flowtrackd: DDoS Protection with Unidirectional TCP Flow Tracking

flowtrackd: DDoS Protection with Unidirectional TCP Flow Tracking
flowtrackd: DDoS Protection with Unidirectional TCP Flow Tracking

Magic Transit is Cloudflare’s L3 DDoS Scrubbing service for protecting network infrastructure. As part of our ongoing investment in Magic Transit and our DDoS protection capabilities, we’re excited to talk about a new piece of software helping to protect Magic Transit customers: flowtrackd. flowrackd is a software-defined DDoS protection system that significantly improves our ability to automatically detect and mitigate even the most complex TCP-based DDoS attacks. If you are a Magic Transit customer, this feature will be enabled by default at no additional cost on July 29, 2020.

flowtrackd: DDoS Protection with Unidirectional TCP Flow Tracking

TCP-Based DDoS Attacks

In the first quarter of 2020, one out of every two L3/4 DDoS attacks Cloudflare mitigated was an ACK Flood, and over 66% of all L3/4 attacks were TCP based. Most types of DDoS attacks can be mitigated by finding unique characteristics that are present in all attack packets and using that to distinguish ‘good’ packets from the ‘bad’ ones. This is called "stateless" mitigation, because any packet that has these unique characteristics can simply be dropped without remembering any information (or "state") about the other packets that came before it. However, when attack packets have no unique characteristics, then "stateful" mitigation is required, because whether a Continue reading

In defense of open debate

Recently, Harper's published a Letter on Justice and Open Debate. It's a rather boring defense of liberalism and the norm of tolerating differing points of view. Mike Masnick wrote rebuttal on Techdirt. In this post, I'm going to rebut his rebuttal, writing a counter-counter-argument.

The Letter said that the norms of liberalism tolerate disagreement, and that these norms are under attack by increasing illiberalism on both sides, both the left and the right.

My point is this: Masnick avoids the rebutting the letter. He's recycling his arguments against right-wingers who want their speech coddled, rather than the addressing the concerns of (mostly) left-wingers worried about the fanaticism on their own side.


Free speech

Masnick mentions "free speech" 19 times in his rebuttal -- but the term does not appear in the Harper's letter, not even once. This demonstrates my thesis that his rebuttal misses the point.

The term "free speech" has lost its meaning. It's no longer useful for such conversations.

Left-wingers want media sites like Facebook, YouTube, the New York Times to remove "bad" speech, like right-wing "misinformation". But, as we've been taught, censoring speech is bad. Therefore, "censoring free speech" has to be redefined to as to not Continue reading

How To Deploy Containers to Azure ACI using Docker CLI and Compose

Running containers in the cloud can be hard and confusing. There are so many options to choose from and then understanding how all the different clouds work from virtual networks to security. Not to mention orchestrators. It’s a learning curve to say the least.

At Docker we are making the Developer Experience (DX) more simple. As an extension of that we want to provide the same beloved Docker experience that developers use daily and integrate it with the cloud. Microsoft’s Azure ACI provided an awesome platform to do just that.

In this tutorial, we take a look at running single containers and multiple containers with Compose in Azure ACI. We’ll walk you through setting up your docker context and even simplifying logging into Azure. At the end of this tutorial, you will be able to use familiar Docker commands to deploy your applications into your own Azure ACI account.

Prerequisites

To complete this tutorial, you will need:

Network Break 292: Nokia Debuts SR Linux Network OS; AT&T, Cisco Team Up On SD-WAN

On today's Network Break we discuss Nokia's new network OS, examine a Cisco/AT&T partnership on SD-WAN, and analyze Google's pullback from a cloud venture in China. We also cover a new video codec and an image format that will save bandwidth, the rise of online learning, and what Uber's Postmates acquisition can tell us about IT startups.

The post Network Break 292: Nokia Debuts SR Linux Network OS; AT&T, Cisco Team Up On SD-WAN appeared first on Packet Pushers.

Tech Bytes: Intent-Based Networking And The Evolution Of Automation (Sponsored)

Today's Tech Bytes dives into Intent-Based Networking (IBN) as an evolution of network automation. Apstra is our sponsor for this episode and our guest is Mansour Karam, fouder and President. We discuss how IBN advances traditional automation, Apstra's support for open networking, customer use cases, and more.

The post Tech Bytes: Intent-Based Networking And The Evolution Of Automation (Sponsored) appeared first on Packet Pushers.

Holding Steady: How CDNs, IXPs, and Network Providers Help Keep us Online

Although the COVID-19 pandemic is, unfortunately, far from over, the Internet continues to be resilient, supporting the additional demands that we have placed on it, including the rapid growth in online learning, work videoconferences, e-commerce, streaming video entertainment, and more.

Because the Internet exists as a network of networks, this resilience is largely due to the planning, actions, and cooperation of all of the interconnected participants. These participants include, but are certainly not limited to, network providers, Internet Exchange Points (IXPs), and Content Delivery Networks (CDNs).

Expanding Infrastructure

On the network side, major providers such as Comcast have invested billions of dollars over the last several years in expanding fiber infrastructure and growing network capacity. In contrast, community network provider NYC Mesh is leveraging DIY customer installations to grow its own infrastructure during the pandemic. While there is still much work to be done, these efforts by both large and small network operators as well as similar operators all over the world, are making reliable broadband connectivity more widely available. Infrastructure expansion is vital as the current pandemic has shown that access to reliable Internet is now more important than ever before.

Fast and Reliable Content Delivery

CDN providers are also doing their Continue reading

Your Security Products Are Insecure, With Data

The video is queued on the section where the talk highlights the security software (firewalls, threat detection etc) is actually the weakest link. He then presents the data that security vendors have become the weakest link in the security landscape. The asymmetry of defence is highlighted by the fact that security appliances have 10MM lines […]

The post Your Security Products Are Insecure, With Data appeared first on EtherealMind.

Zero Trust and the Cookie Metaphor

In old presentations on network security (watch this space; I’m working on a new security course for Ignition in the next six months or so), I would use a pair of chocolate chip cookies as an illustration for network security. In the old days, I’d opine, network security was like a cookie that was baked to be crunchy on the outside and gooey on the inside. Now-a-days, however, I’d say network security needs to be more like a store-bought cookie—crunchy all the way through. I always used this illustration to make a point about defense-in-depth. You cannot assume the thin crunchy security layer at the edge of your network—generally in the form of stateful packet filters and the like (okay, firewalls, but let’s leave the appliance world behind for a moment)—is what you really need.

There are such things as insider attacks, after all. Further, once someone breaks through the thin crunchy layer at the edge, you really don’t want them being able to move laterally through your network.

The United States National Institute of Standards and Technology (NIST) has released a draft paper describing Zero Trust Architecture, which addresses many of the same concerns as the cookie that’s crunchy Continue reading

How to Create a Self-Organized Network of Vendors for Your Small Business

When you start a business, there are many things that you need to look into – from what brands you will allow being a part of your business to which vendors to use. These are all essential decisions that need to be taken by you so that you can decide on the future of your business.

The only way to get through to it is to do your research. By research, what is meant is to do your work on finding the perfect brands and perfect vendors that will help you and your business grow seamlessly and without any issues.

Hence, in this article, you will be told how to create a self-organized network and how you can incorporate vendors into it. Let’s begin.

How to Create a Self-Organised Network of Vendors

Now, this is where the article helps you fulfil the reason why you are here in the first place. We’ll briefly review how to create a good network of vendors that will help in increasing the outlook and the growth of your business.

The relationship that you have with your vendors will be key and will be the basis of your business doing good, so you need to Continue reading

From Micro-segmentation to Internal Firewalling

The Evolution of VMware NSX Service-defined Firewall

Today, many people take micro-segmentation for granted. It’s incredible to recall that just a few years ago, VMware introduced micro-segmentation to support the concept of Zero Trust — a security model that does not automatically trust entities within the security perimeter. Fast forward to the present, and many people have embraced that concept and made it their own. Meanwhile, VMware has extended its solution for micro-segmentation into a full-blown internal firewall. Let’s step back in time and see how VMware progressed from the initial micro-segmentation use case to today’s powerful Service-defined Firewall, deployed by thousands of organizations.

Pioneering the Market for Micro-segmentation

Back in 2013, VMware pioneered micro-segmentation with the release of VMware NSX, the VMware network virtualization and security platform, which propelled VMware into the world of software-defined network and security virtualization. This initial release enabled customers to run a complete Layer 2-Layer 4 stack in software. The guiding philosophy was to make world-class security easy to operationalize.

Some customers used NSX for network segmentation: they created virtual security zones in software where they had previously used hardware. Other customers adopted NSX for micro-segmentation: they were now able to provide Continue reading

An Architecture for Artificial Intelligence Storage

As we’ve talked about in the past, the focus on data – how much is being generated, where it’s being created, the tools needed to take advantage of it, the shortage of skilled talent to manage it, and so on – is rapidly changing the way enterprises are operating both in the datacenter and in the cloud and dictating many of the product roadmaps being developed by tech vendors. …

An Architecture for Artificial Intelligence Storage was written by Jeffrey Burt at The Next Platform.

The Week in Internet News: Balloon-Based Internet Comes to Kenya

Up, up and away: Google’s Project Loon, focused on providing Internet access with balloons floating in the stratosphere, has begun providing service in Kenya, CNN reports. The project will use about 35 balloons floating 20 kilometers above the ground to provide 4G LTE service covering 50,000 square kilometers in central and western Kenya.

Reach the sky: A broadband cooperative in rural Pennsylvania has built its own wireless network to provider faster Internet service, The Philadelphia Inquirer says. The Rural Broadband Cooperative, made up mostly of retirees, uses a 120-foot, former HAM radio tower that they erected on Stone Mountain. The service, with about 40 paying customers, offers speeds of up to 25 megabits per second.

The great divide: The COVID-19 pandemic has shown the seriousness of the digital divide in Pakistan, The Diplomat says. While the country has moved to online school, many areas lack broadband service, and in some areas, mobile services are shut down by the government because of security concerns. “Students across the country, from the former Federally Administered Tribal Areas to Balochistan, have been protesting against online classes, not only on social media but in front of various press clubs, universities, and on roads. They have Continue reading

Weekend Reads 071020

Better late that never … ?

For decades, we have prized efficiency in our economy. We strive for it. We reward it. In normal times, that’s a good thing. Running just at the margins is efficient. A single just-in-time global supply chain is efficient. Consolidation is efficient. And that’s all profitable. Inefficiency, on the other hand, is waste. Extra inventory is inefficient. Overcapacity is inefficient. Using many small suppliers is inefficient. Inefficiency is unprofitable. —Bruce Schneier

In this post, we describe the challenges associated with measuring anycast services and propose a tool called the Border Gateway Protocol (BGP) Tuner. By using our open-source tool, operators can see in advance how changes in their BGP policies may impact the traffic load distribution over the anycast sites. This post is a short description of our technical report available here. —Joao M. Ceron

There are increasing calls to break up, tax, regulate or [other intervention here] Big Tech. What I’m curious about is what for. —Matt Webb

Hence I made a self-experiment in which I generated two certificates with random names, monitoring the authoritative DNS servers as well as the IPv6 addresses of those names in order to check who is resolving/connecting to otherwise Continue reading

Juniper aligns its security portfolio with the SASE model

The conga line around secure-access service edge (SASE), continues to grow with Juniper this week becoming the latest to join the dance.Just as other big networking players with extensive security portfolios including Cisco and VMware have recently done, Juniper says it will build off its offerings to address the SASE blueprint. Read about edge networking How edge networking and IoT will reshape data centers Edge computing best practices How edge computing can help secure the IoT As defined by Gartner in 2019, SASE features a wide variety of components that Juniper summarized and includes:To read this article in full, please click here

Juniper targets security portfolio at SASE race

The conga line around secure-access service edge (SASE), continues to grow with Juniper this week becoming the latest to join the dance.Just as other big networking players with extensive security portfolios including Cisco and VMware have recently done, Juniper says it will build off its offerings to address the SASE blueprint. Read about edge networking How edge networking and IoT will reshape data centers Edge computing best practices How edge computing can help secure the IoT As defined by Gartner in 2019, SASE features a wide variety of components that Juniper summarized and includes:To read this article in full, please click here

Fast Friday Random Thoughts

It’s Friday and we’re technically halfway into the year now. Which means things should be going smoother soon, right? Here’s hoping, at least.

  • I posted a new episode of Tomversations yesterday. This one is about end-to-end encryption. Here’s hoping the Department of Justice doesn’t find a way to screw this up. And here’s hoping the Senate stops helping.
  • I saw a post that posits VMware may be looking to buy BitGlass. I know VMware’s NSX team pretty well. I also talked to the BitGlass team at RSA this year. I think this is something that VMware needs to pick up to be honest. They need to round out their SASE portfolio with a CASB. BitGlass is the best one out there to make that happen. I think we’re going to see a move here before we know it.
  • There are a lot of other acquisitions going on in the market. VMware bought Datrium. Uber bought Postmates. It’s typical to see these kinds of acquisitions during downturns because it becomes way cheaper to snap up your competition. I expect Q3 is going to be full of consolidation in the networking space. Cisco won’t start doing anything until August at the earliest, Continue reading

Heavy Networking 528: If Automation Is So Great, Why Aren’t More Networks Automated? (Sponsored)

On today's Heavy Networking episode, sponsored by Cisco, we discuss reasons why automation isn't more pervasive, particularly in networking, and look at complications such as source of truth, getting state information, the need for orchestration, and user trust. Our guests are Omar Sultan, Leader, Product Management at Cisco; and Kevin Corbin, Sr. Solutions Engineer at HashiCorp.
1 … 923 924 925 926 927 … 3,841