Upcoming Course: How Routers Really Work

My newest course on Safari through Pearson is coming up in just a few weeks:

This training will peer into the internal components of a router, starting with an explanation of how a router switches packets. This walk through of a switching path, in turn, will be used as a foundation for explaining the components of a router, including the various tables used to build forwarding tables and the software components used to build these tables.

VPC native GKE clusters – Container native LB

This blog is last in the series on VPC native GKE clusters. In this blog, I will cover Network endpoint groups(NEG) and Container native load balancing. For the first part on GKE ip addressing, please refer here and the second part on VPC native clusters, please refer here. Container load balancing and Network endpoint groups(NEG) … Continue reading VPC native GKE clusters – Container native LB →

A10 Networks ACOS Critical Insecure Cookie Vulnerability 1 of 2

The following summarizes an HTTP persistence cookie vulnerability that I identified in A10’s ACOS ADC software. This issue was disclosed to A10 Networks in June 2016 and has since been resolved.

A10 Networks Cookie Vulnerability

This vulnerability results in information disclosure about names of service-groups and IPs of real servers, as well as the ability to manipulate the content of the cookies.

SUMMARY OF VULNERABILITY

The ACOS documentation for HTTP persistence cookies notes that “For security, address information in the persistence cookies is encrypted.” However, the address information is not “encrypted”; rather, the real server IP and port information is weakly obfuscated and is easily decoded, exposing information about the internal network. The simplicity of the obfuscation also makes it trivial to manually create a cookie which ACOS would decode and honor.

Additionally, cookies configured using the service-group command option have the service-group’s full name included in the persistence cookie as plain text. This vulnerability applies to HTTP/HTTPS VIP types that have been configured to use a cookie-based persistence template.

SOFTWARE VERSIONS TESTED

This vulnerability was discovered and validated initially in ACOS 2.7.2-P4-SP2 and reconfirmed most recently in ACOS 4.1.1-P3.

VULNERABLE VERSIONS

This behavior has been core to Continue reading

A First Look at Docker Desktop Enterprise

Delivered as part of Docker Enterprise 3.0, Docker Desktop Enterprise is a new developer tool that extends the Docker Enterprise Platform to developers’ desktops, improving developer productivity while accelerating time-to-market for new applications.

It is the only enterprise-ready Desktop platform that enables IT organizations to automate the delivery of legacy and modern applications using an agile operating model with integrated security. With work performed locally, developers can leverage a rapid feedback loop before pushing code or docker images to shared servers / continuous integration infrastructure.

\Imagine you are a developer & your organization has a production-ready environment running Docker Enterprise. To ensure that you don’t use any APIs or incompatible features that will break when you push an application to production, you would like to be certain your working environment exactly matches what’s running in Docker Enterprise production systems. This is where Docker Enterprise 3.0 and Docker Desktop Enterprise come in. It is basically a cohesive extension of the Docker Enterprise container platform that runs right on developers’ systems. Developers code and test locally using the same tools they use today and Docker Desktop Enterprise helps to quickly iterate and then produce a containerized service that is Continue reading

IPv6 Buzz 027: Making The Leap To Enterprise IPv6

Today's IPv6 Buzz podcast discusses key approaches to getting IPv6 deployed in the enterprise. Guest Enno Rey talks about how to identify quick wins, being liberal and flexible as you deploy, and more. The IPv6 crew also talks about IPv6 security, and Enno shares highlights from his recent RIPE78 presentation.

The post IPv6 Buzz 027: Making The Leap To Enterprise IPv6 appeared first on Packet Pushers.

Growing an Internet Exchange Point in Burkina Faso

BFIX, the Burkina Faso Internet exchange point, was established as an association in Burkina on February 19, 2015 by Internet Service Providers (ISP), mobile telecommunication operators, and some public institutions such as the University of Ouagadougou and the government agency in charge of promoting information and communication technologies (“Agence de Promotion des Technologies de l’Information et de la Communication – ANPTIC”).

BFIX started exchanging the first bits of data among peers on June 26, 2015, during the 11th edition of the national “Internet Week.” BFIX’s service was officially launched on July 10, 2018 as part of the West Africa Regional Communication Infrastructure Project (WARCIP) – Burkina, among other projects.

Despite the launch and the operationalization of BFIX, a number of challenges remained, mainly attributed to the implementation of IXP best practices. In particular the network design was not optimal. Moving forward, the local community, through the voice of its executive director, Millogo Jean Baptiste, reached out to the Internet Society Africa Regional Bureau for technical assistance. A training session was planned and carried out between the 14th and 18th of January 2019 in Ouagadougou under the Internet Society and Facebook IXP Partnership project.

The one-week training had two Continue reading

1 … 1,174 1,175 1,176 1,177 1,178 … 3,793