Comparing Forwarding Performance of Data Center Switches
One of my subscribers is trying to decide whether to buy an -EX or an -FX version of a Cisco Nexus data center switch:
I was comparing Cisco Nexus 93180YC-FX and Nexus 93180YC-EX. They have the same port distribution (48x 10/25G + 6x40/100G), 3.6 Tbps switching capacity, but the -FX version has just 1200 Mpps forwarding rate while EX version goes up to 2600 Mpps. What could be the reason for the difference in forwarding performance?
Both switches are single-ASIC switches. They have the same total switching bandwidth, thus it must take longer for the FX switch to forward a packet, resulting in reduced packet-per-seconds figure. It looks like the ASIC in the -FX switch is configured in more complex way: more functionality results in more complexity which results in either reduced performance or higher cost.
Comparing Forwarding Performance of Data Center Switches
One of my subscribers is trying to decide whether to buy an -EX or an -FX version of a Cisco Nexus data center switch:
I was comparing Cisco Nexus 93180YC-FX and Nexus 93180YC-EX. They have the same port distribution (48x 10/25G + 6x40/100G), 3.6 Tbps switching capacity, but the -FX version has just 1200 Mpps forwarding rate while EX version goes up to 2600 Mpps. What could be the reason for the difference in forwarding performance?
Both switches are single-ASIC switches. They have the same total switching bandwidth, thus it must take longer for the FX switch to forward a packet, resulting in reduced packet-per-seconds figure. It looks like the ASIC in the -FX switch is configured in more complex way: more functionality results in more complexity which results in either reduced performance or higher cost.
Network Centrality and Robustness
Introduction
A system is robust if the failure of some components doesn’t affect its function. As network engineers, we face various types of network failures like link, node failures all the time.
Generally, we use various Network modeling tools like Cariden(WAE), WANDL, etc. to model failures and see how the network reacts under a given failure condition. The components which are in play are:
- Type and Number of failures. Type: Link, Node. Number of Failures: Single or Double.
- Routing protocols running on top of the network and there reaction to the failure. Example: RSVP-TE, Pure IGP, SR-TE etc.
- Network flows and their volume.
- Network Topology.
In this blog post, we will focus purely on #4 Network topology and certain characteristics of topology, which may make them more robust than other topologies.
Key Idea
The network topology may have some critical nodes. If we can identify them and take them out of the service, they will significantly impact the functionality of the network. For example, in the case of a Hub and Spoke topology, if a Hub is out of service, it affects all the spokes vs. a spoke out of service. We can make this hub and spoke topology more Continue reading
pygnmi 11. Measuring Automated Testing with Coverage.py and Pytest
Hello my friend,
It is been a while since we posted our last blogpost, which was touching Infrastructure aspects of building Multi Server Cloud with ProxMox. After summer break we continue our blogging and developing activities at Karneliuk.com. Today we’ll show some backstage of the software development of the pygnmi.
2
3
4
5
retrieval system, or transmitted in any form or by any
means, electronic, mechanical or photocopying, recording,
or otherwise, for commercial purposes without the
prior permission of the author.
What is Automation? Network Automation?
In a nutshell, Automation and Network Automation are just subset of tasks from a broader topic called Software Development. With the move of the world towards Industry 4.0, the digital economy growth and others, all sort of applications are becoming more widely used. In order you create a history, and not being a part of that in the past, you shall know the principles of software development and be able to create applications yourselves. Sounds complicated? It may be, indeed. However, with our Network Automation Training you definitely will have a break-through in the software development world.
At our Continue reading
Getting Blasted by Backdoors
I wanted to take minute to talk about a story I’ve been following that’s had some new developments this week. You may have seen an article talking about a backdoor in Juniper equipment that caused some issues. The issue at hand is complicated at the linked article does a good job of explaining some of the nuance. Here’s the short version:
- The NSA develops a version of Dual EC random number generation that includes a pretty substantial flaw.
- That flaw? If you know the pseudorandom value used to start the process you can figure out the values, which means you can decrypt any traffic that uses the algorithm.
- NIST proposes the use of Dual EC and makes it a requirement for vendors to be included on future work. Don’t support this one? You don’t get to even be considered.
- Vendors adopt the standard per the requirement but don’t make it the default for some pretty obvious reasons.
- Netscreen, a part of Juniper, does use Dual EC as part of their default setup.
- The Chinese APT 5 hacking group figures out the vulnerability and breaks into Juniper to add code to Netscreen’s OS.
- They Continue reading
Heavy Networking 596: Weaponizing Firewalls And Middleboxes For DDoS Attacks
Today's Heavy Networking podcast dives into academic research on DDoS attack techniques. Our guests have published a paper about how the TCP protocol and middleboxes such as firewalls can be weaponized by bad actors and used in reflective amplification attacks. We discuss technical details, how they performed this research, potential countermeasures, and more.
The post Heavy Networking 596: Weaponizing Firewalls And Middleboxes For DDoS Attacks appeared first on Packet Pushers.
Heavy Networking 596: Weaponizing Firewalls And Middleboxes For DDoS Attacks
Today's Heavy Networking podcast dives into academic research on DDoS attack techniques. Our guests have published a paper about how the TCP protocol and middleboxes such as firewalls can be weaponized by bad actors and used in reflective amplification attacks. We discuss technical details, how they performed this research, potential countermeasures, and more.Video: Introduction to Network Addressing
A friend of mine pointed out this quote by John Shoch when I started preparing the Network Stack Addressing slide deck for my How Networks Really Work webinar:
The name of a resource indicates what we seek, an address indicates where it is, and a route tells us how to get there.
You might wonder when that document was written… it’s from January 1978. They got it absolutely right 42 years ago, and we completely messed it up in the meantime with the crazy ideas of making IP addresses resource identifiers.
Video: Introduction to Network Addressing
A friend of mine pointed out this quote by John Shoch when I started preparing the Network Stack Addressing slide deck for my How Networks Really Work webinar:
The name of a resource indicates what we seek, an address indicates where it is, and a route tells us how to get there.
You might wonder when that document was written… it’s from January 1978. They got it absolutely right 42 years ago, and we completely messed it up in the meantime with the crazy ideas of making IP addresses resource identifiers.
Exploring the Future of Enterprise Desktop Management
New desktop-as-a-service platforms like Windows 365 provide a glimpse into the future of enterprise desktop management.HS010 Budgeting for Cybersecurity
When it comes to allocating budget for cybersecurity there are many approaches to breaking it down into line items. We discuss various ideas and possibilities that might offer some insight for your own situation.
The post HS010 Budgeting for Cybersecurity appeared first on Packet Pushers.
HS010 Budgeting for Cybersecurity
When it comes to allocating budget for cybersecurity there are many approaches to breaking it down into line items. We discuss various ideas and possibilities that might offer some insight for your own situation.
Quick Tunnels: Anytime, Anywhere
My name is Rishabh Bector, and this summer, I worked as a software engineering intern on the Cloudflare Tunnel team. One of the things I built was quick Tunnels and before departing for the summer, I wanted to write a blog post on how I developed this feature.
Over the years, our engineering team has worked hard to continually improve the underlying architecture through which we serve our Tunnels. However, the core use case has stayed largely the same. Users can implement Tunnel to establish an encrypted connection between their origin server and Cloudflare’s edge.
This connection is initiated by installing a lightweight daemon on your origin, to serve your traffic to the Internet without the need to poke holes in your firewall or create intricate access control lists. Though we’ve always centered around the idea of being a connector to Cloudflare, we’ve also made many enhancements behind the scenes to the way in which our connector operates.
Typically, users run into a few speed bumps before being able to use Cloudflare Tunnel. Before they can create or route a tunnel, users need to authenticate their unique token against a zone on their account. This means in order to simply Continue reading