D2C221: KubeConversations Part 2 – Building Cloud Platforms
Ned Bellavance continues his KubeCon conversations with Akamai about cloud-native design and its impact on cloud architecture, Acorn Labs about building a cloud platform, F5 about the networking side of platform engineering, and the startup Chkk about platform engineering and managing Kubernetes.
The post D2C221: KubeConversations Part 2 – Building Cloud Platforms appeared first on Packet Pushers.
D2C221: KubeConversations Part 2 – Building Cloud Platforms
Welcome to part 2 of my KubeConversations. I spent two days in the Windy City attending KubeCon Cloud Native Con Chicago. I had the opportunity to speak to a wide array of vendors and open source maintainers about what’s going on in the cloud native ecosystem. From those conversations, I picked up on some major... Read more »Why Do We Need BGP Identifiers?
A friend of mine sent me an interesting question along these lines:
We all know that in OSPF, the router ID is any 32-bit number, not necessarily an IP address of an interface. The only requirement is that it must be unique throughout the OSPF domain. However, I’ve always wondered what the role of BGP router ID is. RFC 4271 says it should be set to an IP address assigned to that BGP speaker, but where do we use it?
Also, he observed somewhat confusing behavior in the wild:
Take two routers and configure the same BGP identifier on both. Cisco IOS will not establish a session, while IOS XR and Junos will.
I decided to take the challenge and dug deep into the bowels of RFC 4271 and RFC 6286. Here’s what I brought back from that rabbit hole:
Why Do We Need BGP Identifiers?
A friend of mine sent me an interesting question along these lines:
We all know that in OSPF, the router ID is any 32-bit number, not necessarily an IP address of an interface. The only requirement is that it must be unique throughout the OSPF domain. However, I’ve always wondered what the role of BGP router ID is. RFC 4271 says it should be set to an IP address assigned to that BGP speaker, but where do we use it?
Also, he observed somewhat confusing behavior in the wild:
Take two routers and configure the same BGP identifier on both. Cisco IOS will not establish a session, while IOS XR and Junos will.
I decided to take the challenge and dug deep into the bowels of RFC 4271 and RFC 6286. Here’s what I brought back from that rabbit hole:
Call the Routing Police!
There is a continual strewam of routing anomalies that are seen in today's Internet. Some are the result of operational mishaps, some are malicious and deliberate, but all of them have some impact. The latest routing mishap in Australia affected some 10 million customers when all their services, including telephony, IP, mobiles and fixed services all stopped. How can we enforce a set of requirements for service operators to do a better job? Where's the Routing Police to chase down these incidents and find out where poor operational practices are compromising the stability of the public Internet?Is Your Infrastructure Ready? What You Need to Know Ahead of an AI Investment
Modernizing the enterprise architecture is a critical path on the journey to becoming a digital, AI, and data-driven business.Workers AI Update: Hello Mistral 7B
This post is also available in Deutsch.
Today we’re excited to announce that we’ve added the Mistral-7B-v0.1-instruct to Workers AI. Mistral 7B is a 7.3 billion parameter language model with a number of unique advantages. With some help from the founders of Mistral AI, we’ll look at some of the highlights of the Mistral 7B model, and use the opportunity to dive deeper into “attention” and its variations such as multi-query attention and grouped-query attention.
Mistral 7B tl;dr:
Mistral 7B is a 7.3 billion parameter model that puts up impressive numbers on benchmarks. The model:
- Outperforms Llama 2 13B on all benchmarks
- Outperforms Llama 1 34B on many benchmarks,
- Approaches CodeLlama 7B performance on code, while remaining good at English tasks, and
- The chat fine-tuned version we’ve deployed outperforms Llama 2 13B chat in the benchmarks provided by Mistral.
Here’s an example of using streaming with the REST API:
curl -X POST \
“https://api.cloudflare.com/client/v4/accounts/{account-id}/ai/run/@cf/mistral/mistral-7b-instruct-v0.1” \
-H “Authorization: Bearer {api-token}” \
-H “Content-Type:application/json” \
-d '{ “prompt”: “What is grouped query attention”, “stream”: true }'
API Response: { response: “Grouped query attention is a technique used in natural language processing (NLP) and machine learning Continue readingIs BGP TTL Security Any Good?
After checking what routers do when they receive a TCP SYN packet from an unknown source, I couldn’t resist checking how they cope with TCP SYN packets with too-low TTL when using TTL security, formally known as The Generalized TTL Security Mechanism (GTSM) defined in RFC 5082.
TL&DR: Not bad: most devices I managed to test did a decent job.
Is BGP TTL Security Any Good?
After checking what routers do when they receive a TCP SYN packet from an unknown source, I couldn’t resist checking how they cope with TCP SYN packets with too-low TTL when using TTL security, formally known as The Generalized TTL Security Mechanism (GTSM) defined in RFC 5082.
TL&DR: Not bad: most devices I managed to test did a decent job.
NB456: China Flexes Tech Muscles With 1.2Tb Backbone; Will CISOs Mitigate Risk Or Liability?
China demonstrates the strength of its home-grown technology industry by announcing a 1.2Tbit Internet backbone that stretches 3,000 kilometers, Fortinet warns of a 9.8 severity bug in its SIEM product, and we continue our ongoing discussion about the precarious role of the CISO, plus more tech news, in this episode of the Network Break podcast.
The post NB456: China Flexes Tech Muscles With 1.2Tb Backbone; Will CISOs Mitigate Risk Or Liability? appeared first on Packet Pushers.
NB456: China Flexes Tech Muscles With 1.2Tb Backbone; Will CISOs Mitigate Risk Or Liability?
China demonstrates the strength of its home-grown technology industry by announcing a 1.2Tbit Internet backbone that stretches 3,000 kilometers, Fortinet warns of a 9.8 severity bug in its SIEM product, and Nvidia and Dell roll out ready-made models and infrastructure for enterprises to build their own generative AI apps. HPE Aruba Networking releases a new... Read more »Zscaler Study Finds Companies are Rushing Towards Generative AI Without Considering the Risks
The research underlines the urgency for businesses to balance the potential of gen AI tools with effective security strategies to ensure safe usage of this emerging technology.2024, the year of elections
2024 is a year of elections, with more than 70 elections scheduled in 40 countries around the world. One of the key pillars of democracy is trust. To that end, ensuring that the Internet is trusted, secure, reliable, and accessible for the public and those working in the election space is critical to any free and fair election.
Cloudflare has considerable experience in gearing up for elections and identifying how our cyber security tools can be used to help vulnerable groups in the election space. In December 2022, we expanded our product set to include Zero Trust products to assist these groups against new and emerging threats. Over the last few years, we’ve reported on our work in protecting a range of election entities and as we prepare for the 2024 elections, we want to provide insight into attack trends we’ve seen against these groups to understand what to expect in the next year.
For this blog post, we identified cyber attack trends for a variety of groups in the elections space based in the United States, as many of our Cloudflare Impact projects provide services to these groups. These include U.S. state and local government websites protected under Continue reading
VXLAN/EVPN Layer-3 Handoff (L3Out) on Arista EOS
A while ago, I published a blog post describing how to establish a LAN/WAN L3 boundary in VXLAN/EVPN networks using Cisco NX-OS. At that time, I promised similar information for Arista EOS. Here it is, coming straight from Massimo Magnani. The useful part of what follows is his; all errors were introduced during my editing process.
In the cases I have dealt with so far, implementing the LAN-WAN boundary has the main benefit of limiting the churn blast radius to the local domain, trying to impact the remote ones as little as possible. To achieve that, we decided to go for a hierarchical solution where you create two domains, local (default) and remote, and maintain them as separate as possible.
VXLAN/EVPN Layer-3 Handoff (L3Out) on Arista EOS
A while ago, I published a blog post describing how to establish a LAN/WAN L3 boundary in VXLAN/EVPN networks using Cisco NX-OS. At that time, I promised similar information for Arista EOS. Here it is, coming straight from Massimo Magnani. The useful part of what follows is his; all errors were introduced during my editing process.
In the cases I have dealt with so far, implementing the LAN-WAN boundary has the main benefit of limiting the churn blast radius to the local domain, trying to impact the remote ones as little as possible. To achieve that, we decided to go for a hierarchical solution where you create two domains, local (default) and remote, and maintain them as separate as possible.
Weekend Reads 111923
Bad queries tend to propagate to the root zone due to the hierarchical nature of DNS, so studying traffic at a root server can provide key insights into overall network usage.
This blog covers an interesting case of suspected abuse in a gTLD registry between February and April 2023.
Gartner has raised the specter of departments outside of tech running their own IT Continue reading
AX.25 and 9600bps G3RUH decoding
I’ve been coding more on my rust SDR framework, and want to improve my ability to send/receive data packets efficiently and reliably.
There are two main ways I use learn to do this better: designing a new protocol, and making the best implementation possible for an existing one. This post is about refining the latter.
AX.25 and APRS
First a detour, or background.
AX.25 is the standard amateur radio data protocol. It’s mostly an OSI layer 2-4 protocol, mashing the layers together into one. Contrast this with IP, which just encapsulates the next layer.
Layer 3 (IP stack equivalent: IP itself) consists of the ability to
add, in addition to source and destination, a variable number of
intermediate repeaters. This allows limited source routing. In APRS
the repeaters are usually not named, but instead uses “virtual” hops
like WIDE1-1.
Layer 4 (IP stack equivalent: TCP and UDP) allows both connected and disconnected communication channels. In my experience connected AX.25 works better over slow simplex radio than TCP. If TCP was ever optimized for high delay low bandwidth, it’s not anymore.
For the physical layer, there are three main “modems”:
-
300 baud bell 103, used Continue reading
SDR transmit and clean signals
If you have a transmit capable SDR, you may have heard that you need to filter its output, before transmitting to the world. Certainly before amplifying the signal.
I have a TinySA Ultra spectrum analyzer, and will here show you some screenshots about just how true that is.
I tested this with my USRP B200, transmitting a pure carrier around 145MHz and 435MHz.
Oh, and a word of caution: If you want to replicate this, make sure to add an inline attenuator, to not damage your spectrum analyzer. I had a cheap 40dB one, but the values in the graphs have been adjusted to show the real signal strength, as if I hadn’t.
tl;dr
- Harmonics can be almost as strong as the fundamental. You need to filter these.
- Transmitting at maximum output gain may cause lots of unwanted signals right around your fundamental. You cannot filter these. You need to not generate them.
Harmonics
Reducing the output gain did not meaningfully fix the problem. The best I saw from using half output gain was to make the strongest harmonic 9dB less than the fundamental. That’s way too strong.
I added a cheap band pass filter (FBP-144), which made Continue reading
HN710: The Future Of Networking With Brad Casemore – Part 2
Analyst Brad Casemore offers his takes on the rise of zero trust, the influence of geopolitics on IT, what's driving the need for visibility and observability on prem and in the cloud, and whether 5G will ever live up to the hype.
The post HN710: The Future Of Networking With Brad Casemore – Part 2 appeared first on Packet Pushers.