Pavel's blog about underlying Internet technologies

Pavel Odintsov

sFlow on Huawei: story of scarcity and redundancy

Hello! I’m Pavel and I’m CTO and co-founder of FastNetMon LTD, London, 🇬🇧. We’re cyber security software vendor and we develop DDoS 🎯 detection and mitigation platform for Telecoms. This blog post is result of research and cooperation on this matter with Blažej Krajňák. Netflow and IPFIX for DDoS

BGP Flow Spec: Ultimate Weapon Against DDoS

Hello! I’m Pavel and I’m CTO and co-founder of FastNetMon LTD, London, 🇬🇧. We’re cyber security software vendor and we develop DDoS 🎯 detection and mitigation platform for Telecoms. In this article we’re going to discuss how BGP Flow Spec protocol can allow you to mitigate volumetric DDoS

Quirks of discarded traffic reporting on JunOS

Hello! I’m Pavel and I’m CTO and co-founder of FastNetMon LTD, London, 🇬🇧. We’re cyber security software vendor and we develop DDoS 🎯 detection and mitigation platform for Telecoms. To detect DDoS attack we need to get information about observed traffic from network equipment first. Our customers use variety

Main FastNetMon design principle: don't be a black box

FastNetMon project was built on very basic software engineering principle: don't be a black box 📦 You can see this approach on all levels of our product: * Open source core published at GitHub * Strong preference of RFC approved protocols: BGP Unicast, BGP Flow Spec, IPFIX, sFlow * Multiple options for

What is XDP after all?

Introduction Since XDP (eXpress Data Path) emerged as technology in mainline Linux around 2017 I heard large number of misconceptions and misunderstandings about it's purpose and capabilities. It's very hard to blame anybody for it as amount of high quality materials about this amazing technology is

High speed network traffic processing on Linux: part 1

Setting expectations After reading this article you will have high level understanding of best approaches for developing high performance user space Linux applications which work with live network traffic. Keywords We will talk a lot about following technologies (in historical order as author worked with them): pcap, PF_RING, Netmap,

Building gateway to access legacy IPv4 Internet from IPv6 only work laptop

Want to be among leading engineers testing IPv6 protocol by switching off IPv4 completely for your work laptop? But scared by inability to use IPv4 only services such as GitHub? I can recommend solution for it. We can use some protocol trickery to transparently "upgrade" all IPv4 connections

Sufficient set of fields required for IPFIX exporter implementation

There are multiple traffic telemetry protocols available from vendors and each of them has their own cons and pros. In this article we will focus on the most advanced one called IPFIX. It's a standardized vendor neutral protocol which offers ways to export almost all possible characteristics and

Using IDE CD drive as poor man audio player

My very first computer based on Intel Celeron 266 wasn't able to play mp3 music and computer game in same time. mp3 is pretty computationally heavy and used significant amount of very scarce CPU resource. The only way to listen audio during game was to use CD audio

Multiple inconsistencies in Linux Kernel 6.2 when SO_ATTACH_REUSEPORT_CBPF used with UDP sockets

I spent last week in researching ways how to load balance traffic between REUSE_PORT sockets with #BPF microcode. You may read part 1 here and part 2 here. Both articles accompanied with complete source code example licensed under Apache 2 license. Sadly SO_ATTACH_REUSEPORT_CBPF capability has mostly