Microsoft Brings eBPF to Windows

If  you want to run code to provide observability, security or network functionality, running it in the kernel of your operating system gives you a lot of power because that kernel can see and control everything on the system. That’s powerful, but potentially intrusive or dangerous if you get it wrong, whether that’s introducing a vulnerability or just slowing the system down. If you’re looking for a way to take advantage of that kind of privileged context without the potential danger, eBPF is emerging as an alternative — and now it’s coming to Windows. Not Just Networking Originally eBPF stood for “extended Berkeley Packet Filter”, updating the open source networking tool that puts a packet filter in the Linux kernel for higher performance packet tracing (now often called cBPF for classic BPF). But it’s now a generic mechanism for running many kinds of code safely in a privileged context by using a sandbox, with application monitoring, profiling and security workloads as well as networking, so it’s not really an acronym anymore. That privileged context doesn’t even have to be an OS kernel, although it still tends to be, with eBPF being a more stable and secure alternative to kernel modules Continue reading

Cisco NCS 5500 Series Routers

Cisco already supports industry standard sFlow telemetry across a range of products and the recent IOS-XR Release 7.5.1 extends support to Cisco NCS 5500 series routers.

Note: The NCS 5500 series routers also support Cisco Netflow. Rapidly detecting large flows, sFlow vs. NetFlow/IPFIX describes why you should choose sFlow if you are interested in real-time monitoring and control applications.
The following commands configure an NCS 5500 series router to sample packets at 1-in-20,000 and stream telemetry to an sFlow analyzer (192.127.0.1) on UDP port 6343.
flow exporter-map SF-EXP-MAP-1
 version sflow v5
 !
 packet-length 1468
 transport udp 6343
 source GigabitEthernet0/0/0/1
 destination 192.127.0.1
 dfbit set
!

Configure the sFlow analyzer address in an exporter-map.

flow monitor-map SF-MON-MAP
 record sflow
 sflow options
  extended-router
  extended-gateway
  if-counters polling-interval 300
  input ifindex physical
  output ifindex physical
 !
 exporter SF-EXP-MAP-1
!

Configure sFlow options in a monitor-map.

sampler-map SF-SAMP-MAP
 random 1 out-of 20000
!

Define the sampling rate in a sampler-map.

interface GigabitEthernet0/0/0/3
 flow datalinkframesection monitor-map SF-MON-MAP sampler SF-SAMP-MAP ingress

Enable sFlow on each interface for complete visibilty into network traffic.

The diagram shows the general architecture of an sFlow monitoring deployment. All the switches stream sFlow telemetry to a central sFlow analyzer Continue reading

Email Routing is now in open beta, available to everyone

Email Routing is now in open beta, available to everyone
Email Routing is now in open beta, available to everyone

I won’t beat around the bush: we’ve moved Cloudflare Email Routing from closed beta to open beta 🎉

What does this mean? It means that there’s no waitlist anymore; every zone* in every Cloudflare account has Email Routing available to them.

To get started just open one of the zones in your Cloudflare Dashboard and click on Email in the navigation pane.

Email Routing is now in open beta, available to everyone

Our journey so far

Back in September 2021, during Cloudflare’s Birthday Week, we introduced Email Routing as the simplest solution for creating custom email addresses for your domains without the hassle of managing multiple mailboxes.

Many of us at Cloudflare saw a need for this type of product, and we’ve been using it since before it had a UI. After Birthday Week, we started gradually opening it to Cloudflare customers that requested access through the wait list; starting with just a few users per week and gradually ramping up access as we found and fixed edge cases.

Most recently, with users wanting to set up Email Routing for more of their domains and with some of G Suite legacy users looking for an alternative to starting a subscription, we have been onboarding tens of thousands of new zones Continue reading

Do new technologies make IT easier?

Software-defined networking, intent-based networking, SD-WAN, and a host of other technologies are focused on making IT work easier through automation. Rather than manually configuring every part of a system, these technologies offer templates, AI assistance, and, in theory, a much lower workload for the IT worker in the field. Whether that theory translates to practice, however, remains a matter of debate.To read this article in full, please click here

Do new technogies make IT easier?

Software-defined networking, intent-based networking, SD-WAN, and a host of other technologies are focused on making IT work easier through automation. Rather than manually configuring every part of a system, these technologies offer templates, AI assistance, and, in theory, a much lower workload for the IT worker in the field. Whether that theory translates to practice, however, remains a matter of debate.To read this article in full, please click here

Making the network (even) more consumable: Salty minions for cloudlubbers ☁️

Building and integrating custom SR Linux agents — part Ⅱ

A ‘lubber’ is a “big, clumsy person”, a word more commonly used in the form of ‘landlubber’ meaning someone unfamiliar with the sea or sailing. The latter was first recorded back in 1690, combining the Middle English word ‘lubber’ (~1400) with the Germanic — or Dutch — ‘land’: “A definite portion of the earth’s surface owned by an individual or home of a nation”.

The process of combining two words to form a new one is called ‘nominal composition’ and it is used a lot in my native Dutch language. Technically this means that Dutch has exponentially more words than English for example, though we can’t be bothered to list them in dictionaries — we simply invent them as needed (against the advice of my browser’s spellchecker who argues “cloudlubber” should be written as two separate words, silly machine)

Found at the bottom of that dictionary list: Toki Pona — “simple language” — is a minimalistic constructed language consisting of only 120 words. It uses only 14 letters — a e i j k l m n o p s t u w — to form words

Insulting one’s audience from the start is generally considered bad practice, but we’re ok because I wasn’t talking Continue reading

How To Pass API Query Parameters In A Curl Request

If you’re using CLI tool curl to retrieve data from a remote API, you might send forth a command like so.

curl -H "Authorization: Bearer access_token_goes_here" \
  https://api.provider.com/thing/you_want/index.json

That results in a lovely JSON payload that makes you happy.

Let’s say that according to the API documentation, /thing/you_want/ accepts query parameters so that you can scope what you want to know about. Excellent! Instinctively, you try the following…

curl -H "Authorization: Bearer access_token_goes_here" \
  https://api.provider.com/thing/you_want/index.json?scope=1

Rather than a scoped JSON payload that also makes you happy, you get back a message indicating that the API endpoint is displeased. Your sacrifice was deemed unworthy. Nay, YOU are unworthy. You are decidedly not happy.

What has gone wrong to anger the API gods so? You asked the wrong question of the API. More accurately, curl hasn’t formatted the request in quite the way you intuited it would.

To appease the API deities, the appropriate sacrifice comes in the form of a tweaked curl command. For example…

curl -G -H "Authorization: Bearer access_token_goes_here" \
  https://api.provider.com/thing/you_want/index.json \
  -d "query=scope=1"

We added a “-G” flag to make sure curl is sending a GET and not Continue reading

Xilinx Benefits From Intel FPGA Shortages

As AMD is getting closer to closing its $35 billion acquisition of FPGA maker Xilinx, it is natural to think about how well that business is doing and how it is competing against its main rival, Intel – specifically, the Programmable Solutions Group, formerly known as the free-standing Altera before the latter was acquired by Intel in June 2015 for $16.7 billion. …

Xilinx Benefits From Intel FPGA Shortages was written by Timothy Prickett Morgan at The Next Platform.

Emotet Is Not Dead (Yet) – Part 2

Emotet attacks leveraging malicious macros embedded in Excel files continue, with new variants and novel tactics, techniques, and procedures (TTPs). Following our recent report, we observed new waves of Emotet campaigns abusing legitimate Windows features, such as batch scripts and the mshta utility, combined with PowerShell, to deliver Emotet payloads.

In this follow-up blog post, we first provide an overview of the delivery processes of Emotet payloads in typical attacks. Then, we examine the recent variants and reveal how techniques evolved in these attacks.

Emotet payload delivery chain

The Emotet infection chain typically starts with a spam email containing a malicious document in the attachment (see Figure 1). The attachment can be either a Word document or an Excel file with embedded VBA or Excel 4.0 (XL4) macros. To entice the user to enable macro execution in Microsoft Word or Excel, the file displays social engineering content when opened. Once macro execution has been enabled, the embedded macro is executed, leading to the delivery process of an Emotet payload.

Figure 1: A typical Emotet payload delivery chain.

As highlighted in Figure 1, there are typically two ways to deliver an Emotet payload:

Slicing and Dicing Instant Logs: Real-time Insights on the Command Line

Slicing and Dicing Instant Logs: Real-time Insights on the Command Line
Slicing and Dicing Instant Logs: Real-time Insights on the Command Line

During Speed Week 2021 we announced a new offering for Enterprise customers, Instant Logs. Since then, the team has not slowed down and has been working on new ways to enable our customers to consume their logs and gain powerful insights into their HTTP traffic in real time.

Slicing and Dicing Instant Logs: Real-time Insights on the Command Line

We recognize that as developers, UIs are useful but sometimes there is the need for a more powerful alternative. Today, I am going to introduce you to Instant Logs in your terminal! In order to get started we need to install a few open-source tools to help us:

  • Websocat - to connect to WebSockets.
  • Angle Grinder - a utility to slice-and-dice a stream of logs on the command line.

Creating an Instant Log’s Session

For enterprise zones with access to Instant Logs, you can create a new session by sending a POST request to our jobs' endpoint. You will need:

  • Your Zone Tag / ID
  • An Authentication Key or an API Token with at least the Zone Logs Read permission
curl -X POST 'https://api.cloudflare.com/client/v4/zones/${ZONE_ID}/logpush/edge/jobs' \
-H 'X-Auth-Key: <KEY>' \
-H 'X-Auth-Email: <EMAIL>' \
-H 'Content-Type: application/json' \
--data-raw '{
    "fields": "ClientIP,ClientRequestHost,ClientRequestMethod,ClientRequestPath,EdgeEndTimestamp,EdgeResponseBytes,EdgeResponseStatus,EdgeStartTimestamp,RayID",
    "sample": 1,
    "filter": "",
    "kind": "instant-logs"
}'

Response

The Continue reading

Network Break 368: Juniper, Cato Advance Cloud-Based Security Offerings; Citrix Gets Acquired

Take a Network Break! This week’s tech news includes new cloud-delivered security services from Juniper Networks and Cato Networks, new firewall hardware from Fortinet, prognostications on the campus switch market, Cisco teasing a private 5G service, and more.

The post Network Break 368: Juniper, Cato Advance Cloud-Based Security Offerings; Citrix Gets Acquired appeared first on Packet Pushers.

On-Demand execution with Red Hat OpenShift

Being able to dynamically scale infrastructure is no longer a nice-to-have - it is a requirement. The advent of cloud and container platforms have shifted the expectations in terms of consuming IT infrastructure and services. As a result, any tool that is used to manage infrastructure needs to be able to handle this ever-changing landscape. 

Red Hat Ansible Automation Platform provides customers with the tools that they need to build an automation solution. The component automation controller helps enterprises automate and scale with confidence. 

One of the ways we can scale our automation is to leverage container groups. Container groups are part of automation controller, and allow customers to leverage an existing OpenShift cluster to create on-demand execution capacity for Ansible Playbooks. When a job is executed from automation controller, it creates pods on the target OpenShift cluster, which runs the automation job. Once the job is complete, the pods are terminated. This provides a number of benefits:

  • Fewer wasted resources - infrastructure isn’t sitting idle while waiting for automation jobs. Once a job completes, the resources are instantly freed up.
  • Deliver execution capacity quicker - we don’t need to provision infrastructure up front.
  • Less focus on capacity Continue reading

How to Celebrate Valentine’s Day with Your Single Friends 

Valentine’s Day is just a few months away, so it’s time to think about what you’re going to do this year. It is believed that Valentine’s Day is just for people who are romantically and passionately in love. However that is not the case, you can still enjoy Valentine’s Day with your loved ones even if you are single. This article will teach you how to celebrate Valentine’s Day with your single friends, no matter where they are in their dating journey!

Have a Movie Marathon

You and your single friends can get together to watch movies. The best thing about this is you don’t even have to change out of your pajamas! Buy a big tub of popcorn, order some pizzas and cuddle up on the couch surrounded by blankets. You’ll all love this because it’s just like being in high school again!

Go To a Comedy Show

If you’re looking for something more interactive than watching movies, then check out a comedy show! It will be exciting and hilarious at once so everyone should enjoy themselves.

Valentine’s Day Charity Event

Another option is to do a charity event. You and your single friends can volunteer at an Continue reading

1 … 529 530 531 532 533 … 3,792