Day Two Cloud 125: Scanning Infrastructure-as-Code For Security Issues

It's always better to catch misconfigurations and security issues earlier in your pipeline rather than later. That's especially true for cloud services where a simple configuration error can expose sensitive assets to the entire Internet. On today's Day Two Cloud podcast we discuss how to incorporate security checks into your Infrastructure-as-Code (IaC) workflows. Our guest is Christophe Tafani-Dereeper, a cloud security engineer.

The post Day Two Cloud 125: Scanning Infrastructure-as-Code For Security Issues appeared first on Packet Pushers.

Anycast Fundamentals

I got into an interesting debate after I published the Anycast Works Just Fine with MPLS/LDP blog post, and after a while it turned out we have a slightly different understanding what anycast means. Time to fall back to a Wikipedia definition:

Anycast is a network addressing and routing methodology in which a single destination IP address is shared by devices (generally servers) in multiple locations. Routers direct packets addressed to this destination to the location nearest the sender, using their normal decision-making algorithms, typically the lowest number of BGP network hops.

Based on that definition, any transport technology that allows the same IP address or prefix to be announced from several locations supports anycast. To make it a bit more challenging, I would add “and if there are multiple paths to the anycast destination that could be used for multipath forwarding¹, they should all be used”.

Anycast Fundamentals

Anycast is a network addressing and routing methodology in which a single destination IP address is shared by devices (generally servers) in multiple locations. Routers direct packets addressed to this destination to the location nearest the sender, using their normal decision-making algorithms, typically the lowest number of BGP network hops.

Finally, A Coherent Interconnect Strategy: CXL Absorbs Gen-Z

It is refreshing to find instances in the IT sector where competing groups with their own agendas work together for the common good and the improvement of systems everywhere. …

Finally, A Coherent Interconnect Strategy: CXL Absorbs Gen-Z was written by Timothy Prickett Morgan at The Next Platform.

Turbocharging AKS networking with Calico eBPF

A single Kubernetes cluster expends a small percentage of its total available assigned resources on delivering in-cluster networking. We don’t have to be satisfied with this, though—achieving the lowest possible overhead can provide significant cost savings and performance improvements if you are running network-intensive workloads. This article explores and explains the improvements that can be achieved in Microsoft Azure using Calico eBPF in AKS, including reducing CPU usage, decreasing complexity, enabling easier compliance and troubleshooting, and more.

Before going into details about how exactly Calico takes advantage of eBPF, it is important to note that in the context of this article, Calico is viewed as an additional networking layer on top of Azure CNI, providing functionality that turbocharges its performance. In particular, the standard instructions for installing Calico’s network policy engine with AKS use a version of Calico that pre-dates eBPF mode.

Accelerating network performance

Test methodology

To show how Calico accelerates AKS network performance using eBPF, the Calico team ran a series of network performance benchmarks based on the k8s-bench-suite. These performance benchmarks compared the latest Calico eBPF data plane (using the iptables data plane) with a vanilla AKS cluster.

Tests were run using Standard_D2s_v3 nodes, which are a Continue reading

Network Modeling: Segmented Lab access with Containerlab and ZeroTier

Introduction

When building out network labs, often multiple people will need access to the lab. The main way right now is to use something like EVE-NG or GNS3 to provide access.

There are 2 downsides to this method. The first is that your server is exposed to the internet and if your usernames/passwords aren’t strong enough, your server can become compromised. The second is that sometimes you may not want everyone to be able to add or edit to the lab topology.

The solution to this is using Containerlab and ZeroTier. This setup is great for things like testing new hires, training classes, or for providing lab access to others on a limited basis.

What is Containerlab?

Containerlab is a container orchestrating tool for managing container-based networking labs. It doesn’t just support Container based Network Operating Systems though. Through vrnetlab, there is support for a wide variety of commonly used NOSes: Mikrotik RouterOS, Nokia SROS, Juniper vMX and vQFX, and many more.

Configs are text based making it easy to add/update links between nodes. The lab does need to be destroyed and redeployed when adding/removing links. With some tools to generate configs, it’s easy to spin up a 500+ node Continue reading

Image/Data set collection – ML Hobby Post 2

Why is this required?

While Deep Learning is in many different categories ( like Vision, Text (NLP), Audio, Recommendation system), My interest is always in Vision or anything which involves images, I somehow to find it closer to embed into a hobby than other aspects
Any Part of Image-based Learning, involves a set of Images that are needed to train the model on what is our intention to recognize parameters, for example, consider the below image set called CIFAR-10.
- https://www.cs.toronto.edu/~kriz/cifar.html — This is the URL, this has a predefined collection of 10 different categories of Images that can be used for training the classifier of an image if the Image is among any of the 10 categories.
Ordinarily, Let us say you wanted to categorize a Dog in a given picture or you had a scenario where you had months collected time-lapse photos and wanted to categorize Dog and filter out the images which involved Dog in it, you don’t have to collect so many images to train, test and build the model, Data is readily available
Other Popular datasets — https://docs.fast.ai/data.external.html has lot of pre-collected Datasets at our disposal and https://www. Continue reading

What Rescale’s $105M Funding Round Says About HPC Cloud

Patience in a slow-growing market is tough, but supercomputing cloud startup, Rescale, is reaping rewards for its persistence. …

What Rescale’s $105M Funding Round Says About HPC Cloud was written by Nicole Hemsoth at The Next Platform.

Governing a Growing API Portfolio

To achieve API governance requires putting the right tools, frameworks, and guardrails in place. That will enable organizations to securely embrace the growing digital economy.

Announcing Argo for Spectrum

Today we're excited to announce the general availability of Argo for Spectrum, a way to turbo-charge any TCP based application. With Argo for Spectrum, you can reduce latency, packet loss and improve connectivity for any TCP application, including common protocols like Minecraft, Remote Desktop Protocol and SFTP.

The Internet — more than just a browser

When people think of the Internet, many of us think about using a browser to view websites. Of course, it’s so much more! We often use other ways to connect to each other and to the resources we need for work. For example, you may interact with servers for work using SSH File Transfer Protocol (SFTP), git or Remote Desktop software. At home, you might play a video game on the Internet with friends.

To help people that protect these services against DDoS attacks, Spectrum launched in 2018 and extends Cloudflare’s DDoS protection to any TCP or UDP based protocol. Customers use it for a wide variety of use cases, including to protect video streaming (RTMP), gaming and internal IT systems. Spectrum also supports common VoIP protocols such as SIP and RTP, which have recently seen an increase in DDoS ransomware attacks. A lot of Continue reading

Using the script command on Linux to record command line activity

The Linux script command has been around for ages and provides a simple but useful service. It lets you record command line activity – both input and output. This can be very helpful in troubleshooting problems or verifying what was done later by reviewing the commands that were run along with their output.Even if you've used the script command time to time, it offers more options than many of us realize. In this post, we will look at the simplest use of script and some of the options that can make it even more useful.The easiest way to use the script command is simply to type "script" in the terminal window and press ^d when you want to stop the recording. The output, by default, will be saved in a file called "typescript". You will see the file name that is used in the first line of output.To read this article in full, please click here

Using the script command on Linux to record command line activity

Cisco CCIE certification explained

Cisco Certified Internetwork Expert is Cisco’s most prestigious and most difficult certification to achieve, typically requiring years of industry experience and a deep understanding of networking technologies. The lab portion of the exam alone is eight hours long and costs $1,600, and candidates typically spend much more than that on preparatory courses. But professionals with the expert-level CCIE networking certification are in demand, and the value is reflected in significantly higher salaries. "It is a preeminent certification in the industry," says Nick Marentic, senior manager for IT infrastructure and security at cybersecurity training firm Cybrary. "It requires years in the industry to understand the concepts contained."To read this article in full, please click here

Multi-Threaded Routing Daemons

When I wrote the Why Does Internet Keep Breaking? blog post a few weeks ago, I claimed that FRR still uses single-threaded routing daemons (after a too-cursory read of their documentation).

Donald Sharp and Quentin Young politely told me ~~I was an idiot~~ I should get my facts straight, I removed the offending part of the blog post, promised to write another one going into the details, and Quentin improved the documentation in the meantime, so here we are…

Multi-Threaded Routing Daemons

When I wrote the Why Does Internet Keep Breaking? blog post a few weeks ago, I claimed that FRR still uses single-threaded routing daemons (after a too-cursory read of their documentation).

ScaleFlux Takes Computational Storage Up A Notch With Homegrown Chip, Software Tools

A key trend in the ever-changing IT world is bringing whatever is needed – processing, storage, analytics, networking – closer to where the data is. …

ScaleFlux Takes Computational Storage Up A Notch With Homegrown Chip, Software Tools was written by Jeffrey Burt at The Next Platform.

Why 2022 will be the year for edge automation

image (30) Seamlessly, every single day, we wake up and check our health statistics in smart watches, scan QR codes to validate information, pay using credit cards in different locations, use surveillance cameras to record our neighborhoods, and connect our smartphones to distributed WiFi access points in our restaurants or coffee shops. According to the Statista, in the Forecast number of mobile users worldwide 2020-2025^[1] report, the number of mobile users worldwide reached 7.1 billion in 2021, and this number is projected to grow. This initiates a new set of use cases for edge devices due to the explosive growth of network-connected entry points.

Edge computing and networking is not specific to any industry; all of these scenarios span many different types of organizations. However, all edge scenarios have one common factor: creating and consuming data resources that are geographically distributed. As a final objective we want to analyze, consume or react to data to fulfill our customer and business needs.

Edge challenges here, and now

12 years ago, I was the network administrator for a bank. We had a branch office connected through a satellite link, which was easily impacted by the constant heavy rains. In the Continue reading

Tech Bytes: Why Customers Should Care About SASE Architecture (Sponsored)

Today on the Tech Bytes podcast we’re diving into SASE, which provides firewalling, Web filtering, and more as a cloud-delivered service. Sponsor Palo Alto Networks is here to make that case that how the service is architected matters, and how Palo Alto integrates SD-WAN and digital experience management into the service.

Tech Bytes: Why Customers Should Care About SASE Architecture (Sponsored)

The post Tech Bytes: Why Customers Should Care About SASE Architecture (Sponsored) appeared first on Packet Pushers.

Network Break 360: Facebook Chooses Cisco ASIC For OCP; Apple To Allow Limited Self-Service Repair

This week's Network Break podcast examines why Facebook has chosen Cisco and Broadcom ASICS for new Open Compute Project switch designs, Apple will allow self-service repair of two iPhone models, Fortinet partners with Azure on SD-WAN and firewalls, Cisco and NVIDIA announce quarterly earnings, and more tech news.

« Previous 1 … 569 570 571 572 573 … 3,791 Next »