Technology
Protecting Router & Switch Control Plane with CoPP/CPP…
A CoPP/CPP model that classifies and polices routing, management, and ICMP traffic on the router/switch control plane to reduce CPU exhaustion and adjacency…
Technology
333 posts
Deep dives into software, cloud computing, AI and technology trends.
Technology
OSPF/IS-IS Authentication: Block Rogue Neighbors in the Routing Domain
Reducing the risk of rogue neighbors and route injection in the routing domain through OSPF/IS-IS authentication, key rotation, and control-plane hardening.
Technology
Multi-Region Traffic Steering and Failover Discipline with GSLB
Traffic steering discipline for multi-region services using GSLB, built around health signals, hold-down, and controlled failback.
Technology
BMC (iDRAC/iLO/IPMI) Hardening and Management Segmentation
An operating model for the BMC (iDRAC/iLO/IPMI) attack surface using segmentation, identity, audit, and break-glass to keep it secure and auditable.
Technology
DoH/DoT/DoQ in Enterprise Networks: Policy and Visibility
A controlled-transition, telemetry, and runbook approach for enterprise policy and visibility in a world of encrypted DNS via DoH/DoT/DoQ.
Technology
BGP Traffic Engineering Runbook for the Enterprise Edge
A practical runbook for steering traffic with localpref, community, prepend, and MED in multi-ISP and multi-POP environments — measurable and reversible.
Technology
Load Balancer, Keepalive, and Retry Budgets for gRPC/HTTP2 Traffic
A practical architecture and operations guide for handling long-lived HTTP/2 connections, idle timeouts, and retry storms without losing your SLO.
Technology
Online Schema Migration: Expand/Contract, Backfill, and Dual Write
An expand/contract approach for schema changes without downtime, plus backfill strategy, dual-write risks, and a rollback plan.
Technology
Sticky Sessions and Load Balancer Decisions for Stateful Traffic
When are sticky sessions essential and when are they technical debt for WebSocket, long TCP sessions and stateful applications? A decision matrix grounded…
Technology
Enterprise SSO Federation: A SAML/OIDC Gateway Architecture
An SSO broker design that unifies legacy SAML applications and modern OIDC services under a single identity policy — secure and operationally manageable.
Technology
MTU and PMTUD Blackhole: An Incident Runbook
When some users work and others don't, a frequent cause is broken PMTUD and an MTU blackhole. Diagnosis steps and a permanent fix.
Technology
Edge Service Design with BGP Anycast: DNS and DDoS Resilience
A practical edge design guide that addresses routing, health signals, capacity, and attack scenarios together to see Anycast's real benefits.
Technology
Egress Control in ZTNA: Designing Against Data Exfiltration
ZTNA isn't just about inbound access. A practical approach to data leakage with egress (outbound) control, DLP signals and service-centric segmentation.
Technology
DDoS Scrubbing Center Design: GRE, BGP, and Failover
GRE tunnels, BGP signaling, capacity, and an operational runbook to keep the service up by diverting traffic to scrubbing during an attack.
Technology
Preventing Edge Outages with BGP Max-Prefix Limits
Designing, monitoring, and writing an incident runbook for the max-prefix guardrail that protects edge routers during route leaks and bad-prefix waves.
Technology
Enterprise DNS Firewall with DNS RPZ: Threat Blocking and Operations
Build a sustainable DNS security control by blocking threat domains via RPZ at the recursive resolver, with proper exception handling and observability.
Technology
Path Selection and Incident Triage with SLA Probes in SD-WAN
Choosing the right path for application classes via active probes that measure latency/jitter/loss; rapid diagnosis during degradation and a controlled…
Technology
Self-Hosted CI Runner Security: Isolation, OIDC and Secrets
A practical model that lowers supply-chain risk on self-hosted CI runners with isolation, network boundaries and OIDC-based short-lived authorization.
Technology
Network Telemetry with IPFIX/NetFlow: A Pipeline for DDoS and Capacity
Build an operational telemetry pipeline by collecting and enriching IPFIX/NetFlow streams for DDoS triage, capacity planning, and anomaly detection.
Technology
QUIC / HTTP/3: Security and Operations on Enterprise Networks
A practical approach to managing HTTP/3 traffic over UDP/443 without breaking security, visibility, or performance.
Technology
Kubernetes Etcd Encryption at Rest + KMS Design
Protecting Secrets with real cryptography rather than just base64: encryption configuration, KMS integration, and an operational rotation model.
Technology
L2 Encryption with MACsec in Enterprise Networks
Hardening campus and data center backbones by encrypting L2 links with MACsec (802.1AE): design choices, risks, and operations.
Technology
Firewall Rulebase Cleanup: Waves with Hitcount and Shadow Rules
Pull your firewall rule set out of the 'don't touch it, it'll explode' state with hitcount, log evidence, ownership, and a wave-based approach to safely…
Technology
Segmentation and Governance with Transit Gateway in Hybrid Cloud
A practical architecture guide that handles hub-spoke and Transit Gateway design together with security, route control, and operational observability.