Pavel's blog about underlying Internet technologies
Hello! I’m  Pavel  and I’m co-founder of FastNetMon LTD, London, 🇬🇧. We’re cyber security software vendor and we develop  DDoS detection and mitigation 🎯  platform  for Telecoms. For quite long time the only available way to notify
In first part of this series I covered such well known protocols as Netflow v5, Netflow v9 and IPFIX. In this article I'll continue conversation and will talk about protocols which offer more flexibility: sFlow v5 Port mirror Sampled port mirror Sampled port mirror over GRE Raw headers
Hello! I’m  Pavel  and I’m CTO and co-founder of FastNetMon LTD, London, 🇬🇧. We’re cyber security software vendor and we develop  DDoS  🎯 detection and mitigation  platform  for Telecoms. Please note that this article will be
Hello! I’m  Pavel  and I’m CTO and co-founder of FastNetMon LTD, London, 🇬🇧. We’re cyber security software vendor and we develop  DDoS  🎯 detection and mitigation  platform  for Telecoms. This blog post is result of research
Hello! I’m Pavel and I’m CTO and co-founder of FastNetMon LTD, London, 🇬🇧. We’re cyber security software vendor and we develop DDoS 🎯 detection and mitigation platform for Telecoms. In this article we’re going to discuss how BGP Flow Spec
Hello! I’m  Pavel  and I’m CTO and co-founder of FastNetMon LTD, London, 🇬🇧. We’re cyber security software vendor and we develop  DDoS  🎯 detection and mitigation  platform  for Telecoms. To detect DDoS attack we need to
FastNetMon  project was built on very basic software engineering principle: don't be a black box 📦 You can see this approach on all levels of our product: Open source core published at GitHub Strong preference of RFC approved protocols: BGP Unicast, BGP Flow Spec, IPFIX , sFlow Multiple
Introduction Since XDP ( e X press D ata P ath ) emerged as technology in mainline Linux around 2017 I heard large number of misconceptions and misunderstandings about it's purpose and capabilities. It's very hard to blame anybody for it as amount of high quality materials about
Setting expectations After reading this article you will have high level understanding of best approaches for developing high performance user space Linux applications which work with live network traffic. Keywords We will talk a lot about following technologies (in historical order as author worked with them): pcap, PF_RING, Netmap,
Want to be among leading engineers testing IPv6 protocol by switching off IPv4 completely for your work laptop? But scared by inability to use IPv4 only services such as GitHub? I can recommend solution for it. We can use some protocol trickery to transparently "upgrade" all IPv4 connections
There are multiple traffic telemetry protocols available from vendors and each of them has their own cons and pros. In this article we will focus on the most advanced one called IPFIX. It's a standardized vendor neutral protocol which offers ways to export almost all possible characteristics and
My very first computer based on Intel Celeron 266 wasn't able to play mp3 music and computer game in same time. mp3 is pretty computationally heavy and used significant amount of very scarce CPU resource. I did not find freely availavble Celeron 266 image and this one is
I spent last week in researching ways how to load balance traffic between REUSE_PORT sockets with #BPF microcode. You may read part 1 here and part 2 here . Both articles accompanied with complete source code example licensed under Apache 2 license. Sadly SO_ATTACH_REUSEPORT_CBPF capability
In first part of this article we evaluated multiple possible options to load balance UDP traffic between multiple sockets using SO_REUSEPORT capability. Due to nature of traffic in my particular case (majority of traffic is coming from single device) standard Linux kernel load balancing algorithm did not distribute it
If you're not familiar with my previous articles I would recommend this one which explains how can we capture 10 Millions packets per second on Linux without any third part libraries. In this article I'll step away from my usual habit of working with top tier