Chasing Anycast IP Addresses
One of my readers sent me this question:
My job required me to determine if one IP address is unicast or anycast. Is it possible to get this information from the bgp dump?
TL&DR: Not with anything close to 100% reliability. An academic research paper (HT: Andrea di Donato) documents a false-positive rate of around 10%.
If you’re not familiar with IP anycast: it’s a brilliant idea of advertising the same prefix from multiple independent locations, or the same IP address from multiple servers. Works like a charm for UDP (that’s how all root DNS servers are built) and supposedly pretty well across distant-enough locations for TCP (with a long list of caveats when used within a data center).
SEC 4. Complete guide for integrating Nokia, Arista, Cumulus, as well as CentOS and Raspberry PI Linux in your own PKI
Hello my friend,
In one of the previous blogposts we have share the details how you can build the containerised PKI relying Docker, Alpine Linux and OpenSSL. Today we’ll show how you can use it.
2
3
4
5
retrieval system, or transmitted in any form or by any
means, electronic, mechanical or photocopying, recording,
or otherwise, for commercial purposes without the
prior permission of the author.
How automation can increase the security?
In one of the recent articles dedicated to threats to the national security with respect to 5G caused by the current operation models in the big service providers, one the network automation were named as one of the key mitigation approaches. The reason is very simple: network automation allows you to keep (or even increase) the pace of the network changes with increasing the stability without increasing the size of your network operation teams.
We absolutely agree with this statement. We have observed ourselves that in many cases the key technical competence for service providers is being outsourced and in certain cases the service providers have to rely on the external parties to perform Continue reading
Tigera and Microsoft Extend the Power of Calico for Windows to AKS
Tigera, in collaboration with Microsoft, is thrilled to announce the public preview of Calico for Windows on Azure Kubernetes Service (AKS). While Calico has been available for self-managed Kubernetes workloads on Azure since 2018, many organizations are migrating their .NET and Windows workloads to the managed Kubernetes environment offered by AKS. Now the leading open-source Kubernetes network policy and security solution for Kubernetes enables Windows users to fulfill their policy and compliance requirements on Azure Kubernetes Service.
With the availability of Calico for Windows on AKS in public preview, enterprises can leverage the power and simplicity of Calico to enable a single solution that provides uniform Kubernetes network policy and security for their clusters across AKS, other clouds and on-premises, as well as across their choice of Windows, Linux, and mixed-node environments.
Project Calico is the most widely adopted open-source solution for Kubernetes networking and security, used on more than 1 million nodes across 166 countries. However, thousands of our users want to be sure that choosing Calico is the right decision for many years to come. Calico is the only solution that offers a pluggable data plane supporting Windows, standard Linux and eBPF, thus future-proofing their decision Continue reading
Why AI is Eating Networking
Networking teams are just starting their AIOps journey. In the next five years, AI assistants will be considered integral members.Betting On Virtual Events In A Post-Covid World
In-person events will return some day. In the meantime, a huge crop of tech companies and investors are betting that virtual events can thrive not just during a pandemic, but beyond.
The post Betting On Virtual Events In A Post-Covid World appeared first on Packet Pushers.
Cloudflare recognized as a ‘Leader’ in The Forrester Wave for DDoS Mitigation Solutions
We’re thrilled to announce that Cloudflare has been named a leader in The Forrester WaveTM: DDoS Mitigation Solutions, Q1 2021. You can download a complimentary copy of the report here.
According to the report, written by, Forrester Senior Analyst for Security and Risk, David Holmes, “Cloudflare protects against DDoS from the edge, and fast… customer references view Cloudflare’s edge network as a compelling way to protect and deliver applications.”
Unmetered and unlimited DDoS protection for all
Cloudflare was founded with the mission to help build a better Internet — one where the impact of DDoS attacks is a thing of the past. Over the last 10 years, we have been unwavering in our efforts to protect our customers’ Internet properties from DDoS attacks of any size or kind. In 2017, we announced unmetered DDoS protection for free — as part of every Cloudflare service and plan including the Free plan — to make sure every organization can stay protected and available.
Thanks to our home-grown automated DDoS protection systems, we’re able to provide unmetered and unlimited DDoS protection for free. Our automated systems constantly analyze traffic samples asynchronously as to avoid impact to performance. They scan for Continue reading
HTTP Protocol, Web Page Waterfalls and Complexity
One aspect of networking is that some understanding of the protocols using the network is required. As HTTPS replaces nearly all other protocols I would suggest that everyone needs a working understanding of how a web page is fetched by a web browser. WebPageTest is a community tool that reads web pages and then displays […]
How to execute an object file: Part 1
Calling a simple function without linking
When we write software using a high-level compiled programming language, there are usually a number of steps involved in transforming our source code into the final executable binary:
First, our source files are compiled by a compiler translating the high-level programming language into machine code. The output of the compiler is a number of object files. If the project contains multiple source files, we usually get as many object files. The next step is the linker: since the code in different object files may reference each other, the linker is responsible for assembling all these object files into one big program and binding these references together. The output of the linker is usually our target executable, so only one file.
However, at this point, our executable might still be incomplete. These days, most executables on Linux are dynamically linked: the executable itself does not have all the code it needs to run a program. Instead it expects to "borrow" part of the code at runtime from shared libraries for some of its functionality:
This process is called runtime linking: when our executable is being started, the operating system will invoke the dynamic Continue reading
Impact of Azure Subnets on High Availability Designs
Now that you know all about regions and availability zones (AZ) and the ways AWS and Azure implement subnets, let’s get to the crux of the original question Daniel Dib sent me:
As I understand it, subnets in Azure span availability zones. Do you see any drawback to this? You mentioned that it’s difficult to create application swimlanes that way. But does subnet matter if your VMs are in different AZs?
It’s time I explain the concepts of application swimlanes and how they apply to availability zones in public clouds.
Impact of Azure Subnets on High Availability Designs
Now that you know all about regions and availability zones (AZ) and the ways AWS and Azure implement subnets, let’s get to the crux of the original question Daniel Dib sent me:
As I understand it, subnets in Azure span availability zones. Do you see any drawback to this? You mentioned that it’s difficult to create application swimlanes that way. But does subnet matter if your VMs are in different AZs?
It’s time I explain the concepts of application swimlanes and how they apply to availability zones in public clouds.
VPC peering with terraform
I wrote up an example of using terraform modules and provider aliases to turn up interconnected cloud resources (vpcs / vpc peering / peering acceptance / routes) across multiple cloud regions.
New Year, New Name: Insights Platform Is Now Internet Society Pulse
In order to align better with the Internet Society’s brand strategy, and to further differentiate our platform from other products with similar names, we have decided to rename our measurement platform.
As of 1 March, 2021, Insights will be known as Internet Society Pulse.
The new URL is: https://pulse.internetsociety.org/
A redirect will be implemented so that anyone navigating to the previous URL will be automatically taken to Internet Society Pulse.
And, if you follow us on Twitter, you’ll see that our handle has been changed from @isoc_insights to @isoc_pulse.
The platform’s look and feel will not change.
Looking Ahead
We launched Insights in early December 2020 and are extremely proud of the impact that the platform has had in just three short months. We’re looking forward to ramping up the platform further in 2021 and will be adding three new focus areas throughout the year:
- Internet Resilience
- The Internet Way of Networking
- Keeping Traffic Local
In 2021, we’ll also expand our analysis and reporting offerings, increase our engagement with the Internet measurements community, bring on board more data partners and add new features to the platform.
Stay up to date by signing up to our mailing list and Continue reading
Attend Future:NET 2021 – A Premier Networking Event
What is Future:NET?
Sponsored by VMware, Future:NET 2021 is the premier thought leadership event on networking of the year. Scheduled for March 23 in AMER and March 24 in EMEA and APJ, the event will be simulcast live around the world—showcasing authentic, in-depth discussions led by the who’s-who of networking leaders. Come prepared to hear open, honest, and sometimes lively conversations about the future direction of networking.
How is Future:NET 2021 Different from Previous Years?
Future:NET has always been an invite-only, in-person event held during VMworld U.S. This year, we are taking it to the next level with a virtual format that will be broadcast live to a global audience on a new, interactive online platform. This will preserve the intimate, authentic feel of past events while allowing participants to share valuable insights with change agents around the world.
Why Attend Future:NET?
Future:NET is a different kind of industry event. While other networking conferences have been reduced to vendor showcases, Future:NET disallows product pitches in favor of open debates that foster in-depth conversation among professionals across the industry. This will not be a VMware showcase or a think tank. Future:NET is a vendor-agnostic industry event led by those who have forecasted, created, or disseminated change and who are lured by new technology and its ability to transform the world. Hear from luminaries such as Albert Greenberg from Azure, Bikash Koley from Google Cloud, Nick McKeown of Stanford University, Pere Monclus from VMware, and Vijoy Pandey from Continue reading
Rethinking BGP on the DC Fabric (part 5)
BGP is widely used as an IGP in the underlay of modern DC fabrics. This series argues this is not the best long-term solution to the problem of routing in fabrics because BGP is not ideal for this use case. This post will consider the potential harm we are doing to the larger Internet by pressing BGP into a role it was not originally designed to fulfill—an underlay protocol or an IGP.
My last post described the kinds of configuration required to make BGP work on a DC fabric—it turns out that the configuration of each BGP speaker on the fabric is close to unique. It is possible to automate configuring each speaker—but it would be better if we could get closer to autonomic operation.
To move BGP closer to autonomic operation in a DC fabric, there are several things we can do. First, we can allow a BGP speaker to peer with any other BGP speaker it receives an open message from—this is often called promiscuous mode. While each router in the fabric will still need to be configured with the right autonomous system, at least we won’t need to configure the correct peers on each router (including the Continue reading