Funemployment

My wife and I recently moved continents, and I have now joined the ranks of the funemployed, because (for our family) moving was more important that moving to a job. I'm certainly going to miss my old job (because, aside from being given billions of dollars and told to go explore the oceans, "Network Architect" is exactly where I want to be, and I worked with great people and did fun things!).

Read on for some thoughts on how to make the most of this process, and perhaps some ideas of what to do when you move vast distances...

Trust Boundaries and Reliable Backups: Ransomware Edition

A network whose administrators I know quite well has been thoroughly compromised and critical files encrypted, and much configuration destroyed. Even their backups (such as they were) are no more.

This is, to put it mildly, a fairly catastrophic incident for any organisation.

We turned our minds to the issue and thought about how we can prevent similar things happening to us...

Happy Eyeballs. Unhappy user.

As part of the migration efforts to IPv6, many programs implement a system known as "happy eyeballs". The basic premise is that sometimes, IPv6 "is flaky", and after a while, you should give up and take the IPv4 option - resulting in some "happy eyeballs". In a dual stack system, IPv6 is preferred.

Well the thing about this is it is S L O W... and users (not unreasonably) get grumpy about it. Here's a case where something went wrong, and *everything* was subjected to this delay.

Port Mirroring in Junos

So sometimes, the manual isn't quite detailed enough...

At the moment, our telephony people are having some issues with various things like handsets logging themselves out under certain conditions.

Vendor support has requested packet captures, and rather than schlepping around to the four corners of campus, dropping off laptops by each switch stack, I thought "wait, Junos does port mirroring, and it looks straightforward".

It is, and it isn't...

Glitchy RPKI OV and uRPF: one hell of a match

I've previously written about RPKI and mentioned some of the glitches. It looks like there are some other fun interactions to be had if you're implementing all the "best practice" internet edge routing for your customers...

One year on, in a different kind of school...

A year ago (to the day), I started what I would seriously consider a "dream job title" - that of Network Architect at a University (at the first place in sub-Saharan Africa to have an Internet connection - so long ago that its first IP address allocation was done within an RFC!). It ticked all my boxes in terms of favourite things to do, and promised to throw me in at the deep end in a much more challenging environment. I didn't have any particular desire to leave my last position (which I enjoyed immensely), but when I got two phone calls some time apart strongly suggesting I ought to apply for the position, and with an interesting list of "things we need done", after much hand-wringing, I jumped at the chance, and made it through the selection process. #GreatSuccess.

Securing Internet Routing: RPKI OV and ROAs

For some time now, I've had a ticket in my queue to "Investigate RPKI". A few weeks ago, we experienced some strange internet outages that turned out to be because not all is well with RPKI Origin Validation at one of our upstream ISPs...