Hasty Briefsbeta

All tags

#networking

197 stories total

Bilingual

Tailscale Services
6 months ago
- Tailscale Services announced, enabling virtual Tailscale IPv4/IPv6 address pairs (TailVIPs) for logical resources.
- Services provide unique MagicDNS names and act as policy units for access control.
- Tailscale Services can replace traditional load balancing with intelligent routing.
- Early adopters used Services for CI pipelines, database proxies, and internal applications.
- Services architecture includes TailVIPs, MagicDNS, endpoints, and service hosts.
- Service hosts require validation and can be auto-approved based on tags or IPs.
- Access to services is controlled via Grants, specifying source and destination.
- Services support high availability through multiple hosts and intelligent routing.
- Tailscale Services are in open beta, with future features like Configuration Audit Logs planned.
- Future enhancements may include state validation, API registration, and third-party proxy integration.
Tailscale Peer Relays
6 months ago
- Tailscale Peer Relays is a customer-deployed and managed traffic relaying mechanism.
- Peer relays can relay traffic for any nodes on the tailnet, including traffic bound to itself.
- Peer relays provide higher throughput compared to Tailscale’s managed DERP relays.
- Testing shows throughput nearing direct connection speeds, often much higher than DERP.
- Peer relays help overcome hard NAT environments and strict firewalls.
- Peer relays are built into the Tailscale client for easy deployment.
- Peer relays run on UDP, reducing latency and resource overhead.
- Peer relays require a single UDP port to be available for connections.
- Tailscale prefers direct connections but falls back to peer relays or DERP if needed.
- All traffic remains end-to-end encrypted via WireGuard®.
- Peer relays are useful in cloud NATs, firewalled environments, and locked-down networks.
- Peer relays are available as a public beta, with free usage for two relays.
One Organization, Multiple Tailnets
6 months ago
- Tailscale introduces the ability for organizations to create and manage multiple tailnets under the same identity provider.
- Multiple tailnets provide separation for testing, development, and managing customer connectivity without needing new identity systems.
- Each tailnet maintains its own policy file, tags, devices, and settings, with customizable ownership and admin assignments.
- Enterprises can sync group assignments from Google Workspace, Okta, or Microsoft Entra ID across all tailnets.
- Use cases include sandbox tailnets for testing, lab tailnets for R&D, and separate tailnets for development, staging, and production environments.
- Tailscale offers an API for programmatically creating tailnets, useful for automation, OEM, and integration scenarios.
- API-generated tailnets are lightweight, managed exclusively via API, and ideal for embedding Tailscale into products.
- Access to multiple tailnets and the tailnet creation API is available through an alpha program.
- Future features include assigning users to tailnets based on groups, self-serve tailnet creation, and organization-level controls.
UDP Isn't Unreliable, It's a Convertible
6 months ago
- UDP is often labeled as 'unreliable,' but this is a misnomer—it's more about lacking built-in reliability features like TCP.
- UDP provides minimal framing and no guarantees, offering pure freedom, whereas TCP includes reliability mechanisms like ordered delivery and retransmission.
- The 'unreliability' of UDP stems from protocol guarantees, not packet loss, as all network layers can fail, including TCP.
- UDP allows applications to handle reliability on their terms, making it ideal for scenarios like gaming, voice calls, and IoT.
- A simple 4-byte header with acknowledgment requests and sequence numbers can add reliability to UDP without TCP's complexity.
- UDP's flexibility is its strength, enabling custom reliability solutions tailored to specific needs, unlike TCP's one-size-fits-all approach.
Auraphone: A simple app to collect people's info at events
6 months ago
- Auraphone is an app designed to collect people's information at networking events using Bluetooth.
- Users can set their name, photo, and choose what information to share (e.g., Instagram, email, LinkedIn).
- The app broadcasts and collects information from nearby devices, creating a record of people met at the event.
- Bluetooth terminology is simplified by thinking in terms of client-server models to manage connections.
- The app uses two Bluetooth characteristics: PROFILE_CHAR for JSON data and PHOTO_CHAR for image data.
- A cooldown list prevents repeated connections to the same device, optimizing the networking process.
- Challenges include handling BLE stack complexities, differences between iOS and Android, and connection errors.
- A BLE stack simulator was created in Golang for testing but proved more useful for understanding Bluetooth than fixing bugs.
- Real-device testing with thorough logging was more effective for debugging and improving the app.
- The app requires the phone to be in the foreground, encouraging users to stay engaged in conversations.
- Auraphone is currently available in the iOS App Store and as an APK for Android, with testing ongoing at BLANKSPACES Culver City.
How did I get here?
6 months ago
- The author's server hit the Hacker News front page, causing traffic issues.
- A custom traceroute program called 'ktr' was developed to trace packet paths across the Internet.
- ICMP protocol with TTL (Time to Live) fields is used to perform traceroutes by sending packets with incrementally increasing TTL values.
- The website loads traceroute results in real-time without JavaScript, using CSS tricks to simulate updates.
- Reverse traceroutes are used, which may not be perfectly accurate due to asymmetric routing paths.
- Autonomous Systems (AS) are networks owned by companies that decide Internet routing via BGP (Border Gateway Protocol).
- BGP v4, introduced in 1994, is still the standard protocol for routing between ASes.
- Peering relationships between ASes allow traffic to flow across the Internet, governed by financial and bureaucratic agreements.
- WHOIS and PeeringDB are used to identify AS ownership and network details.
- The project is open-source, aiming to educate about Internet structure and protocols.
BGP zombies and excessive path hunting
6 months ago
- Cloudflare discusses BGP zombies, which are routes stuck in the Internet’s Default-Free Zone (DFZ) due to missed or lost prefix withdrawals.
- BGP zombies can disrupt traffic by causing route loops or inefficient paths, creating headaches for network operators.
- Path hunting in BGP occurs when routers search for the best path after a more-specific prefix is withdrawn, leading to delays.
- The Minimum Route Advertisement Interval (MRAI) adds delay to BGP updates, prolonging path hunting and increasing the chance of zombies.
- Cloudflare observed BGP zombies in both upstream ISP networks and internal LANs, with some routes stuck for over 10 minutes.
- IPv4 path hunting delays are worse than IPv6, likely due to the larger number of IPv4 prefixes in global routing tables.
- Cloudflare suggests improvements like graceful traffic forwarding and multi-step draining to mitigate BGP zombie impacts.
- Customers using on-demand BYOIP should announce the same-length prefix natively before withdrawing from Cloudflare to avoid zombies.
- RFC9687 (BGP SendHoldTimer) can help detect unresponsive routers, reducing long-lived zombies.
- Cloudflare encourages network operators to be cautious with more-specific prefix announcements to minimize BGP convergence issues.
Easel's State-of-the-Art Rollback Netcode Implementation
6 months ago
- Rollback netcode helps games feel responsive despite latency by predicting inputs and correcting mispredictions later.
- Easel simplifies multiplayer game development by handling rollback netcode automatically, allowing developers to code as if in a singleplayer environment.
- Rollback netcode requires determinism and the ability to snapshot and restore game states, which Easel guarantees.
- Easel's rollback netcode features include incremental snapshotting, true peer-to-peer networking, and fair latency distribution.
- Easel uses Cloudflare for secure, efficient peer connections and employs server-authoritative models to prevent cheating.
- The platform ensures determinism across all operations, avoiding desynchronization bugs common in other engines.
- Easel's design specifically supports multiplayer games, with features like snapshotting executing code and continuous time synchronization.
- Developers don't need to understand the underlying technology to create multiplayer games with Easel.
The Internet Is Cool. Thank You, TCP
6 months ago
- TCP is the workhorse of the internet, ensuring reliable data transmission despite network unreliability.
- TCP operates at the transport layer, using ports to direct data to the correct application on a host.
- TCP handles packet loss, corruption, duplication, and reordering, shielding developers from these issues.
- Flow control in TCP prevents overwhelming the receiver by managing buffer space via the window field in TCP segments.
- Congestion control in TCP prevents network overload by adjusting data transmission rates based on network conditions.
- A simple TCP server example demonstrates socket creation, binding, listening, and accepting connections.
- TCP segments include fields like sequence numbers, acknowledgment numbers, flags (SYN, ACK, FIN, RST), and window size for reliable communication.
- The TCP three-way handshake (SYN, SYN-ACK, ACK) establishes connections, while a four-way handshake (FIN, ACK, FIN, ACK) terminates them.
- TCP checksums ensure data integrity by verifying the correctness of transmitted segments.
- The internet's reliability and scalability are largely due to TCP's robust mechanisms.
libwifi: an 802.11 frame parsing and generation library written in C
6 months ago
- libwifi is a fast, simple C shared library for generating and parsing 802.11 wireless frames on Linux and macOS.
- It prioritizes clean, readable code and supports cross-architecture use with strict error checking.
- The library simplifies parsing and generating WiFi frames with easy-to-use functions and structs.
- Examples of usage can be found in the source examples directory.
- For parsing, libwifi processes captured packets (e.g., via libpcap) into common datatypes and then into frame-specific data.
- For generation, users provide required data to frame generation functions like `libwifi_create_beacon()`.
- Building libwifi involves using CMake with commands: `mkdir build`, `cd build`, `cmake ..`, `make`, and `sudo make install`.
- Benchmark tests show libwifi's beacon parsing is extremely fast, with times as low as 0.0000010 seconds.
- Documentation is available in the source code comments and online, including struct diagrams and frame layouts.
Ubiquiti Flex Mini 2.5G Review Ubiquiti Does a Cheap 5-Port 2.5GbE Switch
6 months ago
- The Ubiquiti Flex Mini 2.5G is a 5-port 2.5GbE switch with PoE-in and UniFi management.
- STH purchased the switch independently, refusing Ubiquiti's 'Influencer Testing NDA' to maintain editorial independence.
- The switch is compact (4.6×3.5×0.8in) with a plastic housing and lacks visible vents, posing cooling challenges.
- Power options include PoE-in via the 5th port or USB Type-C 5V input.
- Internally, it uses the Realtek RTL8372N switch chip, also found in other budget 2.5GbE/10G switches.
- Cooling relies on a custom heat spreader due to the plastic case limiting heat dissipation.
- Users reported issues like unexpected shutdowns, possibly related to overheating or power distribution.
- The review highlights the lack of temperature and power consumption data in the review.
- Questions remain about features like LAGG support and firmware updates for stability.
I finally understand Cloudflare Zero Trust tunnels
6 months ago
- Cloudflare Zero Trust + Warp provides solutions for connecting private networks, exposing private services publicly, and creating private networks accessible only via Warp VPN.
- Argo tunnels through Zero Trust enable connecting private networks, exposing private services on public hostnames, and creating private networks with granular access policies.
- Cloudflare Zero Trust vs Tailscale: Tailscale is peer-to-peer with best speed if connections are established, while Cloudflare routes through its edge network, adding latency but avoiding NAT issues.
- Warp Client connects users to the Cloudflare network, enforcing policies, while Cloudflared creates tunnels for exposing services or networks.
- Tunnels, Routes, and Targets are key components in Zero Trust: Tunnels act as exits for traffic, Routes direct traffic, and Targets define protected infrastructure.
- Access Policies in Zero Trust allow controlling who can access what, with options to require authentication or bypass it based on conditions like Warp connection.
- Deploying the Warp client involves setting enrollment permissions and profile settings to define behavior, such as protocol and IP exclusions.
- Example setup includes a tunnel routing traffic to a private IP, a public DNS record for external access, and access policies for authentication.
- Cloudflare Zero Trust enables features like SSH authentication without keys, warp-to-warp routing, and assigning private IPs within the Zero Trust network.
PPP-over-HTTP/2: Having Fun with dumbproxy and pppd
6 months ago
- Implemented a new operation mode for dumbproxy to run as a subprocess and communicate via stdin/stdout, useful for OpenSSH ProxyCommand.
- Extended dumbproxy to send PPP tunnel through HTTP proxy, combining TLS security, authentication, and firewall bypassing capabilities with PPP tunneling.
- Configured server-side settings including pppd options, IP forwarding, and iptables rules for traffic forwarding.
- Created client-side configuration for pppd, using dumbproxy to connect through an upstream proxy to a server-side pppd process.
- Added a script to configure routing post-PPP connection establishment, ensuring traffic does not loop back into the tunnel.
- Demonstrated the setup's functionality with a successful PPP connection and traffic routing through the remote server.
- Explored an alternative client setup using openssl and chat for a more traditional modem-like connection setup.
A 'small' vanilla Kubernetes install on NixOS
6 months ago
- Kubernetes abstracts system administration tasks and automates processes like blue-green deployments.
- The article explores setting up a self-managed, small-but-multi-node Kubernetes installation.
- The setup avoids complexities like Public-Key Infrastructure (PKI), NixOS Kubernetes modules, and Kubernetes distributions like K3s or K0s.
- NixOS is used for the Kubernetes package and systemd parts, despite some configuration interweaving issues.
- The setup includes a QEMU environment for testing, available at a provided link.
- Basic NixOS configuration includes enabling nftables and systemd-networkd for networking.
- Kubernetes version 1.34 is targeted, with careful version upgrade considerations.
- Networking setup involves container subnets, Wireguard for encrypted links, and firewall/NAT rules.
- Hostnames are configured with a domain name (k8s.internal) for Kubernetes services.
- The API server setup includes etcd for storage, encryption configuration, and static token file authentication.
- CoreDNS is configured for DNS resolution, running outside Kubernetes but managed by NixOS.
- Kube-proxy and kubelet are set up for service IP management and container runtime, respectively.
- Testing confirms functionality with kubectl commands and container internet connectivity.
- The article suggests next steps like adding an Ingress controller, storage provisioner, and database management.
- Takeaways include the complexity of Kubernetes for small setups and potential simplifications like SQLite support.
Hyperoptic: IPv6 and Out-of-Order Packets
6 months ago
- Hyperoptic IPv6 connectivity issues due to upstream router not responding to Router Solicitation (RS) packets.
- Workaround involves changing the WAN interface MAC address to trigger an unsolicited Router Advertisement (RA).
- Manual addition of default IPv6 gateway address as an alternative solution.
- Hyperoptic assigns only prefix delegations (ia_pd) and not non-temporary addresses (ia_na).
- Out-of-order packets issue linked to WAN MAC addresses starting with '4' or '6'.
- Solution for out-of-order packets: changing the WAN MAC address to one not starting with '4' or '6'.
Windows Clat Enters Private Preview: A Milestone for IPv6 Adoption
6 months ago
- IPv6 adoption has reached 43-48% globally, with France, Germany, and India leading.
- IPv4 address exhaustion and the rise of mobile/IoT devices drive IPv6 adoption.
- Governments like the U.S. and Germany mandate IPv6-only environments by 2025.
- Transition mechanisms include tunneling, dual stack, and translation (NAT64/DNS64).
- CLAT (Customer-side Translator) is key for IPv6-only networks, part of 464XLAT architecture.
- Windows CLAT is now in private preview, responding to community demand.
- CLAT enables IPv4 applications to work over IPv6-only networks via stateless translation.
- CLAT activation involves NAT64 prefix discovery via RA PREF64 or DNS-based methods.
- Windows CLAT supports compliance with government mandates and future networking needs.
Pingap: Simple and efficient reverse proxy based on pingora
5 months ago
- Pingap is a single, self-contained executable with native support for ARM and x86 architectures.
- It provides a fully statically linked build based on musl, ensuring compatibility across Linux distributions.
- Features a built-in web management interface for simplified setup, deployment, and maintenance.
- Built on a flexible, plugin-based architecture to adapt to diverse use cases.
- Includes plugins for Authentication, dynamic data compression, static asset serving, and caching.
- Developed in Rust using the Pingora framework for high performance and memory safety.
- Achieves high network throughput and low-latency with Rust's concurrency model.
- Ensures security and reliability in demanding production environments.
Migrating from Legacy Networking to systemd-networkd on Ubuntu 24.04
5 months ago
- Migrating from legacy ifupdown to systemd-networkd on Ubuntu 24.04 for modern network management.
- Systemd-networkd offers features like predictable interface naming, faster boot times, and unified configuration.
- Steps include checking current setup, installing systemd-networkd, creating network configuration files, and configuring systemd-resolved.
- Handling remote migration risks with console access, timed rollback scripts, and automation for safety.
- Automation scripts like migrate_to_systemd_networkd.sh and upgrade_watchdog.sh ensure smooth transitions and rollback capabilities.
- Successful migration modernizes servers, integrates with automation, and prepares for Ubuntu 24.04.
C++ Web Server on my custom hobby OS
5 months ago
- Author successfully implemented a web server on their hobby operating system after a long break.
- Initial focus was on the networking stack, including Ethernet, IP, ARP, UDP, TCP, DHCP, and DNS.
- Encountered issues with terminal buffer implementation and E1000 network driver handling incoming packets.
- Resolved performance errors related to TCP, especially handling RST packets from browser refreshes.
- Developed an HTTP engine to parse requests, moving beyond static responses.
- Porting a standalone HTTP parser from another project (c-web-modules) to the OS.
- Created a web engine with routing capabilities, allowing path and method matching with handler functions.
- Implemented a FileRepository for serving static files with caching support.
- Next steps include improving UI, graceful shutdown, and eventually developing a web browser.
Imgur Geo-Blocked the UK, So I Geo-Unblocked My Network
5 months ago
- Imgur has geo-blocked the UK, causing broken links across various platforms.
- The author encountered issues with Minecraft shader previews hosted on Imgur.
- Using a VPN was considered but deemed impractical due to speed loss and device management.
- A network-level solution was implemented using Pi-hole, Traefik, Gluetun, and Nginx.
- The setup intercepts Imgur requests and routes them through a VPN without client-side changes.
- The solution is transparent, works on all devices, and maintains high-speed internet for non-Imgur traffic.

first prev6next

About|Login

#networking

Tailscale Services

Tailscale Peer Relays

One Organization, Multiple Tailnets

UDP Isn't Unreliable, It's a Convertible

Auraphone: A simple app to collect people's info at events

How did I get here?

BGP zombies and excessive path hunting

Easel's State-of-the-Art Rollback Netcode Implementation

The Internet Is Cool. Thank You, TCP

libwifi: an 802.11 frame parsing and generation library written in C

Ubiquiti Flex Mini 2.5G Review Ubiquiti Does a Cheap 5-Port 2.5GbE Switch

I finally understand Cloudflare Zero Trust tunnels

PPP-over-HTTP/2: Having Fun with dumbproxy and pppd

A 'small' vanilla Kubernetes install on NixOS

Hyperoptic: IPv6 and Out-of-Order Packets

Windows Clat Enters Private Preview: A Milestone for IPv6 Adoption

Pingap: Simple and efficient reverse proxy based on pingora

Migrating from Legacy Networking to systemd-networkd on Ubuntu 24.04

C++ Web Server on my custom hobby OS

Imgur Geo-Blocked the UK, So I Geo-Unblocked My Network