Bilingual

How to ask for help from people who don't know you
19 days ago
- Asking for help is a skill, not an innate attribute; the key principle is to put yourself in the other person's mind.
- To make someone want to help, demonstrate you are worth helping by showing proof of work, personal connections, or institutional credibility, with proof of work being the strongest.
- Explain context concisely by connecting it to what the other person already knows, using borrowed attention wisely.
- Make requests easy to accept by reducing costs, being specific, low-friction, and bounded in scope.
- Make it easy for the other person to say no to avoid pressured yeses and build genuine, willing help that fosters relationships.
- Never lie in requests, as dishonesty undermines credibility and any chance of a positive response.
TLS certificates for internal services done right
12 days ago
- Using split-horizon DNS allows the same domain to resolve to public or private IPs based on client connection.
- Setting up a WAF (e.g., via nginx) blocks traffic from public internet, adding security beyond DNS.
- Automating certificate renewal with acme.sh and cron jobs ensures ongoing TLS without manual intervention.
- Using SAN certificates enables multiple subdomains under one certificate, avoiding wildcard security risks.
BYO NOS: Building a maintainable, SRE-friendly switch
5 days ago
- The author previously used an Arista 7050QX2-32S switch, which is nearing end of life, and sought alternatives due to the vendor's unique support for third-party daemons like BIRD.
- Whitebox switching options like SONiC and DENT were considered; DENT uses switchdev for Linux kernel integration, allowing hardware offload similar to Arista.
- A Mellanox SN2010 switch with Spectrum ASIC was selected for its switchdev support, and Debian was installed after configuring the kernel and udev rules for mlxsw.
- Breakout cables were configured using devlink, and network interfaces were managed with systemd-networkd, though it required verbose configuration.
- Routing challenges included limited ASIC route capacity; solutions involved resource reallocation, ECMP default routing, and route compression via a custom Go tool to reduce routes from ~1.2 million to ~92k.
- ACLs were implemented using TC (Traffic Control) with features like blocks and chain templates to optimize hardware offload and resource usage, including actions like goto, trap, and pedit.
- Egress control was achieved through VLAN rewrites and additional routing tables, allowing traffic steering based on DSCP values without reconfiguring the router.
- Monitoring utilized standard tools like Node Exporter and hsflowd, with custom exporters for devlink metrics, ensuring comprehensive system and dataplane visibility.
- Maintenance is simplified as the system runs on Debian with upstream tooling, enabling easy updates and config management, exemplified by a quick kernel update for security vulnerabilities.
HomeLab #1: MikroTik as a Home Router
2 days ago
- Setting up a homelab begins with proper networking; MikroTik L009UiGS-RM is chosen for multiple Gigabit Ethernet ports and PoE capabilities.
- Before configuration, identify ISP setup: authentication method (IPoE or PPPoE) and IPv4 type (public vs. private/CGNAT).
- For PPPoE with VLAN, clone ISP router's MAC address on MikroTik's WAN port and create VLAN interface before PPPoE client setup.
- WiFi management uses separate wAP access point with PoE; RouterOS CAPsMAN centralizes configuration for multiple access points.
- Bufferbloat causes latency spikes during network saturation; implement FQ-CoDel queue discipline at 90-95% of line rate to reduce delays.
Designing an Ethernet Switch ASIC
19 hours ago
- The author built the world's first open source switch ASIC, expected back from fabrication in mid-November.
- Open source networking ASICs are rare; most open source silicon projects focus on RISC-V SoCs, not networking equipment.
- The switch is a 3-port, full-duplex, 100 Mbps, cut-through, unmanaged Ethernet switch due to constraints on pins, area, and ease of use.
- Design constraints include limited pins (8 I/O, 8 output, 8 bidirectional) and die area, forcing the use of an external PHY chip (Microchip LAN8720A) via RMII interface.
- The switch uses a 4-entry address table with TTL-based aging (300 seconds) and a replacement policy for new MAC learning.
- FPGA emulation revealed that the switch works but 100 Mbps is too slow for large data transfers like SSH with GUI forwarding.
- The switch is part of the 'Coffee Shop' family of open source networking IP, including coffeepot, teapot, and coldbrew ASICs.
- Future plans include scaling to a full chip with 8 ports and implementing a content-addressable memory (CAM) for larger address tables.

Hasty Briefsbeta

#networking

How to ask for help from people who don't know you

TLS certificates for internal services done right

BYO NOS: Building a maintainable, SRE-friendly switch

HomeLab #1: MikroTik as a Home Router

Designing an Ethernet Switch ASIC