I know, I know, I’m always saying that you don’t need a firewall. That’s mostly to get your attention to push my agenda of sane security architecture, I do actually believe that firewalls are appropriate in a great many use cases and I’ve managed them big and small ranging from Juniper SRX 5800 clusters to tiny purpose built BSD distros on custom hardware. I even managed Checkpoint and gauntlet firewall back in the 1990s. And Novell Border manager….good…

IP addressing and subnetting is a common interview subject. I assert that memorizing these things is useful for learning the concepts but ultimately futile in that it is time consuming and inefficient use of engineering time when tools can be utilized to accomplish the same goals in less time with fewer errors. Honestly, I gave up doing this kind of work manually around 10 years ago and have never regretted it, and in actuality, I’d probably struggle to do it at this point because…

Many network engineers are also tasked with maintaining systems that provide network services, those things that make the network easier to use such as DNS and DHCP or management systems that perform useful things like monitor the network, collect flow data or bestow access to the equipment by acting as bastion or jump hosts.  In many instances, robust and high availability services run on UNIX, Linux or BSD systems for stability and reliability, so those that manage these systems need to be…

Time to rewind from the new and shiny and get back to roots of networking. BGP is one of those odd protocols that is foundational to the functioning of the internet but yet somewhat hard to get experience with.  Say what you will about this venerable protocol, it’s been here a while and it is not going anywhere any time soon. I’ve been doing BGP since around late 1999, and I completely fell into it by accident, having only the Cisco Internet Routing Architectures book (which I…

I recently had the displeasure of dealing with a series of failed disks in my newly created ZFS based NAS.  I had cobbled together roughly 12TB of disk space and jammed them into an old PC, stretching the limits of the platform when I decided to go with ZFS.  I broke all of the rules, underpowered, single core PC, only a handful of GIG of non-ECC RAM, etc.  I’m sure storage guys are having a coronary after reading that, but it works for me and has minimal issues since I just relatively…

I am an absolutely huge fan of statistical and instrumentation data, especially when it comes to traffic analysis, visualization and baselining.  I’ve rambled on about the importance of it at every opportunity.  As a result of that, I have been doing work with netflow and netflow-like data for a fairly long time.  My first collector was the OSU Flow tools based stuff  back around 13 years ago.  From there I played with all kinds of netflow tools, both commercial and open source, finally…

As part of a larger fun project I’m working on (OVS for the ALIX platform; more to come on that once I have it 100% working), I have been playing a lot with OVS.  It’s a great platform, and as others have mentioned, it’s as close to an SDN reference data plane implementation as we have.  I’d be surprised if many if not all commercial implementations of OpenFlow aren’t based on OVS.  Anyway, I wanted to build debian packages since I’d never done it before and…

One of the things that I’ve always lamented about using non-Cisco hardware is the lack of true 1:1 netflow support.  Say what you will about jflow, cflow, sflow….there is no substitute for netflow, with sflow being the exception to that since it is a protocol that inherently supports ipv6 and can transport far more than simple network information if configured in certain ways on certain devices. On newer MX series Juniper routers the game has changed.  One to one flow data export…

I had the need to build a FlowVisor instance under CentOS.  Since nearly all of the docs I could find were for debian, I threw this together.  I utilized this GENI doc and the github docs as a simple reference.  This is the quick and dirty method I used: Install the prerequisites:``` sudo yum -y install ant eclipse java-1.6.0-openjdk.x86_64 git sudo yum -y groupinstall “Development Tools”

One of my biggest complaints about VMware is that it is an enterprise application. It has historically catered to the masses, which I completely understand, but those of us that aren’t a fortune 500 company are figuratively and operationally shoved into a corner and forced to find hackish ways of doing things to work around the enterprise nature. One really, really good example of this is OS dependency. I hated architecture dependencies back in the old days (x86, SPARC, PPC) and I…