehensive analysis of the evolving threat landscape of Distributed Denial of Service (DDoS) attacks based on data from the Cloudflare network.

Key insights

1. Short-burst, low-bandwidth attacks lasting under 10 minutes and 1 Gbps surged by 208%. Conversely, hyper-volumetric attacks exceeding 1 Tbps plummeted by nearly 69% from Q2, possibly a reflection of law enforcement actions against four major Internet of Things (IoT) botnets earlier in the year. However, variants continue to emerge, proving that IoT botnets remain a durable, high-volume threat to network infrastructure.
2. Threat actors dramatically shifted their reflection and amplification tactics, abruptly abandoning CLDAP floods, which collapsed by 99.5% quarter-over-quarter. Instead, attackers pivoted heavily toward other connectionless protocols, driving a 215% surge in DNS amplification and a 122% increase in general UDP floods.
3. Attack targets broadened significantly across both industries and geographies, with the United States reclaiming the most-attacked position from China. Canada and Israel Continue reading

Fabric Topologies for GPU Clusters

In part five of a series on AI data center networking, various interconnected networks are discussed, highlighting the differences between traditional and AI clusters. Key topics include back-end and front-end networks, the folded-Clos topology, adaptive routing, and the significance of switch design in addressing network congestion. Dragonfly topology is also mentioned for hyperscale systems.

The post Fabric Topologies for GPU Clusters appeared first on /overlaid.

Booth Demo

The example above uses the open source sFlow-RT booth-demo application to demonstrate a 400G data center switch carrying RoCEv2 test traffic. The demo shows a series of RDMA write operations in the Traffic Trend chart. The Switch Port Traffic Flows diagram shows the paths traffic takes as it flows through the switch. In this example, a NCCL ring topology results traffic flowing from port to port as it goes around the logical ring of GPUs.

The quickest way to set up the demo is to run the a pre-built sflow/booth-demo image on a laptop connected to the booth display screen. The Traffic Trend chart is easily customizable to show different flow attributes that are relevant to the demo and the title can be changed to include branding and messaging. If more extensive customization is required, clone the GitHub project Continue reading

Validating Your Network with Ansible Assert

This post is part of an ongoing series - see all the posts below.

Ansible Course

In the previous part, we built an OSPF network from scratch using Ansible, and then logged in to the routers to check that everything was working. We looked at the OSPF neighbors, checked the routing table, and ran a few pings. That's fine for six routers. But imagine doing it for fifty, before and after every change, at 2 AM during a maintenance window. By router number twelve, you're not really reading the output anymore, you're just looking for the word FULL and hoping for the best.

In this part, we'll let Ansible do the checking for us. We'll write a few simple tests that check whether every router has the right number of OSPF neighbors, and whether every router can reach every other router. If something is wrong, the playbook fails and tells us exactly where the problem is. We'll also break the network on purpose, so we can see what happens when a check fails.

We're continuing with the same lab and project from the previous part, so if you haven't read it yet, I recommend starting there.

What Is assert?

Continue reading

Fixing SCHED_IDLE for real

I’ve wondered for years why SCHED_IDLE tasks are allowed to preempt other tasks. Nobody seems to know, and I’ve not had the time to dig in and understand the Linux kernel scheduler better. But now I finally have my answer.

The problem

I want to be able to run a CPU-heavy task in the background, without it stealing any CPU, any at all, from other processes.

If you read various documentation, you’d be forgiven if this is as simple as schedtool -D -e ./my-background-thing.

SCHED_FIFO can be used only with static priorities higher than 0,
which means that when a SCHED_FIFO thread becomes runnable, it
will always immediately preempt any currently running SCHED_OTHER,
SCHED_BATCH, or SCHED_IDLE thread.

(and similar statements, e.g. from sched.7)

But if you try that, you’ll find that it’ll actually preempt other processes, taking little but nonzero CPU. There’s a test program, if you want to try it out.

I literally want it to take zero CPU. And not just against SCHED_FIFO/RR, but everything.

The existing settings

There appear to be two places that minmax guarantees can show up.

Settings with default values:

$ sudo sysctl -a | grep sched_rt_
kernel. Continue reading

Global Infrastructure at NANOG 98

What took the Internet offline in Q3 2026

The Internet can feel invisible when everything is working normally. But when connectivity breaks, the many systems it depends upon become evident in an instant. Because Cloudflare’s global network handles more than 20% of the web’s traffic, it offers a unique perspective of how Internet traffic is behaving. When failures in infrastructure, power, policy, or security disrupt access to the Internet, Cloudflare Radar can observe the impact by monitoring traffic to our customers. Each quarter, we review the disruptions detected and annotated on Radar, highlighting what happened, where it happened, and the broader conditions that shaped each event.

In this post, we examine the major categories of Internet disruptions observed during the third quarter of 2026, including government-directed shutdowns, power outages and natural disasters.

Disruptions at a glance

Between July and September, Internet disruptions were largely driven by failures in the systems the Internet depends on. Power grids failed in Cuba, Honduras, Guam, Ukraine, and several other countries. Natural disasters damaged electricity and telecommunications infrastructure from Nepal to Colombia. Government-directed shutdowns remained the most frequent source of disruption, driven largely by exam-related shutdowns in Iraq, while renewed conflict in Ethiopia’s Tigray region showed how quickly connectivity can become part of Continue reading

Introducing the Cloudflare PHP Capture the Flag challenge

Last week was one for the Internet security history books. First, eight eMudhra intermediate certificates were compromised, creating the possibility of forged certificates that could be used to impersonate servers. Then came php2shell: serious vulnerabilities in PHP, the runtime behind a large portion of the Web.

Cloudflare worked around the clock as these events unfolded to protect our customers and help protect the Internet. We shipped client updates and multiple mitigations, updated our web application firewall (WAF) with new rules to block attackers from exploiting the PHP vulnerabilities, and introduced a new feature called full transaction detection.

As always in situations like this, these new capabilities were made available on all plans, including Free.

Put our WAF to the test

Protecting systems from vulnerabilities like these is always an ongoing process, not a one-time event. The widespread adoption of AI allows attackers to discover new vectors with unprecedented speed and efficiency, so collecting real-world data to test our assumptions and strengthen defenses is essential.

That’s why today we're launching the Cloudflare PHP Capture the Flag challenge, run through our Bug Bounty program. We've put a deliberately vulnerable PHP installation behind our WAF, and we're inviting security researchers Continue reading

Nexus OS Fails to Send Syslog Records to a Silent Host

Here’s another you can’t make this up SNAFU observation I made when running integration tests for netlab Syslog functionality: Cisco Nexus OS cannot send Syslog messages to a directly connected silent host.

The setup is as trivial as it can get: a Cisco Nexus OS VM (running version 10.6(2)) connected to a dnsmasq container running rsyslogd.

HTTP/3 load balancer connection offloading

In a previous post I described load balancing for TCP-based HTTP with connection offloading, and mentioned that HTTP/3 can do even more. By the power of AI writing a HTTP/3 version of both the load balancer (sni-router-h3) and the webserver (tarweb-h3), I have experimented enough to have more to say about how that works.

To be clear: this post is 100% human-written.

In this post I will use this terminology:

• client: E.g. a web browser.
• router: A load balancer / traffic router, that inspects SNI and forwards to matching backends. Mine’s called sni-router.
• backend: A webserver. Mine’s called tarweb.

First, the TCP story

While it is possible to use TCP_REPAIR to transfer an established connection between machines (from router to backend), it requires some more infrastructure. The kernel on the chosen backend must be synced up on the connection state (sequence numbers, etc) that TCP_REPAIR provides, but that’s actually just the easy part. It must also be able to send packets to the client with the original server’s IP address as source, and packets going from the client to the backend must somehow find their way to the same backend, in a network-efficient way.

There are other problems Continue reading

Cross-request KV cache exposure in the GLM-5.3 Workers AI model, and our remediation with SGLang

On September 8, 2026, we were alerted by a security researcher, Gadi Evron from Knostic, to a tenant isolation issue affecting the GLM-5.3 Workers AI model (@cf/zai-org/glm-5.3) starting on August 27, 2026. We have remediated the issue, and we restored the model on September 9. We have confirmed that no other model hosted on Workers AI was affected.

Between August 27 and September 9, a small number of customers using the GLM 5.3 Workers AI model received responses that contained data from other customers' requests made to the same model shortly before theirs. In total, 155 responses were affected, all to prompts longer than 681,280 tokens.

After excluding our own testing and the researcher's, the requests we identified are consistent in timing and volume with ordinary long-context use, not with someone repeatedly exploiting the bug. We found no evidence of deliberate exploitation.

Today we are publishing this report alongside a post from SGLang, the open-source inference engine that we use, as a coordinated disclosure. This post describes the bug that caused this issue, our response timeline, and the subsequent hardening we have conducted on our production SGLang deployments. We also detail our continued efforts with Continue reading

Building an OSPF Network from Scratch with Ansible

This post is part of an ongoing series - see all the posts below.

Ansible Course

So far in this series, we've been working with pretty much the same set of devices, core1, core2, access1, access2, and access3. We've used them to configure VLANs, NTP, syslog, and interface descriptions, and to learn the core Ansible concepts along the way.

For this part, we're going to start with a new topology and put everything we've learned into practice with a real-world example. The lab has six Cisco routers, split across three OSPF areas. I created it using Containerlab, and I've included the topology file below, so you should be able to build the same lab and follow along.

name: ospf_lab

mgmt:
  network: mgmt
  ipv4-subnet: 192.168.202.0/24

topology:
  kinds:
    cisco_iol:
      image: cisco-iol-17.12.01

  nodes:
    r1:
      kind: cisco_iol
      mgmt-ipv4: 192.168.202.101
    r2:
      kind: cisco_iol
      mgmt-ipv4: 192.168.202.102
    r3:
      kind: cisco_iol
      mgmt-ipv4: 192.168.202.103
    r4:
      kind: cisco_iol
      mgmt-ipv4: 192.168.202.104
    r5:
      kind: cisco_iol
      mgmt-ipv4: 192.168.202.105
    r6:
      kind: cisco_iol
      mgmt-ipv4: 192.168.202.106

  links:
    # Area 0
    - endpoints: ["r1:Ethernet0/1", "r2:Ethernet0/1"]   # 10.100.12. Continue reading

Useful Ansible Filters for Network Engineers

This post is part of an ongoing series - see all the posts below.

Ansible Course

In the previous part of this series, we looked at what filters are and covered some of the most commonly used ones, such as selectattr, map, and regex_replace. We also used filters to solve a real problem in the previous part by sharing the same syslog servers between Cisco and Arista.

Ansible has a huge number of filters, and it's impossible to cover all of them. So in this part, I want to focus on a handful that I find especially useful as a network engineer. We'll work with IP addresses and subnets, compare lists to check whether a device's config is what it should be, merge dictionaries together, and sort lists. Along the way, we'll also build a simple compliance check that you can use in your own network right away.

This post is part of a series on Ansible for network engineers. If you're new to the series, I recommend following the parts in order, since each one builds on the previous one. Here's a quick overview of the setup we're using. The lab has five switches, core1, core2 Continue reading