标签：#net

Even though networking fundamentals are often taught at the early stages of a tech career, their relevance becomes far more important when you begin working with distributed IoT and edge-driven architectures. Concepts like subnetting, routing, NAT, DNS, firewalls, and VPNs evolve from simple textbook ideas into core architectural tools that determine how devices communicate, how secure the system remains, and how reliably data moves between the edge and the cloud. This refresher looks at these fundamentals from the perspective of someone building and supporting real IoT and edge environments. The goal is not to re-teach the basics, but to reconnect them with the realities of large-scale, low-power, and cloud-connected systems. 1. Subnetting as the Backbone of IoT Network Segmentation Subnetting plays a much bigger role in IoT and edge-driven environments than most people realize. In traditional networking, subnets help organize traffic and reduce broadcast noise. In IoT, they become a core part of the system architecture. When you’re dealing with sensors, gateways, and edge compute nodes running side by side, the network must be segmented in a way that keeps each function secure and predictable. A typical LoRaWAN setup shows this clearly. The gateway LAN, the packet-forwarder network, and the edge analytics node usually sit in different subnets. This separation allows you to apply strict ACLs around what each component can communicate with, especially because IoT devices often have limited security controls of their own. Subnetting also helps manage traffic flow, ensuring that noisy sensor broadcasts don’t interfere with time-sensitive edge workloads. Beyond security, good subnet design improves fault isolation. If a node misbehaves, the impact is contained within its segment. This structure also supports multi-tenant IoT deployments, where different applications or departments share the same physical infrastructure without touching each other’s data paths. In short

⚡ TL;DR Four things about controller mechanics are widely half-understood: what Reconcile receives, where its work comes from, what a periodic resync is, and what a predicate turns off. I built an operator, broke it five ways, and measured each mechanism directly. The reconcile function runs in 2.71ms mean, 77/77 under 25ms , a short resync period costs zero additional API requests , and GenerationChangedPredicate cut steady-state reconciles by 48.5% without touching live repair at all. That last combination is the one that matters at scale. Repo, raw data, and harness: kirPoNik/k8s-drift-operator . 🧩 The four barriers Everyone who runs Kubernetes knows the platform repairs itself. Delete a pod, it comes back. Scale a Deployment by accident, something puts it back. Almost nobody who relies on that property can say how it works, and the gaps are specific and consequential. I keep meeting the same four: People think a controller is told what changed. It is not, and the reason it is not is the single most important design decision in Kubernetes. People think a controller polls the API server. It does not, and knowing what it does instead tells you where your API load actually comes from. People think a resync is a re-check against the cluster. It is not, which is why a short resync period is nearly free — and why the number that is expensive sits somewhere else entirely. People treat a predicate as a pure optimisation. It is a filter with a silent cost, and the cost is not the one the documentation warns you about first. So I built the smallest system that has the self-healing property, broke it on purpose ten times per failure mode, and instrumented each of those four mechanisms until I could state what it does rather than what it is said to do. What I built. One CRD called Echo , holding an image, a replica count, and a greeting. A controller keeps three child objects in sync with it — a Deployment, a Service, and a ConfigMap holding the greeting — with owner referen

Every messenger you use has a hidden dependency: a working network path to a datacenter. Drop into a basement, a packed stadium, a moving train through a tunnel, an exam hall with jammers, or a remote area with no plan, and the app is just a spinner. The people you want to reach are often standing a few meters away, but your message still has to travel to a server on another continent and back. When that path is gone, so is the app. Kabootar is my attempt to remove that dependency entirely. It is a messenger with no backend at all. Your phone forms a peer-to-peer mesh with other phones nearby, and messages hop device to device over Bluetooth and Wi-Fi until they reach the recipient. No internet, no servers, no SIM. It is built in Flutter, and the routing core is plain Dart. The core idea: delay-tolerant networking The insight that makes this work is refusing to assume the recipient is reachable right now . Normal networking is connection-oriented: open a path end to end, then send. If there is no path, there is no delivery. Kabootar instead treats the network as a delay-tolerant network (DTN). A message does not need a live end-to-end path at the moment you hit send. It needs a chain of carriers that will exist over time . You hand your message to whoever is nearby. They hold onto it, carry it as they walk around, and pass it along to the next phone they meet. Eventually a carrier bumps into the recipient and the message lands, even if that is minutes later and both you and the recipient have long since walked away. This is store-and-forward, the same shape as a durable, at-least-once message queue, except the queue is running across a swarm of phones instead of inside a datacenter. How a message actually travels The routing strategy is epidemic routing: flooding. When you send a message, it spreads to everyone in range like a rumor. Each device that receives it re-broadcasts it onward, so the message replicates through the crowd, taking every path at once. That red

If your AWS bill has a NAT Gateway line, you are paying twice for the same packet: once for the gateway to merely exist, and again for every gigabyte it carries. The fix for most teams is dull and free. Add an S3 and a DynamoDB gateway endpoint, route the heavy traffic away from NAT, and only then argue about anything fancier. That single change is free to turn on, takes minutes, and stops the most expensive traffic from ever touching the meter. This is a playbook, not a lecture. The trick with NAT Gateway pricing is that the two charges hide in different places on the bill, so most teams only ever see half of it. Numbers first, then the fixes, in the order I would actually do them. What you are actually being charged for NAT Gateway has two charges, and people forget the second one until they read the bill closely. Hourly charge — you pay for every hour the gateway is provisioned and available, whether or not a single byte moves through it. In us-east-1 (N. Virginia) and us-east-2 (Ohio) this is $0.045 per NAT Gateway-hour . That is roughly $32.85 a month per gateway just to keep the lights on. Partial hours bill as full hours. Data processing charge — you pay $0.045 per GB processed through the gateway, in the same region, on top of the hourly charge. This applies to every gigabyte, inbound or outbound, regardless of source or destination. And then there is the part the pricing page mentions almost in passing: standard AWS data transfer charges still apply on top. NAT processing is an extra meter on traffic you were already paying to move. The hourly charge is fixed and visible. The per-GB charge is the one that catches teams out, because it scales with traffic you mostly cannot see: package installs, container image pulls, S3 reads from private subnets, telemetry shipped out, cross-region calls. The rate varies by region (it runs higher in places like São Paulo, where both the hourly and per-GB rates sit around $0.093), so check your own region rather than trusti

I rent six dedicated servers from a company in Germany. Together they have more cores, more memory, and more SSD than most production clusters I worked on a decade ago. I run my own Kubernetes on them. Not managed. Not EKS. Not GKE. The whole stack, from the immutable OS up to the workloads. People who hear this ask me why, and the question usually arrives in one of two tones. The dangerous tone is "that's amazing, how do I do it" . The responsible tone is "why on earth would you do that to yourself" . This post is for the second group. Why the cloud is the right answer for almost everyone Let me get this out of the way honestly: by every conventional metric, I should be using the cloud. Managed Kubernetes has become genuinely good. EKS has dramatically improved over the last three years. GKE has always been better than people gave it credit for. The serverless options are mature. The serverless databases are mature. The observability is mature. The bill is predictable in the way a Tuesday is predictable. Self-hosting violates almost every assumption that makes a startup productive. Time is the most expensive resource you have. The cloud sells you abstractions that turn that time into product. Running your own substrate means the time goes into the substrate. If you are trying to ship a product to customers — go use the cloud. Stop reading this post. It will only confuse you. What the cloud does not sell you Here is what the cloud will not sell you, even if you are willing to pay extra: control over your own roadmap. The cloud's roadmap is the cloud's. They decide which APIs deprecate. They decide which regions get the new feature. They decide what your egress bill looks like. They decide whether your monitoring vendor — sitting on top of their infrastructure — is allowed to charge you eight times what it would cost you to host the same software yourself. They decide whether the small ML company hosting your fine-tuned model gets acquired by someone with very differ

Adapted from my original Japanese article , with AI-assisted translation and editing. My manager: “Test this device.” (Doesn't really know the product or the technology.) Me: “Sure.” (Also doesn't really know the product or the technology.) If you've worked in infrastructure, that may sound familiar. I'm Goda, a network engineer sharing things I learned while figuring out the job. SNMP comes up in a lot of network device testing. For a while, my idea of an SNMP test was simple: Run snmpwalk . Watch a pile of OIDs and values scroll past. Mark SNMP as working. A screen full of output is reassuring. It certainly looks like something is being monitored. Then I was asked to write a test plan for a device. I added an item along the lines of “Confirm that information can be retrieved using SNMP” and sent it for review. The feedback was: Which OIDs will you use for CPU and memory? The customer will probably ask. You should at least cover those. That was when it clicked: a successful walk and successful retrieval of the metrics we need are two different things. My other thought was, “Fine, you write the test plan, then.” But the feedback was fair. Getting something back is not the same as getting what you need. What did the successful walk actually prove? snmpwalk is useful. Net-SNMP's tool uses GETNEXT requests to walk through a subtree starting from a specified OID. Net-SNMP manual If it successfully returns values, you've established that you could read those values under those test conditions . That matters. It does not, by itself, establish that your CPU and memory monitoring requirements are satisfied, or that every required OID is available. I had been treating a successful command as a much broader result than it actually was. Break “SNMP testing” into specific checks Today, I'd separate at least these questions: Question What to check Can I communicate over SNMP? Whether the device responds to the intended request under the defined conditions Can I monitor CPU? The

Yash K Saini — Engineer, building in public — AI/ML, low-level (Rust/C/C++), and open source. GitHub...

Ev Ağı Nasıl Çalışır? Bir ev ağını en basit haliyle şöyle düşünebiliriz: Internet │ ISP ağı │ Ev Router'ı │ ┌─────────────┼─────────────┐ │ │ │ Laptop Telefon NAS Ev router'ı burada iki farklı dünyayı birbirine bağlar: ISP üzerinden ulaştığı dış ağ ve evdeki cihazların bulunduğu yerel ağ. Bu basit topolojinin arkasında LAN, WAN, subnet, DHCP, routing, NAT, firewall, bridge ve VLAN gibi kavramlar birlikte çalışır. 1. Ev ağı, ISP ve internet tarafı LAN ve WAN LAN — Local Area Network , router'ın yerel ağ tarafıdır. Evdeki laptop, telefon, NAS, televizyon gibi cihazlar genellikle bu tarafta bulunur. Örneğin router'ın LAN adresi: 192.168.1.1/24 olsun. Cihazlar da: Laptop 192.168.1.20 Telefon 192.168.1.30 NAS 192.168.1.50 adreslerini kullanabilir. Bunların tamamı aynı: 192.168.1.0/24 yerel IP ağına aittir. WAN — Wide Area Network ise router'ın kendi yerel ağı dışındaki bir upstream ağa bağlandığı taraftır. Tipik bir evde: Internet / ISP │ WAN │ Router │ LAN │ Ev cihazları şeklinde görünür. LAN ve WAN, Ethernet kablosunun fiziksel türünü tanımlamaz. Aynı standart Ethernet bağlantısı bir router için LAN, başka bir router için WAN rolünde olabilir. Örneğin: Internet │ Upstream Router LAN: 192.168.1.1 │ │ Ethernet ▼ Downstream Router WAN: 192.168.1.50 LAN: 192.168.10.1 Buradaki 192.168.1.0/24 ağı: upstream router açısından LAN, downstream router açısından WAN tarafıdır. Dolayısıyla LAN ve WAN kavramları hangi router açısından baktığımıza göre anlam kazanır . Upstream ve downstream Ağda internet veya daha üstteki ağa doğru olan yön upstream , son kullanıcı cihazlarına doğru olan yön ise downstream olarak adlandırılır. Internet │ Upstream Router │ Downstream Router │ Laptop Downstream router'ın internete doğru bağlandığı router onun upstream router'ıdır. Bu terminoloji özellikle evde bir modem/router arkasına ikinci bir router bağlandığında kullanışlı hale gelir. ISP'nin rolü ISP — Internet Service Provider , ev ağını daha büyük internet altyapısına bağlayan servis sağlayıcıdı

Choosing a thread-safe collection is not simply a matter of replacing Dictionary<TKey, TValue> with ConcurrentDictionary<TKey, TValue> . The right choice depends on the operations you need to make atomic, the ratio of reads to writes, whether consumers must block, and whether the data can become immutable after construction. This guide explains how ordinary generic collections fail under concurrent access, then compares the main types in System.Collections.Concurrent with immutable and frozen collections. The goal is to give you enough mechanical detail to defend the choice in code review—not just a catalog of APIs. C# Concurrent Collections: Quick Selection Guide Requirement Start with Concurrent FIFO processing ConcurrentQueue<T> Concurrent LIFO processing ConcurrentStack<T> Concurrent key-based reads and updates ConcurrentDictionary<TKey, TValue> Unordered items produced and consumed by the same workers ConcurrentBag<T> Blocking or bounded producer-consumer flow BlockingCollection<T> Snapshot-style updates System.Collections.Immutable Build-once, read-many lookup data System.Collections.Frozen The table is a starting point, not a substitute for checking which compound operations must be atomic. The sections below explain the mechanics and tradeoffs behind each choice. Why C# Needs Thread-Safe Collections C# 1.0 introduced System.Collections , which includes ArrayList , Hashtable , Stack , Queue , and other collection classes. The problem is that these collections are not type-safe. They store elements as object , which can lead to type-mismatch exceptions and to performance costs from boxing and unboxing. C# 2.0 then introduced the System.Collections.Generic namespace and collection classes such as List<T> , Dictionary<TKey, TValue> , Stack<T> , and Queue<T> . These collections are type-safe, but not thread-safe. Type safety means that when you create a generic collection, you specify the type it stores as a generic type parameter. Reading an element then returns

If you're prepping for the Certified Kubernetes Application Developer (CKAD) exam, you've probably already found killer.sh, Killercoda, or one of the paid mock-exam platforms. I wanted something different: no account, no cloud dependency, no subscription — just a simulator that runs entirely against my own cluster, so I could rerun the same drills as many times as I wanted without worrying about usage limits. That's CKAD Dojo — free, open source, self-hosted. What it actually does 20 free mock exams, 398 questions, mapped to the official CKAD v1.35 curriculum A 120-minute countdown timer that mirrors the real exam (turns yellow at 15 min, orange at 5, red at 1) An embedded web terminal (ttyd) right next to the question panel — same gesture as the real exam UI, no window-juggling Instant, real scoring: bash functions query the actual state of your cluster against 400+ criteria, question by question. You don't have to wait until the end to know if you got it right. Runs against your own cluster — kubeadm, minikube, or kind (1.28+). Nothing leaves for the cloud. Why "dojo"? Each of the 20 practice sets is themed after a figure from Japanese mythology or the four celestial guardians (Suzaku, Byakko, Genbu, Kirin...). Resources inside each dojo follow the theme, so kubectl get pods genuinely reads like a small story instead of pod-1, pod-2, pod-3. Small detail, but it makes repeated drilling less soul-crushing. The loop Open a dojo — namespaces, workloads and Helm releases get provisioned for you. Scripts are idempotent, so you can rerun them freely. Train in the terminal — question on the left, real shell on the right, resizable divider. Arrow keys to navigate, F to flag a question, collapsible hints if you're stuck. Score whenever you want — not just at the end. Wipe and redo — read solutions.md, clean the cluster, and run the same dojo again tomorrow. The goal is reflex, not memorized answers. It's community-built 14 of the 20 dojos come from contributors — 9 as fully

Kubernetes is encouraging developers to take a closer look at KYAML, a stricter dialect of YAML designed to make Kubernetes configuration more explicit, predictable, and less prone to common YAML errors. By Craig Risi

When building an online game in Unity, the question is often framed as: Should I use Photon, Netcode for GameObjects, FishNet, or Mirror? That question is too small. In 2026, there is still no single networking product that is optimal for every Unity game. The real decision is a stack : transport, netcode, authority model, session management, server hosting, and backend services. For a GameObject-based action game that needs client prediction, Photon Fusion 2.1 is a strong first PoC baseline . If your priorities are Unity Gaming Services, DOTS/ECS, self-hosting, source access, or deterministic simulation, the starting point changes. This article explains how to make that decision in production terms: latency, cheating, reconnection, hosting, bandwidth, operations, and total cost. This article uses official documentation checked on August 31, 2026 as its factual baseline. SDK versions, pricing, licensing, and service availability can change, so re-check them before committing a production project. What I mean by a real-time multiplayer game The target is roughly this class of game: 2–32 players in the same session continuously synchronized players, enemies, projectiles, or interactable objects input latency that directly affects game feel reconnects, host loss, and late joining that must be handled co-op action, FPS/TPS, racing, or competitive action If you only need turn-based play, leaderboards, chat, friends, or asynchronous PvP, you may not need a sophisticated state-synchronization netcode at all. A backend such as Nakama, PlayFab, or Unity Gaming Services may be the more important part of the architecture. Do not treat “networking” as one product A production multiplayer stack has at least five layers. Layer Responsibility Examples Transport Packet delivery, reliability, connection path, secure channel integration Unity Transport, Photon transport, UDP/WebSocket-based transports Netcode Replication, RPCs, input, prediction, interpolation, rollback Fusion, NGO,

This project started with a simple goal: run Kubernetes without keeping an EKS cluster online every day. In I Wanted Kubernetes Without an Always-On EKS Bill , I built an always-on k3s lab on my home server and proved that I could deploy, update, and roll back an application. The rollback worked, but it exposed the next problem. Kubernetes restored Version 2 while the saved YAML still declared Version 3. I corrected the file manually, but the recovery depended on repairing the running cluster and its saved instructions separately. In The Rollback Worked. My Next Deploy Could Break It Again , I designed a safer path. The automated build process would test and publish an exact image, then stop at a Git pull request. Git would record the reviewed version. Argo CD, running inside Kubernetes, would make the cluster follow that record. Now I needed to prove that the design worked outside a diagram. I followed one release from source code to running Pods. Then I tested two opposite failures: The cluster was wrong while Git was correct. Git contained a bad setting while the cluster followed it correctly. Those experiments showed both the value and the limit of GitOps. Automation can make the cluster match Git, but it cannot decide whether the human-approved version in Git is a good one. CI Built the Release but Did Not Deploy It The GitHub Actions workflow—my continuous integration, or CI, worker—ran the application tests and checked the Kubernetes package before building anything. Its job was to prove and publish a release, not to change the cluster. After validation, Buildx created a Linux AMD64 image with the full source commit baked into /version : docker buildx build \ --platform linux/amd64 \ --build-arg "APP_VERSION= $GITHUB_SHA " \ --tag " $image_name : $GITHUB_SHA " \ --provenance = mode = max \ --sbom = true \ --push \ application After publishing the image, CI read its registry digest. A digest is the image's content fingerprint: if the image changes, the digest

A Ravenloft series is currently in development from executive producer Alfonso Cuarón, writer and executive producer John August, and Hasbro Entertainment, Deadline reports. It could bring to life one of Dungeons & Dragons' most iconic campaign settings, which got an update earlier this year with Ravenloft: The Horrors Within. Netflix's Ravenloft series will reportedly center […]

The acquisition also leaves Sequoia-backed Serval as the de facto startup leader in AI IT service automation, industry watchers believe.

A startup called Mostik has a wild new approach to combining the capabilities of AI models.

Upgrading Juniper MX Networks from 100GbE to 400GbE: What Engineers Need to Know Moving a production network from 100 Gigabit Ethernet to 400 Gigabit Ethernet sounds simple on paper: Replace a 100G interface with a 400G interface and get four times the bandwidth. In a real carrier or data-center network, however, the interface is only one part of the equation. The router's forwarding silicon, switch fabric, midplane, power system, cooling, optics, software release, slot selection, redundancy configuration, and licensing can all determine whether the expected capacity is actually available. Juniper's MX240, MX480, and MX960 platforms provide an interesting example because these systems can be upgraded with newer generations of Modular Port Concentrators rather than requiring an immediate chassis replacement. One particularly useful case study is the Juniper MPC10E-15C , a Trio 5-based line card capable of supporting both 100GbE and 400GbE interfaces. This article isn't about whether you should buy a particular line card. Instead, we'll use the MPC10E-15C to examine the engineering questions that should be answered before attempting a 100G-to-400G upgrade on an existing Juniper MX network. Video Overview The video provides a short overview of the hardware. Below, we'll go deeper into the architecture and the deployment considerations that matter when integrating this class of line card into an existing MX environment. Why Moving from 100G to 400G Isn't Just a Port Upgrade Suppose an edge router has four heavily utilized 100GbE connections. At first glance, replacing those links with 400GbE interfaces appears straightforward. But consider what happens behind the physical port. Traffic entering that 400G interface must travel through several parts of the system: Interface → Packet Forwarding Engine → Fabric → Other line cards/interfaces Every component in that path needs sufficient capacity. A 400GbE optic connected to a router that cannot move 400 Gbps through its inte

Swiggy developed an in house predicted lifetime value model using more than 350 pre order features and a multi task MLP for Food and Instamart. Adding order count as an auxiliary task reduced model parameters by 63% while improving predictive performance. The pLTV signal is used with Google Target ROAS bidding to optimize customer acquisition. By Leela Kumili

The official record is one sentence: an "authorized attacker," a local path traversal in Azure Kubernetes Service, 8.8 CVSS. The researchers who found the bug headlined it differently: "From AKS node root vulnerability to Microsoft Copilot hijack." Same vulnerability. The distance between those two descriptions is the story, and the aggregators missed it. Context matters here. June 2026 brought a 206-vulnerability Patch Tuesday with three disclosed zero-days, the largest on record. A "local" traversal with an EPSS of 0.00336 sinks in that noise. The two most visible public writeups are openly machine-generated, and one claims no vendor fix exists in the same entry that recommends the Microsoft update. The actual chain never got told. The chain, with the honest part labeled The flaw is CWE-22 in AKS file path handling: input is not canonicalized against a restricted base directory, so ../ sequences and absolute paths escape the intended root. The fixed line is node image build v0.20260213.5, delivered through the AKS update channel. Both facts point at Microsoft-built node-side components, not upstream Kubernetes. The load-bearing character in the CVSS vector is S:C, scope changed. The traversal is the lockpick. The scope change is the container-to-host escape. Root on a managed node hands you the kubelet's credentials, every projected service account token on the box, the runtime socket, and whatever cloud identity material the node can fetch. Worth noting: Microsoft's own title says "Remote Code Execution" while the vector says AV:L and cvefeed flatly states "Remotely Exploit: No." My read: "local" is measured from the node. An authenticated tenant running code in their own pod already holds that position. That's a normal Tuesday with a working deployment, not a high bar. Stage four, the Copilot hop, is public only as a title, and I'm flagging that instead of pretending otherwise. The shape of this attack class is standard, though. Assistants wired into control pla

Hello, I'm Maneshwar, and I'm building LiveReview — a blast-radius aware AI code review built for your business-critical systems. Star us to help devs discover the project, give it a try, and share your feedback to help improve the product. You open a video and it starts playing in about a second. Somewhere between your thumb and that first frame, your request crossed maybe fifteen different companies' equipment, possibly an ocean, and came back. Nobody coordinated it. That is the part I find genuinely strange about the internet, and it is the part most explanations skip. They tell you the internet is "a global network of networks", which is true and tells you nothing. So let's actually take it apart. There is no internet. There are 75,000 of them. The single most useful thing to understand up front: the internet is not a thing anyone built. It is roughly 75,000 independent networks that agreed on how to hand traffic to each other. Your ISP is one. Your university is one. Cloudflare is one. They own their own cables and routers, they answer to nobody in particular, and they interconnect voluntarily. Once you see it that way, every weird thing about the internet starts making sense. The whole arrangement has three parts: The edge is everything that actually wants to say something. Your phone, a laptop, a server in a rack, and increasingly a doorbell. These are called hosts or end systems , and they split roughly into clients that ask and servers that answer. The access network is your on-ramp. Fibre or cable at home, the office network, 5G from your pocket. Its only job is getting you to the first router. It is also, almost always, the slowest part of the entire journey, which is worth remembering next time you blame a website for being slow. The core is the mesh in the middle. Routers and the links between them, and nothing else. No control room, no master server, no company that owns it. Nobody reserved you a line Here is where the design gets clever. Before the in