0

Fast zero copy static web server with KTLS

I’m writing a webserver optimized for serving a static site with as high performance as possible. Counting every syscall, and every copy between userspace and kernel space.

It’s called “tarweb”, because it serves a website entirely from a tar file.

I’m optimizing for latency of requests, throughput of the server, and scalability over number of active connections.

I won’t go so far as to implement a user space network driver to bypass the kernel, because I want to be able to just run it in normal setups, even as non-root.

I’m not even close to done, and the code is a mess, but here are some thoughts for now.

First optimize syscall count

Every syscall costs performance, so we want to minimize those.

The minimum set of syscalls for a webserver handling a request is:

1. accept() to acquire the new connection.
2. epoll_ctl() to add the fd.
3. epoll_wait() & read() or similar. (ideally getting the whole request in one read() call)
4. epoll_wait() & write() or similar. (again ideally in one call)
5. close() the connection.

There’s not much to do about accept() and read(), as far as I can see. You need to accept the connection, and you need to Continue reading

0

2022 US midterm elections attack analysis

Through Cloudflare’s Impact programs, we provide cyber security products to help protect access to authoritative voting information and the security of sensitive voter data. Two core programs in this space are the Athenian Project, dedicated to protecting state and local governments that run elections, and Cloudflare for Campaigns, a project with a suite of Cloudflare products to secure political campaigns’ and state parties’ websites and internal teams.

However, the weeks ahead of the elections, and Election Day itself, were not entirely devoid of attacks. Using data from Cloudflare Radar, which showcases global Internet traffic, attack, and technology trends and insights, we can explore traffic patterns, attack types, and top attack sources associated with both Athenian Project and Cloudflare for Campaigns participants.

For both programs, overall traffic volume unsurprisingly ramped up as Election Day approached. SQL Injection (SQLi) and HTTP Anomaly attacks were the two largest categories of attacks mitigated by Cloudflare’s Web Application Firewall (WAF), and the United States was the largest source of observed attacks — see more on this last point below.

Below, we explore the trends seen across both customer sets from October 1, 2022, through Election Day on November 8.

Athenian Project

Throughout Continue reading

0

Heavy Networking 655: On-Prem VPC Networking With Netris (Sponsored)

Heavy Networking welcomes sponsor Netris to the show with a special episode for you network nerds who are really getting into automation, infrastructure as code, pipelines, and so on. Netris is all about bringing that public cloud VPC experience to the network you’ve already got. Imagine being able to consume your existing network with APIs and being able to stand up VLANs, VXLANs, elastic load balancers, firewalls, Internet gateways, and more the same way you do in the cloud, but on premises.

The post Heavy Networking 655: On-Prem VPC Networking With Netris (Sponsored) appeared first on Packet Pushers.

0

Heavy Networking 655: On-Prem VPC Networking With Netris (Sponsored)

Heavy Networking welcomes sponsor Netris to the show with a special episode for you network nerds who are really getting into automation, infrastructure as code, pipelines, and so on. Netris is all about bringing that public cloud VPC experience to the network you’ve already got. Imagine being able to consume your existing network with APIs and being able to stand up VLANs, VXLANs, elastic load balancers, firewalls, Internet gateways, and more the same way you do in the cloud, but on premises.

0

Video: Routing Protocols Overview

After discussing network addressing and switching, routing, and bridging in the How Networks Really Work webinar, it was high time for a deep dive into routing protocols, starting (as always) with an overview.

0

Video: Routing Protocols Overview

After discussing network addressing and switching, routing, and bridging in the How Networks Really Work webinar, it was high time for a deep dive into routing protocols, starting (as always) with an overview.

0

Network Automation with CUE – Augmenting Ansible workflows

Hardly any conversation about network automation that happens these days can avoid the topic of automation frameworks. Amongst the few that are still actively developed, Ansible is by far the most popular choice. Ansible ecosystem has been growing rapidly over the last few years, with modules being contributed by both internal (Redhat) and external (community) developers. Having the backing of one of the largest open-source first companies has allowed Ansible to spread into all areas of infrastructure – from server automation to cloud provisioning. By following the principle of eating your own dog food, Redhat used Ansible in a lot of its own open-source projects, which made it even more popular in the masses. Another important factor in Ansible’s success is the ease of understanding. When it comes to network automation, Ansible’s stateless and agentless architecture very closely follows a standard network operation experience – SSH in, enter commands line-by-line, catch any errors, save and disconnect. But like many complex software projects, Ansible is not without its own challenges, and in this post, I’ll take a look at what they are and how CUE can help overcome them.

Ansible Automation Workflow

Let’s start with an overview of the intermediate Ansible Continue reading

0

Kubernetes Unpacked 013: Azure Kubernetes Service (AKS) In Production

In this episode, Michael Levan catches up Richard Hooper, Microsoft Azure MVP and Azure Architect, to chat about Azure Kubernetes Service (AKS) in production. Richard spends the majority of his time working with organizations that are either using AKS, or are migrating to AKS, so he has a ton of experience in how to actually use AKS in the real-world.

The post Kubernetes Unpacked 013: Azure Kubernetes Service (AKS) In Production appeared first on Packet Pushers.

0

Kubernetes Unpacked 013: Azure Kubernetes Service (AKS) In Production

In this episode, Michael Levan catches up Richard Hooper, Microsoft Azure MVP and Azure Architect, to chat about Azure Kubernetes Service (AKS) in production. Richard spends the majority of his time working with organizations that are either using AKS, or are migrating to AKS, so he has a ton of experience in how to actually use AKS in the real-world.

0

Should security systems be the network?

Recently during a research interview with a small but fast-growing business, for the first time I encountered an organization with a “no-network-vendor” network. That is, instead of using Cisco or Dell or even a white-box solution for switching and routing, the company deployed only Fortinet equipment for its entire network. That is, every network component is part of the security infrastructure for them.They built the network this way not just to bake security into its core (a great idea in itself) but also for: ease of management: they have one tool, it manages every component ease of deployment: they have only two or three versions of each appliance, all the same except for capacity and port count ease of expansion to new locations: every site is the same as any other site of similar size They have a small stock of replacement appliances on the shelf, with which they provide rapid recovery for all locations. They could easily also consume security-operations center as-a-service, and use professional services for nearly all the rest of their network operations. In essence, their security solution could become their complete network solution as well.To read this article in full, please click here

0

Should security systems be the network?

Recently during a research interview with a small but fast-growing business, for the first time I encountered an organization with a “no-network-vendor” network. That is, instead of using Cisco or Dell or even a white-box solution for switching and routing, the company deployed only Fortinet equipment for its entire network. That is, every network component is part of the security infrastructure for them.They built the network this way not just to bake security into its core (a great idea in itself) but also for: ease of management: they have one tool, it manages every component ease of deployment: they have only two or three versions of each appliance, all the same except for capacity and port count ease of expansion to new locations: every site is the same as any other site of similar size They have a small stock of replacement appliances on the shelf, with which they provide rapid recovery for all locations. They could easily also consume security-operations center as-a-service, and use professional services for nearly all the rest of their network operations. In essence, their security solution could become their complete network solution as well.To read this article in full, please click here

0

8 free, cheap, and hands-on ways to learn about network administration

A diploma and certifications are great to have, but hands-on experience can take you even further than your educational accomplishments. Playing around with the technology might help you retain information better, too. So don’t just read how to do something, but actually do it.You probably don’t have a rack full of enterprise routers and switches to play around with, but there are some free and budget-friendly ways to get experience. You just need some time and eagerness to learn.Here are eight ideas to get you some of that hands-on experience with networking, starting with simpler projects and progressing to more complex ones. Some of the earlier tasks may just take just a few minutes, while others are more for a weekend project.To read this article in full, please click here

0

BrandPost: Why Retailers Value Wi-Fi and Location-Based Services for New Connected Customer Experiences

By: Todd Johnson, Director of Vertical Marketing at Juniper Networks. Delivering an exceptional customer experience has never been more challenging. Retailers need to leverage technology to embrace new consumer habits and shopping styles while also meeting their in-store expectations with enhanced and personalized experiences and an interactive physical shopping journey.To understand the emerging demands for retail customer experience, Juniper conducted two surveys: the Juniper Workplaces and Public Spaces Enterprise IT Survey and the Juniper Remote Workplaces and Public Spaces Consumer Survey.To read this article in full, please click here

0

Why is Business Intelligence Reporting Creating Technical Debt?

Technical debt describes the result of short-term development solutions that are not rigorous enough to also avoid future development burdens.

0

Return to Work’s Other Meaning: Unretirement

Faced with economic pressures and a lack of daily interactions with co-workers, some network and IT managers who recently retired are considering that other return to office, namely unretirement.

0

BGP Route Reflectors in the Forwarding Path

Bela Varkonyi left two intriguing comments on my Leave BGP Next Hops Unchanged on Reflected Routes blog post. Let’s start with:

The original RR design has a lot of limitations. For usual enterprise networks I always suggested to follow the topology with RRs (every interim node is an RR), since this would become the most robust configuration where a link failure would have the less impact.

He’s talking about the extreme case of hierarchical route reflectors, a concept I first encountered when designing a large service provider network. Here’s a simplified conceptual diagram (lines between boxes are physical links as well as IBGP sessions between loopback interfaces):

0

BGP Route Reflectors in the Forwarding Path

Bela Varkonyi left two intriguing comments on my Leave BGP Next Hops Unchanged on Reflected Routes blog post. Let’s start with:

The original RR design has a lot of limitations. For usual enterprise networks I always suggested to follow the topology with RRs (every interim node is an RR), since this would become the most robust configuration where a link failure would have the less impact.

He’s talking about the extreme case of hierarchical route reflectors, a concept I first encountered when designing a large service provider network. Here’s a simplified conceptual diagram (lines between boxes are physical links as well as IBGP sessions between loopback interfaces):

0

Researchers show techniques for malware persistence on F5 and Citrix load balancers

Tests show that deploying malware in a persistent manner on load balancer firmware is within reach of less sophisticated attackers.

0

IBM goes big on quantum-computer hardware, software

IBM has rolled out its most powerful quantum-computing system so far—the Osprey, a 433-qubit machine that supports three times more qubits than its current Eagle system, and reiterated its plan to have a 1,121-qubit processor, called Condor, out in 2023.At the IBM Quantum Summit 2022, the company also said it was continuing development of a modular quantum platform called System Two that will combine multiple processors into a single system with new communication links that IBM says will use hybrid-cloud middleware to integrate quantum and classical workflows.In addition IBM said it will continue to prototype quantum software applications for specific use cases. By 2025, IBM said, developers will be able to explore quantum machine-learning applications and more.To read this article in full, please click here

0

Researchers show techniques for malware persistence on F5 and Citrix load balancers

Tests show that deploying malware in a persistent manner on load balancer firmware is within reach of less sophisticated attackers.