Flattening Networks – And Budgets – With 400G Ethernet

If it were not for the insatiable bandwidth needs of the twenty major hyperscalers and cloud builders, it is safe to say that the innovation necessary to get Ethernet switching and routing up to 200 Gb/sec or 400 Gb/sec might not have been done at the fast pace that the industry as been able to pull off.

Knowing that there are 100 million ports of switching up for grabs among these companies from 2017 through 2021 – worth tens of billions of dollars per year in revenues – is a strong motivator to get clever.

And that is precisely what …

Flattening Networks – And Budgets – With 400G Ethernet was written by Timothy Prickett Morgan at The Next Platform.

IBM Gets Machines Back Into International Business

Designing and manufacturing processors – or paying a third party foundry to do some of the work – and then manufacturing systems and updating and modernizing operating systems and middleware is tough work. And it is work that few IT vendors and about the same number of hyperscalers do these days. Despite all of the gut-wrenching changes in the datacenter over the past six decades, International Business Machines is still in the game that it largely defined so long ago.

In the fourth quarter of 2017, the company’s System z mainframes had the highest shipment level, as gauged by aggregate …

IBM Gets Machines Back Into International Business was written by Timothy Prickett Morgan at The Next Platform.

CCIE SP Written and Lab Content Updates v4.1

For those who may not have heard, Cisco recently updated their blueprint for the CCIE Service Provider Written and Lab Exams. According to Cisco, only about 10% of the overall blueprint has changed and topics on 4.1 will be similar to those on 4.0. Read on to learn more.

Domain Changes:

4.1 domain topics are almost exactly the same as 4.0 topics. The main difference in domains is that domains 1 and 3 (service provider architecture and evolution and service provider base services) have been merged into one domain. While other domain topics did not change, slight shifts were made to domain weights.

Weighting of Domains:

 

 

Topic changes within the Domains:

  • Domain 1 (Core Routing): No topics were added or removed within this domain, but some items were moved, rephrased, or merged into one single item.
  • Domain 2 (Service Provider Architecture and Services) now holds tasks of the original domain 1 and 3. Other items that were part of domain 1, such as software architecture, mobility node functions, and virtualization concepts, were rephrased to better define their scope.
  • Domain 3 (Access and Aggregation) had a few topics items removed.
  • Domain 4 (High Availability and Continue reading

Weekend Reads 011918: IoT, Cyberthreat Thinking, and Techlash

Throughout 2016 and 2017, attacks from massive botnets made up entirely of hacked IoT devices had many experts warning of a dire outlook for Internet security. But the future of IoT doesn’t have to be so bleak. Here’s a primer on minimizing the chances that your IoT things become a security liability for you or for the Internet at large. —Krebs on Security

The cybercrime and cyber terrorism raging today are the most visible symptoms of a more pervasive problem concerning cyber security. How to establish a fair and just governance regime in cyberspace and establish international rules spark a storm of controversy. The controversy reflects the competing interests and demands of three distinct cyberspace actors: the state, the citizen, and the international community. By focusing only on one’s own interests, each actor ignores the interests of the other two, resulting in the current situation in which each sticks to its own argument and refuses to reconcile. —Hao Yeli

Deputy Attorney General Rosenstein has given talks where he proposes that tech companies decrease their communications and device security for the benefit of the FBI. In a recent talk, his idea is that tech companies just save a copy of the Continue reading

Web Cache Deception Attack revisited

In April, we wrote about Web Cache Deception attacks, and how our customers can avoid them using origin configuration.

Read that blog post to learn about how to configure your website, and for those who are not able to do that, how to disable caching for certain URIs to prevent this type of attacks. Since our previous blog post, we have looked for but have not seen any large scale attacks like this in the wild.

Today, we have released a tool to help our customers make sure only assets that should be cached are being cached.

A brief re-introduction to Web Cache Deception attack

Recall that the Web Cache Deception attack happens when an attacker tricks a user into clicking a link in the format of http://www.example.com/newsfeed/foo.jpg, when http://www.example.com/newsfeed is the location of a dynamic script that returns different content for different users. For some website configurations (default in Apache but not in nginx), this would invoke /newsfeed with PATH_INFO set to /foo.jpg. If http://www.example.com/newsfeed/foo.jpg does not return the proper Cache-Control headers to tell a web cache not to cache the content, web caches may decide to cache Continue reading

Stuff The Internet Says On Scalability For January 19th, 2017

Hey, it's HighScalability time:

 

If you like this sort of Stuff then please support me on Patreon. And I'd appreciate your recommending my new book—Explain the Cloud Like I'm 10—to anyone who needs to understand the cloud (who doesn't?). I think they'll like it. Now with twice the brightness and new chapters on Netflix and Cloud Computing.

 

  • $268,895,000,000: Apple's cash and investments; 60%: growth in Amazon's ad revenue; ~80%: movie tickets sold in China are sold through mobile apps; £27,000: King Edward's yearly income; 3: new Google undersea cables; 7,500: Google edge caching nodes; 50,000x: microprocessor performance compared to a 1978 mini-computer at 0.25% of the cost; $15bn: spending on hosting services; 0.2 cycles per byte: ridiculously fast base64 encoding and decoding; $165B+: 2018 games software/hardware spending; 328 feet: air purification tower in China; 42 million: proteins molecules in a yeast cell;

  • Quotable Quotes:
    • Richard Jones: For now, what we can say is that the age of exponential growth of computer power is over. It gave us an extraordinary 40 years, but in our world all exponentials come to an end, and we’re now firmly Continue reading

Can Routing Be Oversimplified?

I don’t know if you’ve had a chance to see this Reddit thread yet, but it’s a funny one:

We eliminated routing protocols from our network!

Short non-clickbait summary: We deployed SD-WAN and turned off OSPF. We now have a /16 route for the internal network and a default route to the Internet where a lot of our workloads were moved into the cloud.

Bravo for this networking team for simplifying their network to this point. All other considerations aside, does this kind of future really bode well for SD-WAN?

Now You See Me

As pointed out in the thread above, the network team didn’t really get rid of their dynamic routing protocols. The SD-WAN boxes that they put in place are still running BGP or some other kind of setup under the hood. It’s just invisible to the user. That’s nothing new. Six years ago, Ivan Pepelnjak found out Juniper QFabric was running BGP behind the scenes too.

Hiding the networking infrastructure from the end user is nothing new. It’s a trick that has been used for years to allow infrastructures to be tuned and configured in such a way as to deliver maximum performance without letting anyone tinker Continue reading

oVirt 4.2.2 web admin UI browser bookmarks

oVirt web admin UI now allows the user to bookmark all entities and searches using their browser.

Synchronizing URL with application state

Whenever you select a detail view in the application, the browser URL is now updated to match the selected entity. For instance if you have a VM named MyVM and you click on the name to see the details, the URL of the browser will go to #vms-general;name=MyVM. If you switch to lets say the network interfaces tab the URL in your browser will switch to #vms-network_interfaces;name=MyVM. Changing entity or changing location will keep the browser URL synchronized. This allows you to use your browsers bookmark functionality to store a link to that VM.

Direct linking to entities

As a complementary functionality you can pass arguments to places that will execute some functionality based on the type of argument you have passed in. The following types are available:

  • SEARCH, is for main views only, this allows you to pre populate the search string used in the search bar.
  • NAME, most entities are uniquely named and you can use their name in a detail view to go directly to that named entity.
  • DATACENTER, quota and networks are not uniquely Continue reading

SYN 패킷 처리 실제​

역자주: 이 글은 Marek Majkowski의 https://blog.cloudflare.com/syn-packet-handling-in-the-wild/ 를 번역한 것입니다.

우리 Cloudflare 에서는 실제 인터넷상의 서버 운영 경험이 많습니다. 하지만 이런 흑마술 마스터하기를 게을리하지도 않습니다. 이 블로그에서는 인터넷 프로토콜의 여러 어두운 부분을 다룬 적이 있습니다: understanding FIN-WAIT-2 나 receive buffer tuning과 같은 것들입니다.


CC BY 2.0 image by Isaí Moreno

사람들이 충분히 신경쓰지 않는 주제가 하나 있는데, 바로 SYN 홍수(SYN floods) 입니다. 우리는 리눅스를 사용하고 있는데 리눅스에서 SYN 패킷 처리는 매우 복잡하다는 것을 알게 되었습니다. 이 글에서는 이에 대해 좀 더 알아 보도록 하겠습니다.

두개의 큐의 이야기

일단 만들어진 소켓에 대해 "LISTENING" TCP 상태에는 두개의 분리된 큐가 존재 합니다:

  • SYN 큐
  • Accept 큐

일반적으로 이 큐에는 여러가지 다른 이름이 붙어 있는데, "reqsk_queue", "ACK backlog", "listen backlog", "TCP backlog" 등이 있습니다만 혼란을 피하기 위해 위의 이름을 사용하도록 하겠습니다.

SYN 큐

SYN 큐는 수신 SYN 패킷[1] (구체적으로는 struct inet_request_sock)을 저장합니다. 이는 SYN+ACK 패킷을 보내고 타임아웃시에 재시도하는 역할을 합니다. 리눅스에서 재시도 값은 다음과 같이 설정됩니다:

$ sysctl net.ipv4.tcp_synack_retries
net.ipv4.tcp_synack_retries = 5

문서를 보면 다음과 같습니다:

tcp_synack_retries - 정수

    수동 TCP 연결 시도에 대해서 SYNACK를 몇번 다시 보낼지를 지정한다.
    이 값은 255 이하이어야 한다. 기본값은 5이며, 1초의 초기 RTO값을 감안하면
    마지막 재전송은 31초  Continue reading

Packet Forwarding on Linux on Software Gone Wild

Linux operating system is used as the foundation for numerous network operating systems including Arista EOS and Cumulus Linux. It provides most networking constructs we grew familiar with including interfaces, VLANs, routing tables, VRFs and contexts, but they behave slightly differently from what we’re used to.

In Software Gone Wild Episode 86 Roopa Prabhu and David Ahern explained the fundamentals of packet forwarding on Linux, and the differences between Linux and more traditional network operating systems.

Read more ...
1 … 1,722 1,723 1,724 1,725 1,726 … 3,808