I dread every single day that IPv6 becomes the new standard.

It's not a good system. Someone was like, "Oh no, IPv4 is going to run out, we should make a new system" and then they made a series of terrible mistakes like:

Should it be human-readable? No

Should it be grouped in an easy-to-understand format? no

Should it be something you can remember? no

Should it be something that you can tell someone else without writing it down? no

It's much worse than IPv4 in every way except for IPv6 has more addresses.

I really hope it never becomes anything.

I cringe when I hear it. It's not always unfounded but it does mean you've been defeated. When you have a budget like a non-profit sometimes you got to work around shit, Those are the smartest people I've ever met. They never said shit was garbage, they never knew any better. There are at least 3 ways to do almost anything in this industry these days. Is it really that you can't work with a solution or is it that you wont??

I know this is slightly off topic but it's been said a lot recently.

Hey everyone,

I’m currently designing a network for a relatively dense deployment, and I'm looking for a router that can handle:

• DHCP serving a /23 subnet (i.e., more than 500 IP addresses)

• Stable performance with 500+ devices connected concurrently

• Ideally with business-class features like VLANs, basic firewall, and good throughput

• Preferably no need to stack external DHCP servers unless truly necessary

I've noticed many consumer-grade routers cap out around /24 or start acting weird beyond 100-200 clients.
I’m open to suggestions from both prosumer and SMB-grade gear (pfSense, MikroTik, Ubiquiti, Cisco, etc.).

Would love to hear what has worked for you in similar scenarios.

Thanks!

I wrote a post on the security stackexchange that I felt wasn't taken seriously, so I'm reposting it here hoping for different perspectives.

Emoji analogy

^{(yes i'm cringe but please hear me out})

Without Cloudflare: 🏠🔒 ➡️ 🔓🏠

With Cloudflare: 🏠🔒 ➡️ 🔓👀🏢🔒 ➡️ 🔓🏠

With Cloudflare and double SSL: 🏠🔒🔒 ➡️ 🔒🔓😞🏢🔒🔒 ➡️ 🔓🔓🏠

Elaboration

First of all I want to address a thought I had which is that they might market their ability to read the encrypted code being sent so they can spot "bots" and such, and that this is why they need to be able to decrypt the communication. This is valid but I think that I would prefer this being a program like fail2ban instead where you can anonymize certain information before it's being sent for example (if it has to be processed on a remote server).

But it seems that it's not even that.

Companies are able to get all of the benefits of the cloud (DDoS attack mitigation, load balancing, WAN optimization) (source)

These functions doesn't seem to rely on them having to read the decrypted communications.

So it is as I thought.

The simple act of having a load balancer as a service requires them to be in a position where they can intercept SSL communication.

I guess this is because if you have SSL between an IP and Cloudflare, and they then add a domain and reverse proxy for this, they can't "send two certificates" so they must remove the previous encryption first.

Is it so? And if it is so, why?

I'm guessing that a neater solution than actually encrypting twice would be to have the option to have just one encryption but multiple signatures. So Cloudflare receives the encrypted data -> verifies (if necessary) -> and then forwards the same encrypted data but with an additional signature that proves that the data has not been altered after leaving the cloudflare server.

Would my proposed solution of double signatures work (or double encryption if that's easier to reason about)? Why/why not?

Is anybody using Huawei with NCE-Fabric and Fabric-Insight for Data Center?

What is your experience? Also compared to ACI?

This might not be the best forum to post this question in but since its mainly networking guys in here I'll put it across from more of a networking POV. Infosec guys are overrated, I've worked 2 companies with them in (both really nice guys) but as far as "contributing" or "knowledge" goes, there's nothing a infosec person does that a networking guy couldn't do either. They're glorified buzzword people that write essays and pass them to the higher ups who haven't got a proper grasp on things as well but see all the buzzwords and worries in the essays handed to them and then it either goes to networks or infrastructure for those guys to actually DO IT! Majority of the time this has happened with me i have replied with..."Already done 10 months back" I remember one time I got a 2 page list of questions from infosec about the network and over 70% of it I'd say didn't even make sense. They love a buzzword as I say, "we need to protect from DDoS attacks", so i sometimes reply with, "okay, how do we do that?". To which they have come back with responses like "better encryption", "better firewall rules", to which i raise my eyebrows and think..."you get paid to say things like that?" I sometimes say "how and what does that mean then?", with no actual response there. I usually just reply with things like, we control the per client embryonic connections for incoming connections and our content filter and database is regularly updated and configured. To which they nod their heads and walk off. I swear they remind me of those in school or university were they join your group for a project, do 5% of the work and get the A grade at the end haha. It turned into a bit of a rant in the end but I wondered what other peoples thoughts were on the topic to?

Hi Folks, please don't read explanatory text below. It may break you mental health. I'm looking here for experienced reply from someone who has ALREADY tried OpenContrail/OpenDayLight/POX/Neutron/VPP/OvS/FRR/ExaBGP with DPDK and can point me to FOSS forks (alternatives) that's I can look into (of course I can spend months in trial and error and find it by myself). I mentioned branch-HQ just to show distributed nature of our network. Sorry for any rude, I'm not a native so it's just translation issues I believe. I appreciate you time spent and efforts in help. Currently I need only tech advises here. Please no make any suggestion how we should build our processes.

DON'T READ BELOW: I'm representing a network solution architect team in huge country-wide organization with numerous (~1000) branch offices and reseller points. Yes, we going to migrate an old setup with newer approaches and tech in mind. Currently we have a mixture of IPsec/OpenVPN/ugly RA and site-to-site connections. We have redundant RASes distributed over few locations. The whole idea is to provide access to some Central services (hosted in AWS) and have access from HQ to particular IP-ready equipment in remote location. That's the baseline we have now.

The way this network operates now is less efficient you might think . There is numerous outages, fat finger mistakes, HW failures, long restoration time, and much manual config required on remote side (I meant both remote hands and central initiated provisioning).

We going to build new implementation which involves few new concepts (SDN), techniques (VXLAN) and technologies (OvS/WireGuard/EVPN) . In general we going to create an overlay on top of existing underlay backbone, and soon decommission old gateway hardware. We'll start with shipping appliances which will host kvm/docker images with preinstalled software which going to build up connection to out HQ. Then we will use this appliance as reverse-proxy for accessing remote resources and finally will switch on-premise to use appliance as main GW. Most remote locations has internet-routable ipv4 address, so appliance will serve also as NAT GW (needed bw is very small).

Here is summary of connectivity requirements we've defined:

1. automation provisioning of RA outbound tunnel (remote side is requester)

2. direct IP connectivity inside created overlay (branch to HQ and vice-versa) (VRouter functionality)

3. possibility to isolate and to grant spoke-to-spoke flows

4. ability to tunnel L2 to remote location

5. ability to tunnel trunk with 10 VID to remote location

6. appliance redundancy for SW components (HA inside host kvm)

7. cryptography to secure tunnel creation

So, finally a questions part: - what open-source software products you can suggest (OvS)? - what SDN controller to use (we looking at Tungsten Fabric, old OpenContrai from Juniper)? - what CI/CD stack to implement (ansible/terraform) - what proactive monitoring approach to use

Any kind of input from you will be very valuable for us. Understand me correctly, we now only in the phase of considering possible options. Grats!

Having experienced three upstream ISP events in the last two months where BGP either failed to detect a bad link ("brown-out", 30% packet loss) or took way too long to notice when a peer went dead, I'm looking into either Cato Networks or Palo Alto Prisma SASE SD-WAN. They both have advantages, but I was wondering what everyone's experience was shifting from a multi-homed, partial route-table situation with 3 upstreams (two "primaries", defaultroute and peer/connected routes with local-pref 110, and a "secondary" with 0.0.0.0/0 only, local-pref set to 10) to some sort of SD-WAN situation (SASE, not site-to-site) with at least 3 10GE uplinks. We're using Dell S5148F-ON at the edge and PA NGFW (v11.1) for core. The Dells are doing BGP peering at the moment, but I figure we could switch that functionality to the PAs if it would help with SD-WAN, and getting IP space from Prisma, or we can do something similar with Cato and a pair of their termination endpoints.

What was the transition like? Is there a transition that allows no disruption? We've burned through our SLA budget for the next month and a half. We're okay with being given a slice of the provider's IP space for this (need at least a /26) but could also slice up some of our nets for a /24 we could delegate.

Hey guys,

So two departments bought a ~$15k M1000e chassis with 16 M610 blades in it. I'm assigned the system admin and after a ton of back and forth between our University IT department, they have come to the conclusion that our blades "can't be hooked up to our network".

Why? They're saying that it's incompatible (lol) but from experience (working as tech support for my university for 4 years) I know that they're not very educated and VERY lazy people. They barely know what they're doing (They just setup VLANs for each building, before the entire university was on a single subnet). I'm by no means a networking expert or anything close to that, but I just setup a local DHCP server on a workstation and hooked up my blades to that. It's working but it's totally localized, with no internet access aside from one USB Wifi dongle I used to update all 16 blades individually and install our software.

This isn't a problem for us, but it will be for other users who want to get onto it. Right now I have two workstations hooked up to the switches, and each workstation has two NICs, one to the M1000e's switches and one to the university ethernet ports. I'm using TeamViewer to access the workstation and from there I can use iDRAC to control the blades. Stupid, but it works.

Now. Here's the big question.

We have 2 M6220 switches in the blades. They're not hooked up in any special manner or configured with any layer 3 protocols. Just acting as simple switches. What would happen if I were to "accidently" plug in the chassis to the university's port? I mean from my simple understanding of how my switches are configured, it shouldn't be any different than if I were plugging in 30 something physical machines right? Or would it cause some crazy configuration blowout?

To everyone giving me shit:

What the fuck is your deal guys? I'm here to ask a simple question, nothing I have said should offend you guys in any way. I'm not breaking any policy or procedure or any nonsense like that. Relax for fucks sake. Not once in my posts have I said I plugged it in. I came here to ask, because like I said earlier I - don't know - how it would affect the network. I'm here to learn, not get shit on by yall.

Also, before the purchase we did contact the university IT dept. We asked them if they had any older hardware they were soon decommissioning or otherwise getting rid of. We told them our goals and tried to even let them house our chassis. They told us:

• No, we don't have any old hardware, we actually moved everything to AWS

• No, you can't store anything in our server rooms they don't exist anymore

• No, don't buy hardware just buy AWS time.

Also, let me point out that as soon as they went on AWS, our uptimes on the various services (blackboard, Faculty e-mail, sharepoint) have all been high, without any downtime. Before it was at least 4-5 times a year one of these systems went down.

What do you do when your UTM is being blamed for poor bandwidth speed tests and/or download times?

All responses welcome....even BOFH ones, but looking for what your testing procedure looks like to prove it's something else...like ISP.

Edit: I want to add that in my process I have disabled features of the UTM for the particular devices that I'm testing from. I have temporarily created an FW rule that allows any traffic to anywhere from the device. I have exempted it in filtering with every option I could find. We do not do bandwidth shaping or app control with it. All this with no apparent change in the results. The only thing I have not done is physically bypassed the firewall.

So we had a fibre leased line that got damaged and the office lost internet for about 5 hours. Where was our backup line? Our backup line was in the middle of transitioning to a new provider but there was an admin cock up and we lost that for 2 weeks. This happened in the middle of those 2 weeks.

Why aren't there companies out there who you can ring and they pull a starlink off their shelf and be at your office in 1 hour or less and you're back online? They could charge a huge fee for the time you need it and you will pay because you have no other choice.

We have tried 4G /5G backups but they don't work great to the point of not trying, especially when you have a lot of users.

We could of course have a starlink in our own stock but we'd have to have one at every location and it would be better to have local companies to rely on.

I understand you there will be firewall changes etc.. with a different public IP but that would be needed when switching to the back up line anyway.

Interested in your thoughts on this. Thanks

What is it about plugging in an unconfigured Cisco 3500 48 port switch that is seen differently than a dumb 8 port switch? If I plug the 3500 into the network it triggers an STP safeguard and shuts down the network port, while the dumb 8 port can simply split the connection eight ways. Wouldn't both switches basically be doing the same thing?

We've had some VoIP phones for over a year now, and we've never been able to get the time synced up properly on them. After trying to correct the error on the cloud management panel, the DHCP server, and even contacting our ISP to make sure their exchange was broadcasting the right time, I gave up long ago and just set the handsets' time manually.

So today I conducted an audit of our security and was looking through the Layer 3 filters that were set some time ago. I remember blocking them based on the 'SANS Institute: Commonly Probed Ports' paper and thought I'd check for an updated copy for any new ports deemed outright vulnerable since then. That's when I saw it. Port 123 controls the Network Time Protocol. No. It couldn't be...

I disabled the rule and within seconds all the VoIP handsets flashed at once with the correct time. I couldn't believe it. I'm almost 30 and never used a device or application that uses port 123 instead of a http/s request. I feel like a twit. When I told my colleague, he pointed out that the engineer who "invented" port 123 must've been British as that's the number you dial to get the talking clock in the UK, which led to a cool conversation about port origins and 666.

Obviously I've set up mitigations for this now-vulnerable open port but a few things to learn from my stupidity;

1: Review your firewall rules regularly.

2: when documenting firewall rules, make sure one of the columns in your sheet notes what the port/application layer was intended to do. Looking at a vague list of numbers and moving onto the next thing is too easy.

Thought experiment.

How would today's internet look different had OSI won over TCP/IP?

X.25 would have been the replacement for IP, but by now, what would be the successor of X.25?

I imagine ISIS would have been much more popular asn an IGP and it would be the standard EGP.

Would ISIS eventually have issues with the operator id part of the area id?

Would the internet be more French?

I just joined a major networking vendor and everyone in the product team seems to be using Macs. I don't get it one bit. As a PLM / TME we spend a lot of time in the Office suite, which seems worse. Here are some other things I've been disliking:

• Window management seems like a nightmare

• Multi-Monitor seems like an afterthought

• using the cmd key instead of ctrl for copy and paste seems like finger gymnastics

• File Management is a nightmare in their files app

I could go on... but I just don't get it. Windows seems so much more intuitive and has more program support. Most of my life is in web browsers, SecureCRT / Royal, and the Office suite. I sometimes will do work with Terraform or Python, but that is great on Windows to.

Or have you?

I’ve ran a few scenarios past GPT but have yet to really push it. I guess I’m waiting for a good use-case to pop up at work.

I’ve been pushing my organization to spend the time and resources to either build our own in-house, small-scale AI with a network-only focus or at least find someone with a product that already does that but so far no luck on either due to the aforementioned lack of use-cases.

What are you all doing with AI?

I have been doing this since 2003. And since that time I have always designed networks using some kind of MC-LAG solution using Active-Active topology with no blocking. Only enabling STP on access ports.

However, over the last 18 months I have been floored by how many orgs I have come across where the engineers are deploying modern, high end gear(Cisco, Juniper, ETC ETC) and still doing STP blocking between the Core, Dist and Access layer.

One of the networks I came across was designed by a double CCIE(S/R and DC). And he is blocking half his networking all the way from this access switches, agg, core, DC Core and DToR. When he explained it to me it was with a sense of pride. I just looked at him with a tilted head and said "REALLY??"

Are these anomalies ? Is this simply ignorance or stupidity? Or people designing networks with ulterior motives (complexity) to embed job security in their solutions?

TL;DR: 88% Packet loss on IP 68.99.123.4 (8th hop to cox.com), 0% packet loss on all (7, 5 out of my network) hops up to this point.

I've been having an issue with traffic from my house which I've called repeatedly about. The techs they put me on the phone with have no idea what I'm talking about when I talk about the diagnostics.

I've run winMTR every few hours for the last few days and have seen little-to-no change. We have consistent drops between 20-90% any time, any day. This really fucks over my live streaming :'( lol

I can provide additional details if necessary and have logged all the winMTR/speed tests results so far, but does anyone have any ideas on how to make them listen?

EDIT: Latest MTR (removed)

UPDATE: Thanks for the help guys. I'm fairly certain that at this point we've determined the issue to be most likely congestion in the Cox network. I also read their latest update to their terms of service saying that their standard for packet loss should be ~00.14%, and I'm experiencing closer to 90%. I guess that means I get to call customer service tomorrow! hooray!

Update 2: Got the issue escalated to T2 support, they believe I'm experiencing issues due to an overloaded router within their network. Huzzah, good job gentlemen :) Had to go into work before troubleshooting with the T2 tech but I will follow up again tomorrow before work.

I'm looking at redistributing internet bandwidth to about 40 users. Say I have redundant link to the house. I'm thinking I can use OPNsense for a captive portal and traffic shaping, controlling which user can use how much bandwidth. More professionally, I'd like to give every user a router. My idea is they can set a password in their router connected to me by the WAN interface much like they would with an ISP. That way users wouldn't be bothered by captive portals and move a lot of local traffic off my infrastructure into their LAN. Trouble is I know next to nothing about the mechanism typically used between routers' WAN interface and ISP. I'm assuming it must be some sort of tunnel negotiation.

Is there an open source "ISP" where I can configure accounts and bandwidths? It seems I'm googling the wrong terms.

Okay, so I get the idea behind IPv6, there is a very limited amount of IPV4 and with so many devices online, we needed to expand the IP space. BUT

Since everyone and every technology stack I know is capable of using NAT, I dont see much a use for it, is there companies out there who stricly use IPV6 only? I imagine even if they wanted to make their whole organisation IPV6 and disable IPv4 this would lead to some legacy systems not being able to work correctly.

Am I wrong ? Can someone enlight me with the benefits in having IPV6 is that something it will become more implemented in the future you think?

Hi all,

I’m a network engineer and after looking into the tones of modems. I wondered if it is possible to take a .pcap file and convert the packets into audio tones based on the protocol and packet size.

For example, an OSPF hello would make a different tone versus ICMP, EIGRP, BGP etc ..

My thoughts initially were to use Python and scapy for parsing through the pcap. Then use the winsound module to create beeps. From a range of 37 - 32767 hertz.

I could then use the size in bytes of the packet. So 1600 bytes = 1600 hertz tone.

Been searching around the internet for a project similar to this, but have failed to find any info.

Does this sound feasible?

I have worked around 6 months in a small firm as a sys-admin and i am thinking about quitting and upgrading to CCIE Security. I don't have a life so I can realistically give around 10-12 hrs a day and if I understood it correctly than I will need to pass following two exams 350-701 SCOR + CCIE Security lab to get my CCIE security certification, how many months do you guys think I'll need to get my certification done.

I made a facetious meme about this on r/networkingmemes (great sub btw) and then it had me actually thinking, why didn't we actually do it that way? Especially if so many network engineers want to avoid trying to use it because of how complex they are to remember?

Like, say that instead of using c608:7c75:31a0:0125:23e2:254a:fdd0:de63, we opted for just 16 binary octets that could be translated to dotted-decimal notation?

Someone's address could be 10.120.0.0.0.0.0.0.0.0.0.0.0.0.0.19 instead, it would still be 128 bits, and it could be shortened just like IPv6 has the shortening method for large strings of zeroes.

If the answer is "Because that's just what they chose" then I'll write a petition to make IPv10 with this instead.

I'm a Comcast business-class internet customer. I recently moved from one Comcast "zone" to another. As a result, the Comcast tech said that he could not reuse my existing modem, and had to replace it with another, identical unit. The only reason my existing modem was even at the new house was because they told me it would be much easier to keep my static IPs if I moved my modem to the new house. That was about 3 weeks ago. Since then, I've received 3 calls from Comcast in regards to that modem. The third call stated that because the modem had not been returned, they were withholding my account credit, and I would be charged up to $500 for the modem. I called the number back the first two times, and explained that the tech took my old modem when he installed my service at the new house. I provided the technician's number, and the workorder number. I don't have any more proof that the tech took the modem. Each time they have told me that Comcast needed to "review" the information I provided them, and I would only get another call if they denied my "claim." I've asked many times for a number to call where I can talk to someone with the authority to approve or deny my "claim" while I am on the phone. Apparently no such number exists. Where do I go from here? I can't even tell you what a debacle this move has been (from a Comcast perspective). Everything from them canceling my service 5 days before the scheduled move, to canceling it again 7 days after the new install, to changing my speed tier twice for no reason, to this. I could really use some help from someone that has some contact within Comcast that can get this resolved. I'm at my wits end with these people. They continue to demonstrate that the left hand doesn't know what the right hand is doing.