Spectrum for UDP: DDoS protection and firewalling for unreliable protocols

Spectrum for UDP: DDoS protection and firewalling for unreliable protocols

Today, we're announcing Spectrum for UDP. Spectrum for UDP works the same as Spectrum for TCP: Spectrum sits between your clients and your origin. Incoming connections are proxied through, whilst applying our DDoS protection and IP Firewall rules. This allows you to protect your services from all sorts of nasty attacks and completely hides your origin behind Cloudflare.

Last year, we launched Spectrum. Spectrum brought the power of our DDoS and firewall features to all TCP ports and services. Spectrum for TCP allows you to protect your SSH services, gaming protocols, and as of last month, even FTP servers. We’ve seen customers running all sorts of applications behind Spectrum, such as Bitfly, Nicehash, and Hypixel.

This is great if you're running TCP services, but plenty of our customers also have workloads running over UDP. As an example, many multiplayer games prefer the low cost and lighter weight of UDP and don't care about whether packets arrive or not.

UDP applications have historically been hard to protect and secure, which is why we built Spectrum for UDP. Spectrum for UDP allows you to protect standard UDP services (such as RDP over UDP), but can also protect any custom protocol Continue reading

Episode 47 – Introduction To Segment Routing

Many routing experts believe that segment routing provides significant advantages over MPLS, and more specifically MPLS Traffic Engineering (MPLS-TE). In this episode we take a look at some of the foundational concepts used in segment routing and some of the differentiators between it and MPLS.

Resources:

 

 

We would like to thank Cumulus Networks for sponsoring this episode of Network Collective.  Cumulus Networks makes networking software for the open, modern data center. It’s the only open networking software that allows you to affordably build and efficiently operate your network like the worlds largest data center operators. Your company’s success depends on your ability to “future-proof” your network so why would you choose old, legacy infrastructure to stay ahead Continue reading

Printing from the Linux command line

Printing from the Linux command line is easy. You use the lp command to request a print, and lpq to see what print jobs are in the queue, but things get a little more complicated when you want to print double-sided or use portrait mode. And there are lots of other things you might want to do — such as printing multiple copies of a document or canceling a print job. Let's check out some options for getting your printouts to look just the way you want them to when you're printing from the command line.Displaying printer settings To view your printer settings from the command line, use the lpoptions command. The output should look something like this:To read this article in full, please click here

Preventing Request Loops Using CDN-Loop

Preventing Request Loops Using CDN-Loop

HTTP requests typically originate with a client, and end at a web server that processes the request and returns some response. Such requests may pass through multiple proxies before they arrive at the requested resource. If one of these proxies is configured badly (for instance, back to a proxy that had already processed it) then the request may be caught in a loop.

Request loops, accidental or malicious, can consume resources and degrade user's Internet performance. Such loops can even be observed at the CDN-level. Such a wide-scale attack would affect all customers of that CDN. It's been over three years since Cloudflare acknowledged the power of such non-compliant or malicious request loops. The proposed solution in that blog post was quickly found to be flawed and loop protection has since been implemented in an ad-hoc manner that is specific to each individual provider. This lack of cohesion and co-operation has led to a fragmented set of protection mechanisms.

We are finally happy to report that a recent collaboration between multiple CDN providers (including Cloudflare) has led to a new mechanism for loop protection. This now runs at the Cloudflare edge and is compliant with other CDNs, allowing us to Continue reading

Lock-In and SD-WAN: a Match Made in Heaven

This blog post was initially sent to subscribers of my SDN and Network Automation mailing list. Subscribe here.

I made a statement along these lines in an SD-WAN blog post and related email sent to our SDN and Network Automation mailing list:

The architecture of most SD-WAN products is thus much cleaner and easier to configure than traditional hybrid networks. However, do keep in mind that most of them use proprietary protocols, resulting in a perfect lock-in.

While reading that one of my readers sent me a nice email with an interesting question:

Read more ...

Understanding lifecycle management complexity of datacenter topologies

Understanding lifecycle management complexity of datacenter topologies Zhang et al., NSDI’19

There has been plenty of interesting research on network topologies for datacenters, with Clos-like tree topologies and Expander based graph topologies both shown to scale using widely deployed hardware. This research tends to focus on performance properties such as throughput and latency, together with resilience to failures. Important as these are, note that they’re also what’s right in front of you as a designer, and relatively easy to measure. The great thing about today’s paper is that the authors look beneath the surface to consider the less visible but still very important “lifecycle management” implications of topology design. In networking, this translates into how easy it is to physically deploy the network, and how easy it to subsequently expand. They find a way to quantify the associated lifecycle management costs, and then use this to help drive the design of a new class of topologies, called FatClique.

… we show that existing topology classes have low lifecycle management complexity by some measures, but not by others. Motivated by this, we design a new class of topologies, FatClique, that, while being performance-equivalent to existing topologies, is comparable to, or Continue reading

Join a Local IETF Viewing Hub in Africa

The Internet Engineering Task Force (IETF) is the premier Internet standards body, developing open standards through processes to make the Internet work better. It gathers a large, international community of network designers, operators, vendors, and researchers concerned with the evolution of the Internet architecture and the smooth operation of the Internet. Core Internet technologies such as DNS, routing and traffic encryption use protocols standardized at IETF.

The IETF holds three meetings yearly which are livestreamed and can be followed individually, or with others sharing similar interest at a common venue. The next IETF meeting will be held from 25-29 March 2019 in Prague. The usual audience for an IETF meeting is network engineers, system engineers, developers, and university students or lecturers in information technology fields.

The Internet Society Africa Regional Bureau is running an initiative to encourage remote participation in IETF meetings that aims to promote the work of the IETF. IETF Remote Hubs aim to raise awareness about the IETF and allow those who cannot travel to a meeting to participate in the meeting remotely. The meetings are streamed in English only.

Join one of the following IETF Remote Hubs in your area, raise your awareness about the IETF and engage in the various topics of Continue reading

Heavy Networking 436: Will QUIC Collapse The Internet?

Will the new QUIC protocol cause the Internet to collapse? Today's Heavy Networking episode tackles this question with guest Christian Huitema. QUIC is an emerging transport protocol that promises advances over TCP and the ability to innovate quickly, but could--possibly--set off an arms race as developers try to game congestion algorithms to their own benefit.

The post Heavy Networking 436: Will QUIC Collapse The Internet? appeared first on Packet Pushers.

The Multicloud We Need, But Not the One We Deserve

Large organizations are married to the VMware suite of products. We can quibble about numbers for adoption of Hyper-V and KVM, but VMware dominates the enterprise virtualization market, just as Kubernetes is the unquestioned champion of containers.

Virtual Machines (VMs) are a mature technology, created and refined before large-scale adoption of public cloud services. Cloud-native workloads are often designed for containers, and containerized workloads are designed to fail. You can tear one down on one cloud, and reinstantiate it on another. Near-instant reinastantiation is the defense against downtime.

VMs take a different approach. A VM is meant to keep existing for long periods of time, despite migrations and outages. Failure is to be avoided as much as possible. This presents a problem as more organizations pursue a multi-cloud IT strategy.

The key technology for highly available VMs is vMotion: the ability to move a VM from one node in a cluster to another with no downtime. However, as data centers themselves become increasingly virtualized, using cloud computing services such as Microsoft Azure, Google Compute Engine, and Amazon EC2, there’s a growing requirement to be able to move VMs between cloud infrastructures. This is not a supported feature of vMotion.

Routed Continue reading

Interview with Joe Onisick

With this blog, I try to inspire and mentor. One person I have a lot of respect for is Joe Onisick. I had the pleasure of interviewing Joe. Joe has really transformed himself and everything about him lately and I thought it would be nice to give you readers some more insight to his journey. Here is Joe’s story:

Q: Hi Joe, welcome to the blog! Please give the readers a short introduction of yourself.

A: I’m a technology executive who’s been in the field for 23 years, with the exception of a five-year break to serve as a US Marine. I started in network/email administration and have spent most of my career in the data center space on all aspects of delivering data center resources, up to IaaS and private-cloud.

Q: Many people probably know you best from your time at Cisco, working for the Insieme BU, responsible for coming up with ACI. What was your time at Cisco like? How were you as a person at that time?

A: I joined a startup called Insieme Networks that was in the early stages of developing what became Cisco ACI and Nexus 9000. When the product was ready to launch, Continue reading

Cisco spreads AI across Webex meetings

Cisco Webex has rolled out a package of AI-based features that brings together recently acquired technologies it says will make business meetings more efficient and intuitive.The Webex conferencing tool enhancements, which include faster meeting startup, a better way to know the people attending a meeting and facial-recognition improvements will help customers more effectively collaborate from any location, the company said. Read about SD-WAN How to buy SD-WAN technology: Key questions to consider when selecting a supplier How to pick an off-site data-backup method SD-Branch: What it is and why you’ll need it What are the options for security SD-WAN? Cisco bought Webex in 2007 for about $3.2 billion with an eye toward competing more effectively with Microsoft and other collaboration software vendors. Today Webex conferencing tools are used by over 130 million customers a month, Cisco says.To read this article in full, please click here

Cisco spreads AI across Webex meetings

Cisco Webex has rolled out a package of AI-based features that brings together recently acquired technologies it says will make business meetings more efficient and intuitive.The Webex conferencing tool enhancements, which include faster meeting startup, a better way to know the people attending a meeting and facial-recognition improvements will help customers more effectively collaborate from any location, the company said. Read about SD-WAN How to buy SD-WAN technology: Key questions to consider when selecting a supplier How to pick an off-site data-backup method SD-Branch: What it is and why you’ll need it What are the options for security SD-WAN? Cisco bought Webex in 2007 for about $3.2 billion with an eye toward competing more effectively with Microsoft and other collaboration software vendors. Today Webex conferencing tools are used by over 130 million customers a month, Cisco says.To read this article in full, please click here

1 … 1,233 1,234 1,235 1,236 1,237 … 3,792