Hedge 124: Geoff Huston and the State of BGP

Another year of massive growth in the number and speed of connections to the global Internet—what is the impact on the global routing table? Goeff Huston joins Donald Sharp and Russ White to discuss the current state of the BGP table, the changes in the last several years, where things might go, and what all of this means. This is part two of a two part episode.

download

Understanding Data Center Fabrics 09: Other Considerations – Video

In the final video of this series on data center fabrics, Russ White walks through a set of considerations you might want to ponder as you design your data center fabric. These considerations include whether to single-home or dual-home a server in a fabric (it depends!), why Russ isn’t a fan of MLAGs in a […]

The post Understanding Data Center Fabrics 09: Other Considerations – Video appeared first on Packet Pushers.

BGP Policies (Part 3)

At the most basic level, there are only three BGP policies: pushing traffic through a specific exit point; pulling traffic through a specific entry point; preventing a remote AS (more than one AS hop away) from transiting your AS to reach a specific destination. In this series I’m going to discuss different reasons for these kinds of policies, and different ways to implement them in interdomain BGP.

There are many reasons an operator might want to select which neighboring AS through which to send traffic towards a given reachable destination (for instance, 100::/64). Each of these examples assumes the AS in question has learned multiple paths towards 100::/64, one from each peer, and must choose one of the two available paths to forward along.

In the following network—

From AS65001’s perspective

Assume AS65001 is some form of content provider, which means it offers some service such as bare metal compute, cloud services, search engines, social media, etc. Customers from AS65006 are connecting to its servers, located on the 100::/64 network, which generates a large amount of traffic returning to the customers.
From the perspective of AS hops, it appears the path from AS65001 to AS65006 is the same length—if this Continue reading

Understanding Data Center Fabrics 08: Advanced Underlay Control Planes – Video

In this video, Russ White examines two advanced options for your underlay control plane: distoptflood and RIFT. He explores the basics of distopflood and RIFT, optimizations in distoptflood, centralized flooding, how RIFT works, and more. You can subscribe to the Packet Pushers’ YouTube channel for more videos as they are published. It’s a diverse a […]

The post Understanding Data Center Fabrics 08: Advanced Underlay Control Planes – Video appeared first on Packet Pushers.

Understanding Data Center Fabrics 07: Link State Protocol In The Underlay – Video

Episode seven continues a discussion of fabric underlays by looking at the use of link-state protocols instead of BGP. Network architect and author Russ White covers: -Which link state protocol (IS-IS or OSPF) to choose -Russ’s reasons for preferring IS-IS -IS-IS efficiencies for packet formats and autoconfiguration -Resource recommendations for learning IS-IS -Scale and flooding […]

The post Understanding Data Center Fabrics 07: Link State Protocol In The Underlay – Video appeared first on Packet Pushers.

Understanding Data Center Fabrics 06: BGP Underlay – Video

The sixth video in this series examines the underlay component of a data center fabric, touches on a theoretical discussion of network layers, and reviews the use of BGP as your underlay protocol. Russ White covers: -The notion of abstractions in a network and how they limit failure domains -Tradeoffs among surface, state, and optimization […]

The post Understanding Data Center Fabrics 06: BGP Underlay – Video appeared first on Packet Pushers.

Weekend Reads 032522

A Chinese national was recently caught entering China with 160 Intel processors strapped to his body, an act that customs officials amount to smuggling.

In 2022, Facebook has 2.91 billion active users, making it the most-used social media platform. But to me, it will always pale in comparison to early MySpace.

As a CSIRT consultant, I cannot overemphasize the importance of effectively managing the first hour in a critical incident.

A few weeks ago, $3.6 billion in bitcoin was seized from a Manhattan couple who were arrested and charged with money laundering in connection with a 2016 hack on the Hong Kong cryptocurrency exchange Bitfinex. It was the largest financial seizure in the Justice Department’s history.

In a low-light Culver City control room, Lily Shaw is getting her pilot mood on.

This is not the first war in the digital age. But the role played by digital technologies and tech companies in the conflict is in many ways unprecedented.

Economic Denial of Sustainability (EDoS) is a cybersecurity threat targeting cloud environments. EDoS attacks exploit the elasticity of clouds, particularly auto-scaling capabilities, to inflate the billing of a cloud user until the account reaches bankruptcy or large-scale service withdrawal.

Continue reading

Understanding Data Center Fabrics 05: Butterfly Scaling – Video

Episode of this series focuses on the butterfly fabric. While similar to a Clos fabric, the butterfly design is built around pods of switches. In this video, Russ White explains the differences in the butterfly design, physical limitations for ToR switches, how to scale the fabric to thousands of available ports without using chassis switches, […]

The post Understanding Data Center Fabrics 05: Butterfly Scaling – Video appeared first on Packet Pushers.

Hedge 123: Geoff Huston and the State of BGP

Another year of massive growth in the number and speed of connections to the global Internet—what is the impact on the global routing table? Goeff Huston joins Tom Ammon and Russ White to discuss the current state of the BGP table, the changes in the last several years, where things might go, and what all of this means. This is part 1 of a two part episode.

download

Understanding Data Center Fabrics 04: Clos Scaling – Video

In the fourth installment of this 9-video series, Russ White describes methods for scaling data center fabrics. He reviews how to calculate port density in a leaf-spine design, discusses physical restraints on the scale of a fabric based on the spines, fabric types in chassis switches, and the pros and cons of chassis vs. single […]

The post Understanding Data Center Fabrics 04: Clos Scaling – Video appeared first on Packet Pushers.

Understanding Data Center Fabrics 03: Characteristics Of Data Center Fabrics – Video

In the third installment of this 9-video series, Russ White clarifies exactly what a fabric is, complete with drawings, animations, and live illustrations. From there, you’ll be able to determine what is and is not a fabric. In this lesson, Russ also walks through traffic patterns, tiers, and bandwidth between tiers in data center fabrics. […]

The post Understanding Data Center Fabrics 03: Characteristics Of Data Center Fabrics – Video appeared first on Packet Pushers.

Understanding Data Center Fabrics 02: Clos Fabric History – Video

In the second part of this 9-video series, Russ White describes crossbar fabrics and how they interconnect, using historical telephone networks as an example. He jumps from this to help you understand what’s going on inside of data center fabrics, including Clos architectures. Other details Russ touches on include non-blocking fabrics, how an undertaker impacted […]

The post Understanding Data Center Fabrics 02: Clos Fabric History – Video appeared first on Packet Pushers.

DC Fabric Webinar

Sorry for the short notice … I’m teaching a three-hour webinar on DC fabrics and control planes this coming Friday, the 25th, through Safari Books Online. This course covers the basics of spine-and-leaf fabrics, as well as some high level information on various DC fabric control plane options (BGP, RIFT, and IS-IS). Please register here.

Controversial Reads 031922

If you work in advertising or marketing, you’re probably aware of Apple’s privacy efforts over the last year. Apple now requires apps ask customers if they want to ‘opt-in’ to allow behavioral data tracking.

Among gamers and parents and even within the medical community, there’s disagreement about whether gaming addiction is real.

When discussing our relationship with technology, for whatever reason—whether it’s due to aimless maximum engagement algorithms, the ruthless economic incentive structure of the global market, or just our own sheer inability to think critically in the face of incessant propaganda—we’re led to believe that there are only two possible paths from here: 1. Integration with Technology or 2. Luddism.

I was struck by how easily he assumes that large doses of data, math, and computing power make computers smarter than humans. He is hardly alone, but he is badly mistaken.

When Shiri Melumad was working on her doctorate in 2012, she found herself reaching for her smartphone during moments of stress, before a tough exam, for example. She didn’t always use it, she just held it. It was comforting.

There is an estimated $12 billion market of companies that buy and sell location data collected from your cellphone. Continue reading

Weekend Reads 031722

We should instead be choosing authentication processes that appropriately match site risks; using a password should be the last thing you want to rely on.

Public companies would have to report material cybersecurity incidents no later than four business days after they occur if a rule proposed by the Securities and Exchange Commission (SEC) on Wednesday takes effect.

Researchers have disclosed a new technique that could be used to circumvent existing hardware mitigations in modern processors from Intel, AMD, and Arm, and stage speculative execution attacks such as Spectre to leak sensitive information from host memory.

The directive was accompanied by a catalog of known exploited vulnerabilities maintained by CISA that includes mandatory remediation deadlines. Essentially, it means “fix these fast or else” for applicable agencies and organizations.

Just being aware of surveillance has chilling effects in how we exercise speech, which is often under attack by all sorts of actors from criminals to our own governments.

Threat actors have been observed abusing a high-impact reflection/amplification method to stage sustained distributed denial-of-service (DDoS) attacks for up to 14 hours with a record-breaking amplification ratio of 4,294,967,296 to 1.

Since its birth, Yara has become a common ground to exchange threat Continue reading

Hedge 122: The Internet Architecture Board

What is the Internet Architecture Board (IAB) of the IETF? What role does the IAB play in the larger ecosystem of building and deploying standard protocols? In this episode of the Hedge, Tom and Ethan “flip roles” with Russ to ask these questions.

download

BGP Policies (Part 2)

At the most basic level, there are only three BGP policies: pushing traffic through a specific exit point; pulling traffic through a specific entry point; preventing a remote AS (more than one AS hop away) from transiting your AS to reach a specific destination. In this series I’m going to discuss different reasons for these kinds of policies, and different ways to implement them in interdomain BGP.

There are many reasons an operator might want to select which neighboring AS through which to send traffic towards a given reachable destination (for instance, 100::/64). Each of these examples assumes the AS in question has learned multiple paths towards 100::/64, one from each peer, and must choose one of the two available paths to forward along.

In the following network—

From AS65004’s perspective…

Transit providers primarily choose the most optimal exit from their AS to reduce the amount of peering settlement they are paying by using and maintaining settlement-free peering where possible and reducing the amount of time and distance traffic is carried through their network (through hot potato routing, discussed in more detail below).
If, for instance, AS65004 has a paid peering relationship with AS65002, and a contract with AS65003 which Continue reading

Weekend Reads 031122

The big ISPs all lobbied hard against the net neutrality rules, but the CEO of every big ISP was on the record at least once saying that the net neutrality rules were not a big deal and that they could live with net neutrality. So why did the big carriers lobby so hard about what the FCC was doing?

VESA, which makes the DisplayPort spec, today announced a certification program aimed at helping consumers understand if a DisplayPort 2.0 cable, monitor, or video source can support the max refresh rates and resolutions the spec claims.

Over the past week, the Akamai researchers said, they have detected multiple DDoSes that used middleboxes precisely the way the academic researchers predicted. The attacks peaked at 11Gbps and 1.5 million packets per second.

The metaverse, as Microsoft Corp. and Facebook parent Meta Platforms Inc. would have us call it, raises a remarkable prospect: For the first time, all of the technology giants are going to compete over the same turf.

A group of academics from the North Carolina State University and Dokuz Eylul University have demonstrated what they say is the “first side-channel attack” on homomorphic encryption that could be exploited to Continue reading

Hedge 121: Computing in the Network with Marie-Jose Montpetit

Can computation be drawn into the network, rather than always being pushed to the edge of the network? Taking content distribution networks as a starting point, the COIN research group is looking at ways to make networks more content and computationally aware, bringing compute into the network itself. Join Alvaro Retana, Marie-Jose Montpetit, and Russ White, as we discuss the ongoing research around computing in the network.

download

BGP Policies (part 1)

At the most basic level, there are only three BGP policies: pushing traffic through a specific exit point; pulling traffic through a specific entry point; preventing a remote AS (more than one AS hop away) from transiting your AS to reach a specific destination. In this series I’m going to discuss different reasons for these kinds of policies, and different ways to implement them in interdomain BGP.

In the following network—

There are many reasons an operator might want to select which neighboring AS through which to send traffic towards a given reachable destination (for instance, 100::/64). Each of these examples assumes the AS in question has learned multiple paths towards 100::/64, one from each peer, and must choose one of the two available paths to forward along.

Examining this from AS65006’s Perspective …

Assuming AS65006 is an edge operator (commonly called enterprise, but generally just originating and terminating traffic, and never transiting traffic), there are several reasons the operator may prefer one exit point (through an upstream provider), including:

• An automated system may determine AS65004 has some sort of brownout; in this case, the operator at 65006 has configured the system to prefer the exit through AS65005
• The traffic Continue reading