Hasty Briefsbeta

All tags

#networking

197 stories total

Bilingual

New and Upcoming IRCv3 Features
3 months ago
- Libera.Chat is introducing new IRCv3 features, enhancing its position in IRC development.
- message-tags now supported between servers, enabling features like msgid for unique message identifiers.
- server-time improvements ensure timestamps reflect when messages were processed by the sender's server.
- Client tags, like +typing, allow additional message info without server understanding.
- batch feature groups messages for better handling of netsplits and netjoins.
- invite-notify capability alerts users when someone is invited to their channel.
- echo-message bugfix ensures correct echo messages from services.
- Future considerations include draft/multiline batch, labeled-response, bot mode, and setname.
Tailscale Peer Relays is now generally available
3 months ago
- Tailscale Peer Relays is now generally available (GA), offering customer-deployed, high-throughput relaying.
- Improvements include better throughput, especially with many clients, and more efficient packet handling.
- Static endpoints are introduced for restrictive cloud environments, enabling connectivity behind firewalls and load balancers.
- Enhanced visibility and auditability with integration into Tailscale’s tooling, including metrics for monitoring.
- Peer Relays support high-throughput, low-latency connections in restricted environments and enable full mesh deployments.
- Available on all Tailscale plans, including the free Personal plan, with support for incremental deployment.
Six months of yak shaving a Zig web back end stack
2 months ago
- Author wrote about Zio, an async I/O library for Zig, and later developed a full web backend stack in Zig.
- Started with NATS client development, initially using threads and blocking sockets, but later switched to async I/O.
- Created Dusty, an HTTP server and package built on Zio, featuring HTTP client, WebSocket support, Server-Sent Events, and more.
- Developed additional client libraries for Memcached, PostgreSQL, and Redis, adapting existing solutions to fit the Zig stack.
- Author finds Zig suitable for performance-critical backend tasks like databases, streaming services, and audio processing.
- Plans to migrate libraries to use std.Io once Zig 0.16 is released, pending missing API functionality.
Using New Bridges of FreeBSD 15
2 months ago
- FreeBSD 15 introduces a new bridging implementation with native VLAN support.
- The new bridging behaves like a hardware switch by soft-deprecating layer 3 addresses on member interfaces.
- A sysctl, net.link.bridge.member_ifaddrs, controls this behavior and will be removed in FreeBSD 16.0-RELEASE.
- The new implementation optimizes packet processing and allows a single bridge for all VLANs, improving performance.
- Old bridging required separate bridges for each VLAN, leading to messy configurations.
- New bridging simplifies VLAN management by allowing tagged and untagged VLANs on a single bridge.
- VNET jails previously relied on an unofficial script (jib) for epair device creation, which is now outdated.
- A new script was created to handle stable epair device names and VLAN tagging for VNET jails.
- Bhyve VMs currently lack native support for the new bridging, requiring manual tap interface management.
- Future updates may provide better solutions for Bhyve VM networking with the new bridging.
Show HN: Rust blockchain with sharded propagation and post-quantum signatures
2 months ago
- Alphanumeric network features a resilient discovery and light snapshot layer.
- Nodes announce their status, clients discover peers, and gateways ensure reconnection and sync.
- Network operations include live gateway telemetry, chain health signals, and recent activity monitoring.
- Snapshot history is currently unavailable (24h).
- Nodes publish signed status and optional stats snapshots.
- Gateway deduplicates endpoints and prioritizes fresher peer signals.
- Header snapshots transition from pending to verified via signer quorum.
- Clients sync from the canonical chain tip using discovery APIs.
- Discovery involves nodes POSTing signed announcements and clients fetching ranked peers.
- Light snapshot includes validators submitting signed header snapshots with height and timestamps.
- Health checks include a simple uptime endpoint and CORS-friendly APIs.
- To run a node, set ALPHANUMERIC_DISCOVERY_BASES, keep the binary online, and expose ALPHANUMERIC_STATS_PORT if hosting stats.
- Recommended environment variables provided for node setup.
- Example of a signed announcement payload with node details and signature.
OpenWrt 25.12 Stable Release
2 months ago
- OpenWrt 25.12 stable release announced, named 'Dave's Guitar' in honor of Dave Täht.
- Transition from opkg to apk package manager for better maintenance and features.
- Integration of attended sysupgrade (ASU) by default for easier firmware upgrades.
- Shell command history now preserved across sessions in a RAM-backed filesystem.
- Wi-Fi and network management scripts rewritten in ucode for improved performance.
- Support for over 2200 devices, including 180 new additions.
- Core components updated, including Linux kernel 6.12.71 and musl libc 1.2.5.
- OpenWrt 24.10 will reach end of life in 6 months, urging users to upgrade.
- Known issues include WAN interface renaming and WiFi connectivity problems.
- Detailed release notes and upgrade instructions available on OpenWrt's website.
Reverse-engineering the UniFi inform protocol
2 months ago
- UniFi devices communicate with their controller via the inform protocol on port 8080 every 10 seconds.
- The inform protocol's first 40 bytes are unencrypted, including the device's MAC address at bytes 8-13.
- AES-128-CBC encryption is used for the payload, but the header's plaintext MAC allows for routing without decryption.
- A proxy can route traffic based on the MAC address, enabling multi-tenancy without per-tenant VMs.
- The web UI on port 8443 is easily routed via subdomains, while other ports have straightforward handling.
- The inform protocol's design allows for cost-effective hosting solutions by sharing infrastructure among tenants.
Re-architecting End-host Networking with CXL
2 months ago
- The paper discusses re-architecting end-host networking using CXL to address coherence, memory, and offloading challenges.
- CXL Type-1 devices allow NICs coherent access to host memory, enabling efficient prefetching of receive descriptors and reducing host memory reads.
- CXL Type-2 NICs can store packets and descriptors in NIC memory, with host CPU caching and intelligent use of NC-P operations for direct LLC writes.
- The authors implemented a CXL NIC on an Altera FPGA, showing improved loopback latency compared to an nVidia BlueField-3 PCIe NIC.
- CXL coherence messages are highlighted as more efficient than MMIOs and interrupts, though polling memory locations is noted as potentially wasteful.
Networking with agents: Put them in the right conversations with Tailscale
2 months ago
- Firetiger Database Agents can administrate Postgres, MySQL, and Clickhouse on autopilot.
- Most databases live on private networks, making it difficult for external systems like Firetiger to access them.
- Traditional solutions like VPC peering, AWS PrivateLink, VPNs, and bastion hosts have limitations and complexities.
- Firetiger Network Transports enable secure connections to private network resources, starting with Tailscale integration.
- Tailscale simplifies secure, end-to-end encrypted connections across different clouds and network configurations.
- Firetiger joins your Tailnet as an ephemeral device with permissions defined in Tailscale’s access controls.
- Steps to set up include granting Firetiger access, updating Tailscale ACLs, creating credentials, and configuring the transport.
- Agents can then operate on databases or other resources securely, even on private networks.
The Road Not Taken: A World Where IPv4 Evolved
2 months ago
- IPv4 address exhaustion was a looming issue since the early 1990s, with projections suggesting depletion by 2005.
- Temporary solutions like NAT and Carrier-Grade NAT were introduced to delay IPv4 exhaustion, but they introduced limitations.
- IPv6 was designed to solve IPv4's shortcomings but faced slow adoption due to the reluctance of being the first to deploy.
- An alternative universe where IPv4 was extended (IPv4x) instead of replaced is imagined, offering a smoother transition.
- IPv4x would embed 128-bit addresses within IPv4 packets, ensuring backward compatibility with existing IPv4 infrastructure.
- MIT was an early adopter of IPv4x, demonstrating its viability without requiring a complete overhaul of existing systems.
- By 2006, IPv4x was widely adopted, with ISPs providing IPv4x addresses and using NAT only when necessary.
- IPv4x made peer-to-peer networking easier, leading to a backlash from the music industry over increased file sharing.
- By 2016, IPv4x became the norm, with only a few holdouts, and by 2020, it proved essential during the pandemic for seamless remote work.
- The article contrasts the imagined IPv4x world with the real-world challenges of IPv6 adoption, highlighting the benefits and drawbacks of each approach.
- The author introduces SixGate as a real-world solution to bridge IPv4 and IPv6, inspired by the seamless transition in the IPv4x universe.
How far can you go with IX Route Servers only?
2 months ago
- Internet exchanges (IX) simplify BGP peering by connecting routers via a shared layer 2 Ethernet switch.
- Route servers (RS) on IXs act as BGP route reflectors, reducing the need for direct peering between members.
- RSs enhance security with features like RPKI ROV, IRR filtering, and AS_PATH validation, often surpassing member configurations.
- Despite benefits, not all networks use RSs, and policies may differ from direct peering, especially for sensitive services like anycast.
- BGP.tools data shows RSs cover ~56.6% of IPv4 and ~61% of IPv6 prefixes, but uniqueness diminishes after top exchanges.
- Inbound reachability via RSs is low (~14%), highlighting a gap between outbound and inbound route acceptance.
- Major content networks (Meta, Akamai, Google, etc.) dominate traffic, making IXs less economical for large networks compared to PNIs or transit.
- IXs risk becoming middle-tier solutions as large networks favor PNIs/transit, and small networks find IX ports costly.
A most elegant TCP hole punching algorithm
2 months ago
- TCP hole punching connects computers behind NAT routers by knowing each other's WAN IPs, external ports, and connecting simultaneously.
- The algorithm uses a deterministic approach to derive metadata from a single parameter, avoiding fixed infrastructure.
- A 'bucket' is calculated using Unix timestamp, max clock error, and min run window to synchronize both sides without communication.
- Ports are selected using the bucket as a seed for a pseudo-random number generator, ensuring both sides generate the same port list.
- Essential socket options for TCP hole punching include SO_REUSEADDR and SO_REUSEPORT to aggressively reuse socket addresses.
- Non-blocking sockets with select for polling are recommended for precise timing control during SYN packet exchanges.
- The algorithm uses a leader-follower model to choose the winning connection, with the leader sending a single character to confirm.
- The entire process is deterministic, requiring only a destination IP and no additional metadata exchange between hosts.
- The tool can be tested locally by running commands within a 10-second window to simulate the hole punching process.
Linux 7.1 to Retire UDP-Lite – Allows for Better Performance with Cleansed Code
2 months ago
- Linux 7.1 kernel will retire UDP-Lite support.
- UDP-Lite allowed partial checksums for damaged packets but has been unused for years.
- Removing UDP-Lite improves performance by 3-10% for other UDP workloads.
- A null-ptr-deref bug in UDP-Lite was found in 2023, highlighting its lack of use.
- Deprecation notice was issued in 2023, with removal planned for 2025.
- No complaints led to the decision to remove UDP-Lite in Linux 7.1.
- Cleanup of UDP-Lite code simplifies networking and boosts performance.
OpenBSD: PF queues break the 4 Gbps barrier
2 months ago
- Internal 32-bit limitation in HFSC service curve structure capped bandwidth at ~4.29 Gbps.
- Modern network interfaces (10G, 25G, 100G) made this limitation problematic.
- Patch updates HFSC scheduler to use 64-bit integers, removing the bottleneck.
- Fixes display bug in pftop(1) for bandwidth values above 4 Gbps.
- PF queue bandwidth configuration now works correctly for high-speed interfaces.
- Supports values up to 999G, with no changes needed for existing sub-4G configurations.
- Patch and discussion available on tech@, ready for commit by March 20, 2026.
You can run a DNS server (2025)
a month ago
- Running a DNS server is not especially hard.
- PowerDNS supports querying a database for DNS records, simplifying management.
- Example SQL query shows how records are stored and retrieved in PowerDNS.
- Using a subdomain with NS records pointing to your DNS server is a simple solution for public accessibility.
- This setup allows for redundancy with your main domain served by professional DNS providers.
- Adding or modifying DNS records (like CNAMEs) becomes as easy as inserting data into a database, eliminating the need for manual updates via domain registrar interfaces.
Unlocking 25 Gigabit/S on 10 GbE Direct Attach Copper
a month ago
- The author upgraded their homelab setup to 25 Gigabit Ethernet but found that existing DAC cables only supported 10 Gbps.
- DAC (Direct Attach Copper) cables are passive and cheaper than active optical cables but require replacement for higher speeds.
- SFP connectors separate the 'what' from the 'how' in networking, allowing flexibility in transmission technology.
- RJ45 Ethernet cables are limited to 10 Gbps and consume more power compared to DAC cables.
- SFP connectors include metadata like vendor ID and product ID, which can restrict compatibility with certain hardware.
- Enterprise networking gear often enforces vendor lock-in, requiring expensive programming devices to modify SFP metadata.
- The author used a Banana Pi BPI-R3 router to modify the EEPROM of a DAC cable, changing its reported speed from 10 Gbps to 25 Gbps.
- By adjusting the nominal signaling rate in the EEPROM and fixing checksums, the author successfully 'uprated' the cable.
- Testing with iperf3 confirmed the modified cable achieved speeds over 22 Gbps, close to the 25 Gbps target.
- Not all 10 Gbps DAC cables can be uprated; physical differences like cable thickness and PCB design affect compatibility.
- The author explored the internals of a non-upgradable DAC cable, revealing differences in construction compared to upgradable ones.
Fedora 45 Aims for IPv6-Mostly Support Out-of-the-Box
a month ago
- Fedora 45 plans to enable IPv6-mostly support by default in NetworkManager.
- IPv6-mostly balances IPv6 primary usage with IPv4 support for legacy devices.
- The approach uses DHCPv4 option 108 and 464XLAT CLAT to reduce IPv4 address consumption.
- This change aims to ease the transition towards IPv6-only networking.
- The Fedora Engineering and Steering Committee approved the change for Fedora 45's release later this year.

first prev9next

About|Login

#networking

New and Upcoming IRCv3 Features

Tailscale Peer Relays is now generally available

Six months of yak shaving a Zig web back end stack

Using New Bridges of FreeBSD 15

Show HN: Rust blockchain with sharded propagation and post-quantum signatures

OpenWrt 25.12 Stable Release

Reverse-engineering the UniFi inform protocol

Re-architecting End-host Networking with CXL

Networking with agents: Put them in the right conversations with Tailscale

The Road Not Taken: A World Where IPv4 Evolved

How far can you go with IX Route Servers only?

A most elegant TCP hole punching algorithm

Linux 7.1 to Retire UDP-Lite – Allows for Better Performance with Cleansed Code

OpenBSD: PF queues break the 4 Gbps barrier

You can run a DNS server (2025)

Unlocking 25 Gigabit/S on 10 GbE Direct Attach Copper

Fedora 45 Aims for IPv6-Mostly Support Out-of-the-Box