ipSpace.net

Celebrating 40 years of Ethernet ... at south pole

2013-05-22T10:22:00.000+02:00

Did you know Ethernet turned 40 today? I didn't (I was never good at tracking anniversaries), but Kris Amundson (the engineer keeping his network up and running in pitch dark Antarctica) quickly brought it to my attention with wonderful photos of South Pole Ethernet network built @ -69C (that's -92F if you're still ignoring the metric system).

Even better, they still have a thick coax cable with transceiver screwed into it!

Thanks for sharing, Kris! Really appreciated ;)

The Dangers of Ignoring IPv6

2013-05-22T06:45:00.000+02:00

I was sitting next to a really nice security engineer during the fantastic dinner-in-a-wine-cellar @ Troopers 13 and as we started talking about security implications of ignoring IPv6, I was quickly able to persuade him that it's dangerous to pretend IPv6 doesn't exist and that even though you might choose not to deploy it, you still have to acknowledge it exists and take protective measures.

It’s always great fun to explain the dangers of ignoring IPv6 to a networking or security audience, and see some people muttering “oh, ****”

Multi-Vendor OpenFlow – Myth or Reality?

2013-05-21T06:56:00.000+02:00

NEC demonstrated multi-vendor OpenFlow network @ Interop Las Vegas, linking physical switches from Arista, Brocade, Centec, Dell, Extreme, Intel and NEC, and virtual switches in Linux (OVS) and Hyper-V (PF1000) environments in a leaf-and-spine fabric controlled by ProgrammableFlow controller (watch the video of Samrat Ganguly demonstrating the network).

Does that mean we’ve entered the era of multi-vendor OpenFlow networking? Not so fast.

Troopers 13 – a must-visit security conference

2013-05-20T06:52:00.000+02:00

If you live in Europe and happen to be interested in security, make sure you put Troopers on the list of must-attend events. Like many things coming from Europe it’s a boutique event (limited to 200 attendees even if it means it’s sold out – that would never happen in some other parts of the world) with some great content.

Enno Rey, the mastermind behind the event, was kind enough to invite me to talk about virtual firewall architectures – you can view my presentation or watch the video – and of course I used the opportunity to visit a not-so-well-known Heidelberg attraction ;)

Expert Beginners

2013-05-18T11:09:00.000+02:00

Erik Dietrich obviously hates the self-proclaimed (usually clueless) “experts” – he devoted a whole series of blog posts to them:

I’m positive you know at least a few people that would match his descriptions. Enjoy!

How Networking Is Changing – Interview with Stu Miniman

2013-05-17T06:58:00.000+02:00

Stu Miniman kindly invited me to do an interview for the SiliconANGLE during the Interop/EMC World week. Here are the results:

More podcast and interviews

Tail-f Network Control System – the First Impressions

2013-05-16T07:06:00.000+02:00

One of the most pleasant surprises of the recent Interop show was the Tail-f's Network Control System (NCS). I “knew” Carl Moberg (of the NETCONF and YANG fame) for a long time and had the privilege to meet him in person just before the SDN Buyer's Guide panel that I co-hosted with Kurt Marko (who did an excellent job putting the buyer's guide together). Anyhow, what Carl presented during the panel totally blew me away.

Data Has Mass and Gravity

2013-05-15T06:35:00.000+02:00

A while ago, while listening to an interesting CloudCast podcast (my second favorite podcast - the best one out there is still the Packet Pushers), I stumbled upon an interesting idea “Data has gravity”. The podcast guest used that idea to explain how data agglomerates in larger and larger chunks and how it makes sense to move the data processing (application) closer to the data.

Build Data Center Interconnects with Enterasys Switches

2013-05-14T06:49:00.000+02:00

Short story: Enterasys data center switches have an interesting combination of time-tested routing and bridging features that allow you to build robust data center fabrics and interconnects (including the scenarios where you migrate VMs between them if you really must do so).

I’ll describe these features and how you can use them in a free webinar sponsored by Enterasys (register here). Don’t worry, that won’t make me biased; I still think moving a running VM between data centers makes no sense.

And now for a longer story ;)

Are stateless ACLs good enough?

2013-05-13T06:27:00.000+02:00

In one of his Open Networking Summit blog posts Jason Edelman summarized the presentation in which Goldman Sachs described its plans to replace stateful firewalls with packet filters (see also a similar post by Nick Buraglio).

These ideas are obviously not new – as Merike Kaeo succinctly said in her NANOG presentation over three years ago “stateful firewalls make absolutely no sense in front of servers, given that by definition every packet coming into the server is unsolicited.” Real life is usually a bit more complex than that.

Update: TRILL on HP Data Center Switches

2013-05-11T08:19:00.000+02:00

A few days after I published the Interop Product Launch Craze post, Jason Edelman told me HP claims they have running TRILL implementation. Time to read their release notes.

Results: No mention of TRILL in latest release notes for 12500, 9500 or 58xx. 5900 switches support TRILL, EVB and FCoE since release 2207 (January 2013).

More about changes in the data center switching market in the Data Center Fabrics Update webinar. Now I have to catch the next plane on the way home.

Cisco IOS TCP MSS handling on IPv6

2013-05-10T16:26:00.000+02:00

Just received an email from Trevor Warwick (Director, Cisco NOSTG Software Engineering, UK) on ipv6-ops mailing list (which you really should join if you plan to deploy IPv6) explaining the changes they made to IPv6 TCP MSS handling.

Dell Fabric Manager Explained

2013-05-10T11:54:00.000+02:00

In the last part of Clos Fabrics Explained webinar Brad Hedlund described how you can use Dell Fabric Manager to plan, design, configure and operate leaf-and-spine Clos fabric built with Dell Force10 switches. Should we call Dell Fabric Manager an SDN solution? Who cares, it sure is useful ;)

Watch the video

Dedicated Hardware in Network Services Appliances? Meh!

2013-05-09T15:26:00.000+02:00

Francesco made an interesting comment to my Virtual Appliance Performance blog post:

Virtual Appliance Performance is comparable to the equivalent Physical Appliance until the latter use its own ASICs (for a good reason), e.g. Palo Alto with its new generation Firewall...

Let’s do a bit of math combined with a few minutes of Googling ;)

Server Guy’s Guide to Virtual Networks

2013-05-08T14:52:00.000+02:00

I was asked to do a short virtual networking presentation during this year’s Microsoft NT Conference in Slovenia. Most of the audience were server and virtualization administrators, having anywhere from zero to pretty decent networking knowledge; getting the right balance of basics and interesting features was a struggle.

They told me the end result wasn’t that bad. It’s a bit Microsoft-biased, but applies equally well to VMware (be it vSphere/VXLAN or Open vSwitch/NVP combo).

View the presentation

Plexxi’s Dan Backman Presenting in the Data Center Fabrics Update Webinar

2013-05-07T14:58:00.000+02:00

Plexxi has a really interesting data center fabric solution that combines CWDM optics with L2+L3 switching. They briefed me on their product just before their public launch; I like their approach, particularly the combination of robust traditional forwarding with controller-based network optimization that you can influence from the outside, but somehow I never quite found the time to blog about them … although I did manage to solve the hard part of the problem: write a Perl script that generates Graphviz graph description to generate schematics of their CWDM inter-switch links.

Interop Product Launch Craze

2013-05-06T15:14:00.000+02:00

As expected, we’ve experienced a product launch craze just prior to Interop Las Vegas. I try to avoid marketing announcements, but the blogosphere exploded in hard-to-ignore posts ... and as always, it was great fun separating marketing fluff from reality. Here’s a grumpy take on the above-mentioned press releases.

TCP and HTTP Improvements

2013-05-03T10:23:00.000+02:00

In previous videos from the TCP, HTTP and SPDY webinar I described the network-related performance challenges experienced by web applications and did a deep dive into TCP and HTTP mechanisms underlying them.

Today’s video describes numerous TCP and HTTP enhancements – from increased initial congestion window (recently published as RFC 6928) and TCP fast open to persistent HTTP sessions and pipelining.

The whole webinar is also available on Udemy - it’s free but you’ll have to register (or log in with Facebook) to get access.

Watch the video

Attending Interop Las Vegas? Drop by!

2013-05-02T11:15:00.000+02:00

If you’re attending Interop Las Vegas next week, do drop by my Network Infrastructure for Cloud Computing workshop on Monday or one of the networking track sessions on Wednesday: Overlay Networking Explained in late morning and IPv6 – It’s High Time to Get Started in the afternoon. I’ve reserved plenty of time after each one for follow-up questions and discussions.

Other fine sessions you shouldn’t miss: Beware the Firewall, My Son! by Network Security Princess, Chopping Down the Fat Tree by venerable Ethan Banks, Death to Spanning Tree by Data Center Overlord Tony Bourke and How to Keep Video from Blowing Up Your Network by the very first CCIE Terry Slattery.

Open vSwitch Under the Hood

2013-04-30T07:47:00.000+02:00

Hatem Naguib claimed that “the NSX controller cluster is completely out-of-band, and never handles a data packet” when describing VMware NSX Network Virtualization architecture, preemptively avoiding the “flow-based forwarding doesn’t scale” arguments usually triggered by stupidities like this one.

Does that mean there’s no packet punting in the NSX/Open vSwitch world? Not so fast.

They want networking to be utility? Let’s do it!

2013-04-29T07:44:00.000+02:00

I was talking about virtual firewalls for almost an hour at the Troopers13 conference, and the first question I got after the presentation was “who is going to manage the virtual firewalls? The networking team, the security team or the virtualization team?”

There’s the obvious “silos don’t work” answer and “DevOps/NetOps” buzzword bingo, but the real solution requires everyone involved to shift their perspective.

Virtual Firewall presentation from Troopers 13

2013-04-26T08:40:00.000+02:00

The 45 minute virtual firewalls presentation I had at Troopers 13 is now available online. The virtual firewalls webinar is an in-depth 2,5 hour version that includes numerous product architectures.

You can get all my recent public presentations and a list of upcoming events on my web site.

View the presentation

Why are 3G networks so slow?

2013-04-25T07:17:00.000+02:00

More than four years ago one of our engineers wrote about uselessness of UMTS connections for inter-router backup links and although I got numerous comments trying to explain the issues I never found a good explanation that a simplistic networking engineer like me could understand.

Ilya Grigorik fixed that. His Breaking the 1000 msec Time-to-Glass Mobile Barrier talk has some real-world statistics, and a fantastic description of how 3G/4G networks work and what causes the enormous latencies. His High Performance Browser Networking book has even more details. Enjoy!

Resiliency of VM NIC firewalls

2013-04-24T06:59:00.000+02:00

Dmitry Kalintsev left a great comment on my security paradigm changing post:

I have not yet seen redundant VNIC-level firewall implementations, which stopped me from using [...] them. One could argue that vSwitches are also non-redundant, but a vSwitch usually has to do stuff much less complex than what a firewall would, meaning chances or things going south are lower.

As always, things are not purely black-and-white and depend a lot on the product architecture and implementation.

Virtual Appliance Performance is becoming a non-issue

2013-04-23T06:54:00.000+02:00

Almost exactly two years ago I wrote an article describing the benefits and drawbacks of virtual appliances, where I listed virtualization overhead as one of the major sore spots (still partially true). I also wrote: “Implementing routers, switches or firewalls in a virtual appliance would just burn the CPU cycles that could be better used elsewhere.” It’s time to revisit this claim.