Is One Protocol Simpler Than Two?

I’ve been in a lot of interesting discussions the last couple of days on what protocol to use for the underlay when building a VXLAN datacenter network. Do you use an IGP such as OSPF or ISIS or do you use BGP? A common argument for BGP is that running one protocol is less complex than two. Is it, though?

We can argue about if OSPF or BGP is the more well known protocol. What I think is going on here though is that OSPF is perceived as complex due to the following reasons:

• Utilizes both unicast and multicast for messaging.
• Maintains a link state database and runs SPF to calculate best paths.
• Different LSA types and flooding behavior.
• Does not advertise routes.

On the other hand, BGP has the following characteristics:

• Utilizes only unicast for messaging.
• Rides over TCP.
• Advertises prefixes (NLRI).

Is OSPF complex? That’s debateable but everything is difficult if you don’t know it well enough. If you don’t know your way around the LSDB then it can be difficult to understand how routes get into the RIB and later FIB. Not knowing a protocol doesn’t make it complex, though. I would argue that someone with the Continue reading

Tech Bytes: How StackPath Uses Catchpoint’s Internet Performance Monitoring To Accelerate MTTI (Sponsored)

Tech Bytes: How StackPath Uses Catchpoint’s Internet Performance Monitoring To Accelerate MTTI (Sponsored)

Today on the Tech Bytes podcast we talk about monitoring network and application performance. Our sponsor is Catchpoint, and they’ve sent a customer, StackPath, to talk about using Catchpoint in production. This includes real-time BGP monitoring and Catchpoint’s observability network that lets you test networks and applications from multiple vantage points, and instant tests when you need immediate data.

The post Tech Bytes: How StackPath Uses Catchpoint’s Internet Performance Monitoring To Accelerate MTTI (Sponsored) appeared first on Packet Pushers.

Network Break 444: NVIDIA Mines GPU Gold; VMware Wants To Sell You Private AI; SUSE Prepares To Go Private

Network Break 444: NVIDIA Mines GPU Gold; VMware Wants To Sell You Private AI; SUSE Prepares To Go Private

Take a Network Break! On today's episode we discuss two announcements from VMware Explore 2023: a private AI offering, and a revamped NSX for public and private cloud networking. We also discuss recent rule changes at the SEC that require public companies to disclose material security incidents in a timely manner, NVIDIA's huge revenue results, SUSE going private, and more tech news.

The post Network Break 444: NVIDIA Mines GPU Gold; VMware Wants To Sell You Private AI; SUSE Prepares To Go Private appeared first on Packet Pushers.

Mac, iPad, or Both?

Both Jason Snell and John Gruber, both stalwarts in the Apple journalism world, have recently weighed in on this topic. Jason says he’s given up on the iPad-only travel dream; John says he keeps throwing his iPad in his bag when he travels, even if he never uses it. I have thoughts on this topic—as you might think, considering I decided to write about it! (Ah, but what device did I use to write?)

Jason kicks off the discussion with a review of his iPad travel usage, which until the arrival of Apple Silicon, was going along swimmingly. Now, with Apple Silicon-powered Macs, things are different:

In the battle between iPad and Mac, I’m a longtime member of Team Both—I use my Mac most of the day at my desk, but when I write elsewhere in the house or backyard, I switch to an iPad Pro in the Magic Keyboard case. And that iPad (in a regular case) is my primary computing device when I’m not in work mode…But here I sit at my mother’s dining room table, typing on a MacBook Air. Something has changed in my approach to travel, and I’m trying to understand just Continue reading

C 001. Intro into the IPv4/IPv6 Application Support from the Software/System Point of View.

Dear friend,

Being a long-time network engineer, I’ve seen (and done) it all: talking about about IPv6, designing and implementing IPv6 in production service providers and data center networks, holly wars IPv6 vs IPv4, industries saying they aren’t going to use IPv6 ever, and many others. For some network engineers, it could be even quite an “innovation” project (I clearly remember some senior person told me back in 2018 that introduction of IPv6 is an innovation; quite a statement in the 20-years anniversary of IPv6). But today I want to talk about it from a different angle.

How Is Network Relevant for Software?

In many cases every day we rely on the software, which works over Internet: whatever you need to buy or sell some goods, order a table in your favorite cafe, book ticket to train to visit your friends. Connected world is around us and, if for whatever reason it breaks, our life immediately becomes much more difficult. That’s because the applications rely on the Internet and their capability to provide you the service depends on their capabilities to connect from your smartphone or laptop to the application servers. And this capability is significantly affected by Continue reading

Most hyped network technologies and how to deal with them

The appeal of promising network technologies can be jaded by pressure to adopt untested ideas. When I look over the comments I’ve gotten from enterprise technologists this year, one thing that stands out is that almost three-quarters of them said that entrenched views held by company executives is a “significant problem” for them in sustaining their network and IT operations.“Every story that comes out gets me a meeting in the board room to debunk a silly idea,” one CIO said. I’ve seen that problem in my own career and so I sympathize, but is there anything that tech experts can do about it? How do you debunk the “big hype” of the moment?For starters, don’t be too dismissive. Technologists agree that a dismissive response to hype cited by senior management is always a bad idea. In fact, the opening comment that most technologists suggested is “I agree there’s real potential there, but I think there are some near-term issues that need to be resolved before we could commit to it.” The second-most-cited opening is “I’ve already launched a study of that, and I’ll report back to you when it’s complete.” There’s usually a grain (yeah, often Continue reading

Most hyped network technologies and how to deal with them

The appeal of promising network technologies can be jaded by pressure to adopt untested ideas. When I look over the comments I’ve gotten from enterprise technologists this year, one thing that stands out is that almost three-quarters of them said that entrenched views held by company executives is a “significant problem” for them in sustaining their network and IT operations.“Every story that comes out gets me a meeting in the board room to debunk a silly idea,” one CIO said. I’ve seen that problem in my own career and so I sympathize, but is there anything that tech experts can do about it? How do you debunk the “big hype” of the moment?For starters, don’t be too dismissive. Technologists agree that a dismissive response to hype cited by senior management is always a bad idea. In fact, the opening comment that most technologists suggested is “I agree there’s real potential there, but I think there are some near-term issues that need to be resolved before we could commit to it.” The second-most-cited opening is “I’ve already launched a study of that, and I’ll report back to you when it’s complete.” There’s usually a grain (yeah, often Continue reading

Cisco services help enterprises set infrastructure, operations priorities

Cisco has unveiled a new Lifecycle Services (LCS) offering that's aimed at enabling enterprise customers to get the most out of their networking and technology investments.LCS is being delivered by Cisco’s Global Customer Experience (CX) team, which includes some 20,000 employees that focus on supporting organizations as they choose, deploy and operate the technologies they need to achieve their business goals.Cisco CX and its partner organizations offer a suite of services to help customers optimize their network infrastructure, security, collaboration, cloud and data center operations – from planning and design to implementation and maintenance.To read this article in full, please click here

Why Distributedness is a Measure of Digital Maturity

What are network assurance tools and why are they important?

Network assurance tools, which use advanced analytics to optimize and automate network management, are becoming an essential component in every network team’s toolkit.Network assurance was once viewed as a routine IT responsibility. "This attitude essentially reduced assurance to a checkbox," says SQL server consultant Mark Varnas. As enterprises became increasingly data-driven, this perfunctory approach no longer worked. IT leaders needed a better handle on their network in order to advance their data capabilities.And these tools are more than just a simple technology investment. "They're a strategic decision that supports business growth and customer satisfaction," says Matt Aird, CTO at Custom Neon, which makes and sells LED neon lights and signs. "Regular monitoring, clear insights, and preventative measures are vital in competitive markets."To read this article in full, please click here

ARP Details Behind the Scenes

When figuring out how unnumbered IPv4 interfaces work, Daniel Dib asked an interesting question: How does ARP work when the source and destination IPv4 address are not in the same segment (as is usually the case when using unnumbered interfaces)?

TL&DR: ARP doesn’t care about subnets. If the TCP/IP stack needs to find a MAC address of a node it thinks is adjacent, ARP does its best, no matter what.

ARP Details Behind the Scenes

When figuring out how unnumbered IPv4 interfaces work, Daniel Dib asked an interesting question: How does ARP work when the source and destination IPv4 address are not in the same segment (as is usually the case when using unnumbered interfaces)?

TL&DR: ARP doesn’t care about subnets. If the TCP/IP stack needs to find a MAC address of a node it thinks is adjacent, ARP does its best, no matter what.

The Network Times 2023-08-27 09:59:00

Available at Leanpub and Amazon

About This Book

A modern application typically comprises several modules, each assigned specific roles and responsibilities within the system. Application architecture governs the interactions and communications between these modules and users. One prevalent architecture is the three-tier architecture, encompassing the Presentation, Application, and Data tiers. This book explains how you can build a secure and scalable networking environment for your applications running in Microsoft Azure. Besides a basic introduction to Microsoft Azure, the book explains various solutions for Virtual Machines Internet Access, connectivity, security, and scalability perspectives.

Azure Basics: You will learn the hierarchy of Microsoft Azure datacenters, i.e., how a group of physical datacenters forms an Availability Zone within the Azure Region. Besides, you learn how to create a Virtual Network (VNet), divide it into subnets, and deploy Virtual Machines (VM). You will also learn how the subnet in Azure differs from the subnet in traditional networks.

Internet Access: Depending on the role of the application, VMs have different Internet access requirements. Typically, front-end VMs in the presentation tier/DMZ are visible on the Internet, allowing external hosts to initiate connections. VMs in the Application and Data tiers are rarely accessible from Continue reading

Case Study: NGINX + Certbot with Ansible

About this series

In the distant past (to be precise, in November of 2009) I wrote a little piece of automation together with my buddy Paul, called PaPHosting. The goal was to be able to configure common attributes like servername, config files, webserver and DNS configs in a consistent way, tracked in Subversion. By the way despite this project deriving its name from the first two authors, our mutual buddy Jeroen also started using it, and has written lots of additional cool stuff in the repo, as well as helped to move from Subversion to Git a few years ago.

Michael DeHaan [ref] founded Ansible in 2012, and by then our little PaPHosting project, which was written as a set of bash scripts, had sufficiently solved our automation needs. But, as is the case with most home-grown systems, over time I kept on seeing more and more interesting features and integrations emerge, solid documentation, large user group, and eventually I had to reconsider our 1.5K LOC of Bash and ~16.5K files under maintenance, and in the end, I settled on Ansible.

commit c986260040df5a9bf24bef6bfc28e1f3fa4392ed
Author: Pim van Pelt <[email protected]>
Date:   Thu Nov 26 23:13:21 2009 +0000

 Continue reading

Choosing the Underlay Protocol in a VXLAN Network

When building a VXLAN network, what are the considerations for choosing the underlay protocol such as OSPF, IS-IS, or BGP? You obviously want the design to be supported by your vendor of choice. Your staff should also be able to support the design. Although I think it’s reasonable to expect from a Network Engineer that they have some level of knowledge in OSPF and BGP and that this should not be the main deciding factor. Let’s dive into the different protocols and walk through their characteristics and how they can be used as underlay protocols in a VXLAN network. I will compare OSPF to BGP as ISIS basically provides all the benefits of OSPF with some additional ones, but with less support from vendors, and it’s a protocol less known by most Engineers.

OSPF

Protocol overview – OSPF is a link state protocol that builds a Link State Database (LSDB) and runs the Shortest Path First (SPF) algorithm based on Dijkstra’s work to calculate the shortest path. It relies on flooding Link State Advertisements (LSAs). All routers in an area need an identical LSDB.

Ajacencies and transmitting protocol packets – OSPF transmits packets over IP in IP protocol 89. It Continue reading

Weekend Reads 082623

This open-source hardware optimized implementation uses a novel ECC/Dilithium hybrid signature schema that benefits from the security of ECC against standard attacks and Dilithium’s resilience against quantum attacks.

Dig Security, the cloud data security leader, today released findings from its first-ever “State of Cloud Data Security 2023 Report.” The analysis of more than 13 billion files stored in public cloud environments reveals how – and why – sensitive data is at risk in the modern enterprise.

Dr. Read Schuchardt, professor of communications at Wheaton College (IL), identifies five primary ways digital technology can erode our lives and relationships, or produce what he calls “vices of the virtual life”

In the name of taking the global cybersecurity lead and protecting EU citizens, it seeks to impose dozens of onerous, if not impossible, conformance requirements on all “products with digital elements” and associated obligations on every “manufacturer, importer, or distributor.”

Given the exuberance surrounding machine learning (ML) and deep learning (DL) in particular, the claims I will make in this short article will be quite controversial, to say the least.

We all know there are many skilled cyber attackers out there, professionals with the technical know-how to manipulate and exploit Continue reading

SEC To CEOs: Report Your Breaches

The SEC now requires publicly traded companies to report "material" security incidents. But what does "material" mean and how might this new requirement affect infosec practices at these companies?

The post SEC To CEOs: Report Your Breaches appeared first on Packet Pushers.

Networking Is Fast Enough

Without looking up the specs, can you tell me the PHY differences between Gigabit Ethernet and 10GbE? How about 40GbE and 800GbE? Other than the numbers being different do you know how things change? Do you honestly care? Likewise for Wi-Fi 6, 6E, and 7. Can you tell me how the spectrum changes affect you or why the QAM changes are so important? Or do you want those technologies simply because the numbers are bigger?

The more time I spend in the networking space the more I realize that we’ve come to a comfortable point with our technology. You could call it a wall but that provides negative connotations to things. Most of our end-user Ethernet connectivity is gigabit. Sure, there are the occasional 10GbE cards for desktop workstations that do lots of heavy lifting for video editing or more specialized workflows like medical imaging. The rest of the world has old fashioned 1000Mb connections based on 802.3z ratified in 1998.

Wireless is similar. You’re probably running on a Wi-Fi 5 (802.11ac) or Wi-Fi 6 (802.11ax) access point right now. If you’re running on 11ac you might even be connected using Wi-Fi 4 (802.11n) if you’re Continue reading