SR Linux Configuration Conversion Tool

A year ago, I was complaining about SR Linux breaking its configuration data model with a new software release. At that time, I was promised it would only happen once a year, and, like clockwork, that moment arrived with the SR Linux release 26.03.

However, this year Miguel Redondo fixed the netlab SR Linux configuration templates (VRF export policies, LocPref routing policy changes) before I could even start looking at them, and Roman Dodin released a tool that tells you exactly what changed between software releases and how to fix it.

Read more …

NAN118: The Importance of the Data Behind AI in Networks (Sponsored)

When applying AI to network operations and automation, a strong data foundation is essential. In this sponsored episode, Eric Chou and Scott Robohn are joined by Surya Nimmagadda, Chief Data Scientist; and Joby Rudolph, Senior Distinguished Engineer, both from Selector. They discuss the importance of transparency in their data and how it can instill confidence... Read more »

Our ongoing commitment to privacy for the 1.1.1.1 public DNS resolver

Exactly 8 years ago today, we launched the 1.1.1.1 public DNS resolver, with the intention to build the world’s fastest resolver — and the most private one. We knew that trust is everything for a service that handles the "phonebook of the Internet." That’s why, at launch, we made a unique commitment to publicly confirm that we are doing what we said we would do with personal data. In 2020, we hired an independent firm to check our work, instead of just asking you to take our word for it. We shared our intention to update such examinations in the future. We also called on other providers to do the same, but, as far as we are aware, no other major public resolver has had their DNS privacy practices independently examined.

At the time of the 2020 review, the 1.1.1.1 resolver was less than two years old, and the purpose of the examination was to prove our systems made good on all the commitments we made about how our 1.1.1.1 resolver functioned, even commitments that did not impact personal data or user privacy. 

Since then, Cloudflare’s technology Continue reading

Introducing EmDash — the spiritual successor to WordPress that solves plugin security

The cost of building software has drastically decreased. We recently rebuilt Next.js in one week using AI coding agents. But for the past two months our agents have been working on an even more ambitious project: rebuilding the WordPress open source project from the ground up.

WordPress powers over 40% of the Internet. It is a massive success that has enabled anyone to be a publisher, and created a global community of WordPress developers. But the WordPress open source project will be 24 years old this year. Hosting a website has changed dramatically during that time. When WordPress was born, AWS EC2 didn’t exist. In the intervening years, that task has gone from renting virtual private servers, to uploading a JavaScript bundle to a globally distributed network at virtually no cost. It’s time to upgrade the most popular CMS on the Internet to take advantage of this change.

Our name for this new CMS is EmDash. We think of it as the spiritual successor to WordPress. It’s written entirely in TypeScript. It is serverless, but you can run it on your own hardware or any platform you choose. Plugins are securely sandboxed and can run in their own isolate, Continue reading

Every Layer of Review Makes You 10x Slower

Avery Pennarun published yet another excellent article: every layer of review makes you 10x slower, effectively reiterating what I’ve been saying for decades: all the technology in the world won’t help you unless you re-architect the broken processes.

AI is no exception, but of course, the AI evangelists, LinkedIn AI Wranglers1, and Thought Leaders will never tell you that (or even admit it).

  1. Yes, you can find BS like that on LinkedIn. You’re not surprised, are you? ↩︎

Introducing Programmable Flow Protection: custom DDoS mitigation logic for Magic Transit customers

We're proud to introduce Programmable Flow Protection: a system designed to let Magic Transit customers implement their own custom DDoS mitigation logic and deploy it across Cloudflare’s global network. This enables precise, stateful mitigation for custom and proprietary protocols built on UDP. It is engineered to provide the highest possible level of customization and flexibility to mitigate DDoS attacks of any scale. 

Programmable Flow Protection is currently in beta and available to all Magic Transit Enterprise customers for an additional cost.

Programmable Flow Protection is customizable

Our existing DDoS mitigation systems have been designed to understand and protect popular, well-known protocols from DDoS attacks. For example, our Advanced TCP Protection system uses specific known characteristics about the TCP protocol to issue challenges and establish a client’s legitimacy. Similarly, our Advanced DNS Protection builds a per-customer profile of DNS queries to mitigate DNS attacks. Our generic DDoS mitigation platform also understands common patterns across a variety of other well known protocols, including NTP, RDP, SIP, and many others.

However, custom or proprietary UDP protocols have always been a challenge for Cloudflare’s DDoS mitigation systems because our systems do not have the relevant protocol knowledge to make intelligent decisions to Continue reading

BGP Labs: Use Your Preferred Device for External Routers

TL&DR: With the recent changes to online BGP labs, you can also use Aruba CX, Cisco IOS, Cisco IOS XE, Cisco IOS XR, Dell OS10, Junos, or VyOS as external lab devices in most lab exercises (you could always use these devices for the routers you worked on). Previously, you could choose between Arista EOS and FRRouting, both of which are (obviously) still supported.

One of the goals of the Online BGP Labs project was to create an environment in which you could practice the BGP features you were interested in without spending an inordinate amount of time preparing the lab.

For example, if you want to figure out why BGP wedgies work the way they do, you need at least four additional autonomous systems, two of them acting as upstream ISPs for your customer router, and at least one of them implementing BGP policies using BGP communities.

Read more …

NB568: Arm Reaches for More AI Revenue with In-House CPU; Debating the FCC Router Ban

Take a Network Break! Mozilla is our Red Alert topic, with critical vulnerabilities in Firefox and Thunderbird. On the news front, we cover a string of security announcements from Palo Alto Networks, including a new certificate management service to help organizations keep up with shrinking cert lifetimes. Cisco announces new protections for AI agents and... Read more »

Tech Bytes: Build Your Automation Foundation on Infrahub’s Data Management Platform (Sponsored)

Today on the Tech Bytes podcast we talk network automation. More specifically, we dig into the need for proper data management to support your network automation initiatives. Automation relies on accurate, up-to-date information about your infrastructure, but that information can be scattered across innumerable repositories, systems, and spreadsheets. And it may, or may not, be... Read more »

Cloudflare Client-Side Security: smarter detection, now open to everyone

Client-side skimming attacks have a boring superpower: they can steal data without breaking anything. The page still loads. Checkout still completes. All it needs is just one malicious script tag.

If that sounds abstract, here are two recent examples of such skimming attacks:

  • In January 2026, Sansec reported a browser-side keylogger running on an employee merchandise store for a major U.S. bank, harvesting personal data, login credentials, and credit card information.

  • In September 2025, attackers published malicious releases of widely used npm packages. If those packages were bundled into front-end code, end users could be exposed to crypto-stealing in the browser.

To further our goal of building a better Internet, Cloudflare established a core tenet during our Birthday Week 2025: powerful security features should be accessible without requiring a sales engagement. In pursuit of this objective, we are announcing two key changes today:

First, Cloudflare Client-Side Security Advanced (formerly Page Shield add-on) is now available to self-serve customers. And second, domain-based threat intelligence is now complimentary for all customers on the free Client-Side Security bundle.

In this post, we’ll explain how this product works and highlight a new AI detection system designed to identify malicious JavaScript while Continue reading

Changing Interfaces Connected to netlab Links

Some netlab users want to accurately replicate their physical network’s topology in a virtual lab. Ignoring the obvious caveats for a moment, the first hiccup is usually the interface naming. All bets are off if you’re using anything but Ethernet in your actual network, but even if you did standardize on Ethernet, the container/VM interface names might not match the physical ones.

netlab provided a solution for a long time – you can specify interface ifindex when attaching a node to a link. For example, use the following topology to connect Ethernet3 on R1 to Ethernet6 on R2:

Read more …

Worth Reading 032826


This document provides DNS deployment guidelines to secure the DNS protocol and infrastructure, mitigate misuse or misconfiguration, and provide an additional layer of network security as part of a zero trust and/or defense-in-depth security risk management approach.

 


However, eBPF has not seen similarly widespread adoption in other types of networked applications, such as web servers and databases. In this blog post, we argue that this gap stems from limitations in the current eBPF architecture — specifically, the kernel runtime, APIs, and compiler toolchain.

 


Time and again, I see people begging for companies with deep pockets to fund open source projects. I mean, after all, they’ve made billions from this code. You’d think they could support the code’s creators and maintainers. It would be only fair, right?

 


The weird, rare, surprising patterns that make data rich slowly get smoothed out when an AI model trains on outputs from a previous model.

 


In the previous note, the claim was not that the registry layer merely imposes visible fees or administrative inconvenience. The claim was more precise. The first extraction occurs when a scarce, transferable, revenue-enabling resource is kept institutionally discounted through non-asset rhetoric, conditional recognition, and friction around Continue reading

The Last Time

It's fading from our collective memory, but almost thirty years ago the global IT industry was gripped by Y2K fever. Another version of the counter rollover problem is coming back in 2036, 2038 and 2040. Hopefully we will avoid a large amount of hysteria this time around!

HN820: Cyber Week 2026 Wrap Up with Palo Alto Networks: Agents, Prisma AIRS and NGTS (Sponsored)

Palo Alto Networks released a slew of product news at the 2026 RSA conference around AI security, SASE, and a new certificate lifecycle management offering. On today’s Heavy Networking, sponsored by Palo Alto Networks, Ethan and Drew dig into these announcements to get details about how they work. They also talk about the risks of... Read more »
1 … 17 18 19 20 21 … 3,877