Hasty Briefsbeta

All tags

#networking

197 stories total

Bilingual

How to become your own ISP (WHY2025) [video]
9 months ago
- Deep dive into how the internet works at its core.
- Learn about BGP, AS-numbers, and IP-prefixes.
- Understand how to participate in internet infrastructure.
- Gain practical knowledge on getting started with networking.
- Explore a real-world example of a personal network setup.
Dumb to Managed Switch Conversion
9 months ago
- Author replaced old cat2 telephone cables with modern cat5e in their new house.
- Initially used an old 100MBit switch due to time constraints.
- After a year, upgraded to a managed 8-port GBit switch for better network setup.
- Bought an unmanaged TP-link TL-SG1005D switch for workstation to save costs.
- Realized unmanaged switch couldn't handle VLANs needed for the access point.
- Discovered the RTL8366SB chip inside the switch supports VLAN and other managed features.
- Plans to configure the switch via I2C using an AVR microcontroller.
One person was able to claim 20M IPs, or 9% of all IPv4 hosts
9 months ago
- A player named femboy.cat has claimed 20 million IPs (9% of all IPv4 hosts) on the IPv4 Games service.
- The service requires a TCP three-way handshake to claim an IP, and the server ignores HTTP headers like x-forwarded-for.
- Possible methods for claiming IPs include embedding tracking pixels in ads, using residential proxies, or compromising high-traffic websites.
- Suggestions include using Google Ads with free credits to generate HTTP GET requests from various IPs.
- Residential proxies and popular websites embedding the claim URL are also speculated methods.
- The timeline for claiming 20 million IPs is unclear, but ad impressions or compromised sites could explain the volume.
An Argument for Increasing TCP's Initial Congestion Window Again
9 months ago
- Google increased TCP's initial congestion window from 1 to 10 in 2011 to improve web performance.
- Modern internet traffic, especially web pages and API calls, suffers from slow initial congestion window settings.
- TCP's initial congestion window affects how much data can be sent at the start of a connection, impacting load times.
- Google's 2011 adjustment allowed 85% of assets to load in one round trip, but modern web bloat requires further changes.
- Increasing the initial congestion window too much risks causing congestion and bufferbloat.
- Google's BBR congestion control algorithm helps by monitoring congestion rather than packet loss.
- Recommendations include increasing the initial congestion window to 20-40 and adopting BBR for web servers.
- QUIC, Google's HTTP over UDP protocol, bypasses TCP congestion issues but is often disabled by enterprises.
- TCP tuning remains important for legacy devices and networks that disable QUIC.
- A careful increase in TCP's initial congestion window, paired with BBR, can improve modern internet performance.
Ultra Ethernet's Design Principles and Architectural Innovations
8 months ago
- Ultra Ethernet (UE) 1.0 specification introduces a high-performance Ethernet standard for AI and HPC systems.
- Key innovation is Ultra Ethernet Transport (UET), a hardware-accelerated protocol for reliable and fast communication.
- UE leverages the Ethernet ecosystem and computational efficiency gains for high-performance networking.
- Unlike InfiniBand, UE is designed for extreme-scale systems with modern advancements.
Don't pick weird subnets for embedded networks, use VRFs
8 months ago
- An embedded network is a solution for portable equipment like video racks that need consistent internal communication without reconfiguring IP addresses when moving between venues.
- Using a small router with NAT allows for a consistent subnet inside the rack, but conflicts arise if the venue's network uses the same subnet (e.g., 10.0.0.0/24).
- IPv6 offers a solution with link-local addresses (fe80::) and network discovery protocols, but many embedded devices lack IPv6 support.
- APIPA (169.254.0.0/16) is the IPv4 equivalent of link-local addresses but lacks gateway support, making internet connectivity impossible.
- VRFs (Virtual Routing and Forwarding) provide a generic solution by isolating routing tables for internal and external networks, allowing the same subnet on both sides without conflicts.
- A Mikrotik router can be configured with VRFs to manage traffic between the internal rack network and the venue network, ensuring internet connectivity while preventing conflicts.
- This setup is useful for portable live production gear, industrial monitoring, and legacy devices with fixed IP addresses.
Show HN: I integrated my from-scratch TCP/IP stack into the xv6-riscv OS
8 months ago
- Integrates a TCP/IP protocol stack into xv6-riscv OS for network capabilities.
- Key components include a kernel-space TCP/IP stack (microps), virtio-net driver, socket API, and network configuration via ifconfig.
- Setup involves cloning the repository, running QEMU, and configuring network settings.
- Network communication is verified using ping between host and guest.
- Includes sample applications (tcpecho, udpecho) to demonstrate network stack functionality.
- Testing involves running tcpecho in xv6 and connecting via netcat from the host.
- Project is under the MIT License.
Multi-Path TCP: revolutionizing connectivity, one path at a time
8 months ago
- The Internet typically uses a single path for end-to-end communication despite being designed for multiple paths due to issues like packet reordering.
- Multi-Path TCP (MPTCP) leverages multiple interfaces (e.g., Wi-Fi and cellular) on devices to enable multi-path connectivity.
- MPTCP introduces 'subflows' allowing a single TCP connection to use multiple paths, improving aggregation and mobility.
- Aggregation in MPTCP can combine bandwidth from multiple interfaces, though its practical benefits are debated.
- Mobility in MPTCP allows connections to survive network changes, such as switching from Wi-Fi to cellular.
- MPTCP is supported in Linux (kernel v5.6+) and iOS/macOS, with Linux typically used on servers and Apple devices as clients.
- Linux's MPTCP implementation includes a Path Manager and scheduler, but client-side setup is complex and requires configuration.
- macOS and iOS offer higher-level APIs for MPTCP, integrating with features like Wi-Fi Assist for seamless connectivity.
- MPTCP has limitations, such as IPv6 compatibility issues when TCP timestamps are enabled.
- MPTCP's future is uncertain, with Multi-Path QUIC also in development but not yet practical.
Old Man Yells At Cloud: A Mini-Book On AWS Networking
8 months ago
- AWS requires extensive networking knowledge before deploying an app.
- Key terms include VPCs, subnets, security groups, and internet gateways.
- Understanding CIDR notation is essential for AWS networking.
- Without proper networking knowledge, connecting an EC2 instance to the internet is challenging.
- This series simplifies AWS networking concepts with clear explanations and illustrations.
- Each post is designed to be easy to understand and adaptable to various use cases.
Spiped – secure pipe for SSH, SMTP, etc.
8 months ago
- Spiped is a utility for creating symmetrically encrypted and authenticated pipes between socket addresses.
- It uses strong cryptographic components like HMAC-SHA256, Diffie-Hellman key exchange, AES-256 in CTR mode, and HMAC-SHA256 for encryption and authentication.
- Spiped operates at approximately 300 Mbps on a 2.5 GHz Intel Core 2 laptop.
- Example usage includes setting up encrypted pipes for email transmission and protecting SSH servers from attackers.
- Spiped can be configured to automatically connect via the spipe client, enhancing SSH security.
- Development and discussions for spiped occur in its git repository and mailing list.
- Official releases of spiped are listed with version numbers, release dates, and SHA256 hashes.
- Third-party helper scripts exist for deploying spiped, including a Docker image.
The fast path/slow path mirage
8 months ago
- The fast path/slow path split is a common optimization technique in computing, aiming to optimize for the common case (fast path) while handling exceptions or uncommon cases (slow path) in a slower, more generic manner.
- Despite its theoretical appeal, the fast path/slow path split often fails in real-world deployments, leading to performance issues and limitations in system extensibility.
- Amdahl's Law highlights that the effectiveness of the fast path/slow path split depends on the proportion of time spent in the fast path, with mispredictions leading to worse performance than a uniform approach.
- Tail latency is a critical consideration in distributed systems, where the slowest operation (often in the slow path) can dictate overall performance, making the fast path/slow path split detrimental in such contexts.
- The fast path/slow path split can be exploited for Denial of Service (DoS) attacks, as attackers can flood systems with requests that force slow path processing, draining resources.
- In networking, particularly with routers, the fast path/slow path split has led to inflexibility, hindering the deployment of new protocols or features like IPv6 extension headers.
- RFC9673 addresses the fast path/slow path issue by advocating for protocol designs that avoid slow path processing and encouraging router vendors to expand fast path capabilities, leveraging programmable datapaths.
Creating a stretched Layer 2 network for VMs on bhyve and FreeBSD
8 months ago
- FreeBSD and CBSD provide robust tools for managing virtualized environments.
- CBSD simplifies the management of FreeBSD jails and bhyve virtual machines.
- VXLAN technology enables stretched layer-2 networks across distant locations.
- Combining CBSD with VXLAN allows for flexible, distributed infrastructures.
- Setting up VXLAN Tunnel Endpoints (VTEPs) is key for seamless connectivity.
- CBSD automates the creation and configuration of VMs and jails across nodes.
- The guide demonstrates practical steps for deploying a global virtual network.
- FreeBSD's stability and control make it ideal for cloud-like infrastructures.
Realtek RTL8127 10GbE PCIe cards and M.2 modules are starting to show up
8 months ago
- Realtek introduced the RTL8127 10GbE to PCIe NIC at Computex 2025 as a low-power, low-cost 10Gbps Ethernet solution.
- The Auvidea M20E M.2 10GbE module features the Realtek RTL8127 chipset, M.2 Key-E interface, and supports up to 7,400 Mbps speeds.
- The Auvidea M20E is priced between 99.99 to 112.99 Euros, with optional PoE and compatibility with NVIDIA Jetson Orin NX/AGX.
- A Japanese user tested the RTL8127, noting stable performance, low power consumption (1.95W), and no packet loss issues.
- An OEM RTL8127 10GbE PCIe card is available on Alibaba ($35) and AliExpress ($51.62), offering a more affordable option.
- User reviews confirm the RTL8127's stability and lower power usage compared to the Marvell AQC107 chipset.
- Future expectations include more RTL8127-based PCIe cards, M.2 modules, and cheaper 10GbE-capable devices.
Setting up a home VPN server with WireGuard
8 months ago
- Motivations for setting up a home VPN server include secure remote access, bypassing IP restrictions, private browsing on insecure networks, and accessing blocked services.
- Wireguard is a modern VPN alternative to OpenVPN or IPSec, offering simplicity and speed, suitable for users with limited networking knowledge.
- Wireguard operates with 'peers' instead of traditional client-server models, though the setup described uses one peer as a server and another as a client for clarity.
- Installation involves generating private and public keys, configuring server and client files, and setting up IP forwarding and routing.
- Server configuration includes defining a subnet for VPN clients, setting up iptables for forwarding, and ensuring the server starts automatically on reboot.
- Client configuration requires matching the server's public key, specifying allowed IPs for routing, and setting the correct endpoint (server's address and port).
- Additional steps include enabling IP forwarding on the server for LAN and internet access, and testing the connection to ensure data flows correctly.
- The guide acknowledges community support and releases the document under Creative Commons CC0, making it freely usable by anyone.
Show HN: Making a cross-platform game in Go using WebRTC Datachannels
8 months ago
- WebRTC datachannels are a simpler alternative to complex WebRTC setups for game development.
- Websockets are too slow for most games, making them suitable only for turn-based games like Runescape.
- Web Transport, using QUIC, is a potential replacement for Websockets but is still in development with current issues on Firefox.
- WebRTC datachannels allow sending unreliable packets over the web using SCTP, usable today without waiting for Web Transport.
- Benefits of WebRTC include host flexibility, no need for port forwarding, minimal server requirements, and community support.
- Drawbacks of WebRTC include complex setup and the need for signaling and STUN/TURN servers.
- Various WebRTC implementations exist, including libwebrtc, libdatachannel, Pion WebRTC, and others in different programming languages.
- Existing game networking libraries using WebRTC include Geckos.io, Netlib, Matchbox, PeerJS, and Netplayjs.
- Real-world uses of WebRTC include WebXash3D (Half-Life 1 + Counter-Strike 1.6 reimplementation) and Hypersomnia (2D shooter).
- Go is preferred for development due to efficiency, active WebRTC support, and faster coding compared to Rust.
- Ebitengine is a versatile 2D game engine used for cross-platform games, including potential crossplay between Nintendo Switch, PC, and browser.
- An official Pion example using Ebitengine includes a bundled signaling server for hosting lobbies, currently limited to two players.
- WebRTC enables possibilities like hosting Minecraft-style games without dedicated servers or port forwarding.
The Cudy AX3000 Wi-Fi 6 System (With OpenWRT)
8 months ago
- Upgraded Wi-Fi setup from ISP-provided equipment to Cudy M3000 with OpenWRT.
- Requirements included local browser-based management, no cloud features, no mobile apps, and aesthetic considerations.
- Technical needs: 'dumb' access points, Wi-Fi 6/6E support, full control over Wi-Fi features, 2.5GbE backhaul, and pass-through Ethernet.
- OpenWRT was chosen for its familiarity and support, with Cudy providing clear instructions for re-flashing.
- Factory firmware was user-friendly but replaced with vanilla OpenWRT for full control.
- Conversion process involved TFTP, firmware uploads, and configuration adjustments.
- Performance tests showed speeds up to 1.5 Gbps, with stable streaming and gaming experiences.
- Stability was generally good, with minor client-side issues noted.
- FAQ addressed choices like avoiding UniFi, skipping Wi-Fi 7, and not needing meshing or central management.
- Conclusion praised the Cudy M3000 as a cost-effective, reliable replacement for Airport Extremes with OpenWRT offering full local control.
Show HN: I wrote a from-scratch OS to serve my blog
8 months ago
- Tatix is a custom kernel designed for serving static web pages, featuring a custom TCP/IP stack, HTTP server, RAM file system, and cooperative task scheduling.
- Development and testing occur in a QEMU virtual environment on Linux, requiring standard tools like GNU Make, NASM, GCC, and Python 3.
- Tatix can serve web pages globally via HTTP, needing only a Linux host with virtualization support and a public IP address.
- The system includes a bootloader with two stages, transitioning from BIOS to 64-bit long mode with paging for kernel initialization.
- A cooperative scheduler manages tasks, including network packet handling, TCP retransmissions, and web server operations, without needing locks due to single-core execution.
- The TCP subsystem is complex, adhering to RFC standards for state management, data transmission, and retransmission with dynamic timeout adjustments.
- Memory management uses pool allocators for efficient handling of connection structures and data buffers, minimizing fragmentation.
- A RAM file system (ramfs) organizes web content in a tree structure, with nodes for directories and files, using allocators for dynamic memory management.
Inletsctl – the fastest way to create self-hosted tunnels
8 months ago
- inletsctl automates the creation of exit-servers (tunnel servers) on public cloud infrastructure.
- The 'create' command provisions a cloud VM with a public IP and pre-installs inlets.
- Provides a connection string for use with the inlets client.
- Supports L4 TCP and HTTPS tunnels for local services using inlets-pro.
- Facilitates Kubernetes cluster tunnels and port-forwarding with 'inletsctl kfwd'.
- Demo includes creating a DigitalOcean host, running a local Python server, and accessing it via public IP.
- Quickly provision hosts with 'inletsctl create' and delete them with 'inletsctl delete'.
- Cloud host costs vary; estimated around $5/month on providers like DigitalOcean or Scaleway.
- inletsctl does not auto-delete exit nodes; manual deletion is required.
- Install via arkade or directly from releases; supports updates.
- Supports multiple cloud providers: DigitalOcean, Google Cloud, AWS, Azure, etc.
- Uses a provision package for cloud host setup with defaults for OS images and plans.
- Separate binary to avoid bloat; core tunnel binary remains lightweight.
- Open-source Go package 'provision' allows extending support for new providers.
- Licensed under MIT; inlets-pro requires a subscription under EULA.
Computer Networks: A Systems Approach
8 months ago
- The book 'Computer Networks: A Systems Approach' is authored by Larry Peterson and Bruce Davie.
- It includes a foreword, preface, and multiple chapters covering foundational and advanced topics in computer networking.
- Key chapters focus on direct links, internetworking, end-to-end protocols, congestion control, network security, and applications.
- The book also provides additional resources like 'About This Book' and options to read the latest updates or purchase print copies.
Images over DNS
7 months ago
- TXT records can contain multiple character-strings, each limited in length by a single byte for their length.
- The actual limit of a TXT record is constrained by the DNS payload size: around 1232 bytes for UDP and up to 64KB for TCP.
- Google Public DNS's JSON API can serve large TXT responses over TCP, though handling binary data requires custom JSON parsing.
- Binary data in TXT records avoids encoding overhead, allowing more data to be packed in.
- Demonstration includes querying via dig and processing with Perl to unescape and combine character sequences.
- Security consideration: tunneling large payloads over DNS to browsers is a potential new vector, leveraging Google Public DNS's certificate.
- The server is a custom Go DNS server, initially written by ChatGPT but corrected manually for accuracy.
- All code is available, with AI used only for the server component; the blog post and client HTML are original work.

first prev4next

About|Login

#networking

How to become your own ISP (WHY2025) [video]

Dumb to Managed Switch Conversion

One person was able to claim 20M IPs, or 9% of all IPv4 hosts

An Argument for Increasing TCP's Initial Congestion Window Again

Ultra Ethernet's Design Principles and Architectural Innovations

Don't pick weird subnets for embedded networks, use VRFs

Show HN: I integrated my from-scratch TCP/IP stack into the xv6-riscv OS

Multi-Path TCP: revolutionizing connectivity, one path at a time

Old Man Yells At Cloud: A Mini-Book On AWS Networking

Spiped – secure pipe for SSH, SMTP, etc.

The fast path/slow path mirage

Creating a stretched Layer 2 network for VMs on bhyve and FreeBSD

Realtek RTL8127 10GbE PCIe cards and M.2 modules are starting to show up

Setting up a home VPN server with WireGuard

Show HN: Making a cross-platform game in Go using WebRTC Datachannels

The Cudy AX3000 Wi-Fi 6 System (With OpenWRT)

Show HN: I wrote a from-scratch OS to serve my blog

Inletsctl – the fastest way to create self-hosted tunnels

Computer Networks: A Systems Approach

Images over DNS