What you can’t do with Kubernetes network policies (unless you use Calico)

Kubernetes documentation clearly defines what use cases you can achieve using Kubernetes network policies and what you can’t. You are probably familiar with the scope of network policies and how to use them to secure your workload from undesirable connections. Although it is possible to cover the basics with Kubernetes native network policies, there is a list of use cases that you cannot implement by just using these policies.

You can refer to the Kubernetes documentation to review the list of “What you can’t do with network policies (at least, not yet)”.

Here are some of the use cases that you cannot implement using only the native network policy API (transcribed from the Kubernetes documentation):

  • Forcing internal cluster traffic to go through a common gateway.
  • Anything TLS related.
  • Node specific policies.
  • Creation or management of “Policy requests” that are fulfilled by a third party.
  • Default policies which are applied to all namespaces or pods.
  • Advanced policy querying and reachability tooling.
  • The ability to log network security events.
  • The ability to explicitly deny policies.
  • The ability to prevent loopback or incoming host traffic (Pods cannot currently block localhost access, nor do they have the ability to block access from Continue reading

How we built Network Analytics v2

How we built Network Analytics v2
How we built Network Analytics v2

Network Analytics v2 is a fundamental redesign of the backend systems that provide real-time visibility into network layer traffic patterns for Magic Transit and Spectrum customers. In this blog post, we'll dive into the technical details behind this redesign and discuss some of the more interesting aspects of the new system.

To protect Cloudflare and our customers against Distributed Denial of Service (DDoS) attacks, we operate a sophisticated in-house DDoS detection and mitigation system called dosd. It takes samples of incoming packets, analyzes them for attacks, and then deploys mitigation rules to our global network which drop any packets matching specific attack fingerprints. For example, a simple network layer mitigation rule might say “drop UDP/53 packets containing responses to DNS ANY queries”.

In order to give our Magic Transit and Spectrum customers insight into the mitigation rules that we apply to their traffic, we introduced a new reporting system called "Network Analytics" back in 2020. Network Analytics is a data pipeline that analyzes raw packet samples from the Cloudflare global network. At a high level, the analysis process involves trying to match each packet sample against the list of mitigation rules that dosd has deployed, so that it can Continue reading

Heavy Networking 677: US Networking User Association – Meetups For Network Engineers

You ever want a group of fellow networking nerds to hang with once in a while? The US Networking User Association might be exactly what you’re looking for. With local networking user groups popping up in various places all over the US and soon other countries, the USNUA is fostering community and knowledge sharing for networkers everywhere. On today's Heavy Networking we speak with Jason Gintert and Chris Kane, two of the folks behind the USNUA organization, to discuss what the USNUA is, and how you can work with them to get a NUG started in your area.

Heavy Networking 677: US Networking User Association – Meetups For Network Engineers

You ever want a group of fellow networking nerds to hang with once in a while? The US Networking User Association might be exactly what you’re looking for. With local networking user groups popping up in various places all over the US and soon other countries, the USNUA is fostering community and knowledge sharing for networkers everywhere. On today's Heavy Networking we speak with Jason Gintert and Chris Kane, two of the folks behind the USNUA organization, to discuss what the USNUA is, and how you can work with them to get a NUG started in your area.

The post Heavy Networking 677: US Networking User Association – Meetups For Network Engineers appeared first on Packet Pushers.

Private 5G might just make you rethink your wireless options

The hype surrounding 5G ranges from Jetsons-like futurism to deep-in-the-rabbit-hole conspiracy theories. On the consumer side, 5G is still serving up more sizzle than steak, mainly because the technology is so new, handsets so few, and infrastructure still mostly 4G LTE or earlier, so developers are still figuring out how to take advantage of its capabilities.To read this article in full, please click here

Effects of the conflict in Sudan on Internet patterns

Effects of the conflict in Sudan on Internet patterns
Effects of the conflict in Sudan on Internet patterns

On Saturday, April 15, 2023, an armed conflict between rival factions of the military government of Sudan began. Cloudflare observed a disruption in Internet traffic on that Saturday, starting at 08:00 UTC, which deepened on Sunday. Since then, the conflict has continued, and different ISPs have been affected, in some cases with a 90% drop in traffic. On May 2, Internet traffic is still ~30% lower than pre-conflict levels. This blog post will show what we’ve been seeing in terms of Internet disruption there.

On the day that clashes broke out, our data shows that traffic in the country dropped as much as 60% on Saturday, after 08:00 UTC, with a partial recovery on Sunday around 14:00, but it has consistently been lower than before. Although we saw outages and disruptions on major local Internet providers, the general drop in traffic could also be related to different human usage patterns because of the conflict, with people trying to leave the country. In Ukraine, we saw a clear drop in traffic, not always related to ISP outages, after the war started, when people were leaving the country.

Here’s the hourly perspective of Sudan’s Internet traffic over the past weeks as seen Continue reading

Heavy Wireless 001: Are We Ready For Wi-Fi 7?

Welcome to the Heavy Wireless podcast! For this inaugural episode we look at the Wi-Fi 7 standard (802.11be). With consumer products expected to ship in 2023, now's the time to explore what the latest advances mean for enterprise and consumer markets. Host Keith Parsons welcomes David D. Coleman to discuss key features including 320 Mhz channels, 4K QAM, and Multi-Link Operation (MLO).

Heavy Wireless 001: Are We Ready For Wi-Fi 7?

Welcome to the Heavy Wireless podcast! For this inaugural episode we look at the Wi-Fi 7 standard (802.11be). With consumer products expected to ship in 2023, now's the time to explore what the latest advances mean for enterprise and consumer markets. Host Keith Parsons welcomes David D. Coleman to discuss key features including 320 Mhz channels, 4K QAM, and Multi-Link Operation (MLO).

The post Heavy Wireless 001: Are We Ready For Wi-Fi 7? appeared first on Packet Pushers.

How to shop for network observability tools

Today’s enterprise networks span on-premises and cloud environments, and it has become a lot harder for IT teams to maintain performance, reliability and security when some parts of the network are unknown or off-limits to traditional performance monitoring tools.“If you cannot get visibility into all the components comprising the digital experience, everything that is between the end user clicking the mouse to the deepest part of a cloud or data center network, then you are flying blind, you are incurring a lot of risk, and you could be overspending, too,” says Mark Leary, research director for network analytics and automation at research firm IDC.To read this article in full, please click here

How to shop for network observability tools

Today’s enterprise networks span on-premises and cloud environments, and it has become a lot harder for IT teams to maintain performance, reliability and security when some parts of the network are unknown or off-limits to traditional performance monitoring tools.“If you cannot get visibility into all the components comprising the digital experience, everything that is between the end user clicking the mouse to the deepest part of a cloud or data center network, then you are flying blind, you are incurring a lot of risk, and you could be overspending, too,” says Mark Leary, research director for network analytics and automation at research firm IDC.To read this article in full, please click here

Exploring bash builtins on Linux

You probably use some bash builtins fairly often whether or not you think of them as builtins or simply as commands. After all, bash builtins are commands, but not implemented as separate executables. Instead, they are part of the bash executable. In other words, they are "built into" bash, thus the term "bash builtins".If you're looking for a particular builtin, the which command isn't going to find it for you because it only looks through a collection of executables. This includes system commands like /bin/echo as well as scripts for which you have execute permission. Here's an example of which not finding anything:To read this article in full, please click here

Exploring bash builtins on Linux

You probably use some bash builtins fairly often whether or not you think of them as builtins or simply as commands. After all, bash builtins are commands, but not implemented as separate executables. Instead, they are part of the bash executable. In other words, they are "built into" bash, thus the term "bash builtins".If you're looking for a particular builtin, the which command isn't going to find it for you because it only looks through a collection of executables. This includes system commands like /bin/echo as well as scripts for which you have execute permission. Here's an example of which not finding anything:To read this article in full, please click here

Network Break 428: Arista Announces Cloud-Based NAC; Is Google Cloud Finally Making Money?

Take a Network Break! This week we discuss a new NAC solution from Arista Networks, a new version of Central from HPE Aruba, and the latest version of NetBrain. We also cover a new XDR offering from Cisco, Google Cloud's quarterly financial results, Microsoft entanglements with EU and UK regulators, and more tech news.

The post Network Break 428: Arista Announces Cloud-Based NAC; Is Google Cloud Finally Making Money? appeared first on Packet Pushers.

Celebrating Australia’s Privacy Awareness Week 2023

Celebrating Australia’s Privacy Awareness Week 2023
Celebrating Australia’s Privacy Awareness Week 2023

When a country throws a privacy party, Cloudflare is there! We are proud to be an official sponsor of the Australian Privacy Awareness Week 2023, and we think this year’s theme of “Privacy 101: Back to Basics” is more important now than ever. In recent months, Australians have been hit with the news of massive personal data privacy breaches where millions of Australian citizens' private and sensitive data was compromised, seemingly easily. Meanwhile, the Australian Attorney General released its Privacy Act Review Report 2022 earlier this year, calling for a number of changes to Australia’s privacy regulations.

You’re probably familiar with the old-school privacy basics of giving users notice and consent. But we think it’s time for some new “privacy basics”. Thanks to rapid developments in new technologies and new security threat vectors, notice and consent can only go so far to protect the privacy of your personal data. New challenges call for new solutions: security solutions and privacy enhancing technologies to keep personal data protected. Cloudflare is excited to play a role in building and using these technologies to help our customers keep their sensitive information private and enable individual consumers to protect themselves. Investing in and offering these Continue reading

1 … 267 268 269 270 271 … 3,804