All 54 articles, sorted alphabetically
Tune Passive Outlier Detection Without Ejecting Too Many Hosts
Passive outlier detection removes hosts that fail live traffic. How consecutive-error and success-rate detection decide, why the default 10 percent cap ejects nothing below ten hosts, how ejection time grows and decays, and when ejection makes an outage worse.
Read article →Pooled HTTP Connections That Die Mid-Request: Idle Timeout Mismatches, the Reuse Race and Which Retries Are Safe
Why a client that keeps idle connections longer than the server or load balancer occasionally sends a request into a closed connection, what JDK HttpClient and Python http.client did in a local test, which requests may be retried, and how to set idle timeouts along a path so it stops happening.
Read article →Cilium 1.20.3: A Conntrack Garbage-Collection Race That Broke Live SNAT Connections, Network Policies That Enforced Nothing, and DNS Lost During Agent Restarts
Cilium 1.20.3, released 15 October 2026, fixes a time-of-check to time-of-use race in batched conntrack garbage collection that could reallocate SNAT ports of live connections, marks CiliumNetworkPolicies with nodeSelector as invalid, and keeps DNS working through agent restarts.
Read article →Path MTU Black Holes: Overlay Encapsulation Overhead, Filtered ICMP, MSS Clamping and Packetization-Layer Probing
Why connections that complete a handshake and then hang on large responses are usually a path MTU problem: encapsulation overhead, filtered ICMP breaking classic discovery, how to confirm it, and when to fix it with interface MTU, MSS clamping or packetization-layer probing.
Read article →Envoy 1.40.0: HTTP/3 and QUIC Declared Stable, Post-Quantum Key Exchange by Default, Route Specifiers, Event-Driven Drain and the Breaking Build and MCP Router Changes
Envoy 1.40.0 (13 October 2026): QUIC and HTTP/3 promoted to stable, a hybrid post-quantum curve in the default TLS key exchange, route specifiers, event-driven drain, and incompatible changes to the Bazel build, MCP router header forwarding and the Rust dynamic module ABI.
Read article →gRPC Load Balancing on Kubernetes: Why One HTTP/2 Connection Pins Traffic, and the Fixes
Why gRPC traffic stays on a few Pods behind a Kubernetes Service, the arithmetic of connection pinning, and how client-side round_robin, MAX_CONNECTION_AGE, L7 proxies and xDS compare, with configuration and failure analysis.
Read article →Anycast DNS Explained, in depth: why DNS fits anycast, health-checked BGP announcements, catchment debugging, zone consistency and multi-provider design
How anycast DNS works and how to operate it: one address announced from many sites, why UDP DNS suits it, a health check that drives BGP announce and …
Read article →Anycast Explained, in depth: one address on many hosts, health-gated BGP announcements, ECMP and Maglev hashing, and finding which site answered
A hands-on guide to anycast: how one IP address announced from many sites reaches the nearest one, ExaBGP with a health checker that has hysteresis, w…
Read article →BBR Congestion Control, in depth: how Linux tcp_bbr turns ACKs into a pacing rate, its constants and code paths, and a netem lab to watch it compete with CUBIC
A code-level tour of BBR as Linux actually ships it: the congestion-ops hooks, delivery-rate samples from tcp_rate.c, the windowed max-bandwidth filte…
Read article →BGP Basics for Application Developers, in depth: how your prefix reaches users, why outages are partial, and what to do about it
A developer's guide to BGP: autonomous systems, prefixes and announcements, why routing failures affect some users and not others, reading RIPEst…
Read article →DNS in 2026, in depth: the root KSK-2024 cutover, SHA-1 leaving DNSSEC, fragmentation-free UDP, HTTPS records with ECH, encrypted resolver discovery and .internal
What changed in DNS and what operators need to do about it in 2026: the root zone switching to KSK-2024 on 11 October 2026 and how to check every reso…
Read article →DNS in Microservices, in depth: Kubernetes service records, ndots and search-list amplification, caching layers, connection pinning and the failure modes that cause 5-second stalls
How DNS works as the service-discovery layer for microservices: the A, AAAA and SRV records Kubernetes publishes, ClusterIP versus headless Services, …
Read article →Edge Routing, in depth: anycast versus GeoDNS versus latency-based DNS, failover arithmetic and measurement-driven steering
How to decide where user traffic enters your network: the three layers of edge routing, how anycast and DNS-based geo and latency steering actually ch…
Read article →HTTP/3 (QUIC) in production, in depth: a rollout and measurement runbook
How to roll out HTTP/3 safely and prove it helped: prerequisites, staged Alt-Svc advertisement with a holdout cohort, HTTPS DNS records, rollback with…
Read article →IPv6 in 2026, in depth: what the adoption numbers mean, the public IPv4 bill, and a readiness playbook for applications, clouds and Kubernetes
A practical IPv6 guide for 2026: how to read the adoption figures, why public IPv4 now costs money, how clients reach you through NAT64 and 464XLAT, d…
Read article →mTLS Certificate Rotation, in depth: leaves, intermediates and roots on both sides of the connection, without an outage
How to rotate certificates in mutual TLS without breaking connections: renewal timing arithmetic, hot-reloading certificates and trust bundles in Go, …
Read article →Anycast architecture
Deep-dive on anycast: announcing one prefix from many PoPs, BGP path selection and catchment behavior, health-gated withdrawal as the drain mechanism,…
Read article →BBR Congestion Control Architecture, in depth: the bottleneck model, delivery-rate estimation, the state machine, v1's flaws and v3's fixes
How BBR congestion control works and how to run it: why loss-based control fills buffers, the bandwidth and min-RTT model, delivery-rate sampling, pac…
Read article →BGP architecture, in depth: sessions, RIBs, best-path selection, policy, route security and convergence
How the Border Gateway Protocol works inside a router and across the Internet: the session state machine and messages, Adj-RIB-In, Loc-RIB and Adj-RIB…
Read article →CDN architecture -- content close to the user
Deep-dive on CDN architecture: edge PoPs near users, anycast routing to the nearest edge, edge caching and origin offload, cache keys and TTL, invalid…
Read article →Connection pooling architecture
Deep-dive on connection pooling: why reuse and — more importantly — concurrency limiting matter against a finite backend, the acquire path and its thr…
Read article →Linux conntrack architecture
Deep-dive on nf_conntrack: the 5-tuple hash table, reply tuples and NAT bindings, per-state timeouts as the real capacity knob, table-full drops vs ev…
Read article →DNS Architecture, in depth: stub and recursive resolvers, delegation and glue, caching and TTLs, EDNS and TCP, encrypted transports and DNSSEC
How the Domain Name System actually resolves names: the roles of stub, recursive and authoritative servers, referrals and glue, the wire format with a…
Read article →eBPF and XDP
Deep-dive on eBPF and XDP: sandboxed verified kernel programs, the verifier and JIT, XDP earliest-hook packet processing, maps for kernel-user state, …
Read article →ECMP routing architecture
Deep-dive on ECMP: how routers spread flows across equal-cost paths with a stateless header hash, next-hop groups and resilient hashing, flowlet switc…
Read article →What Is ECN in Networking? Explicit Congestion Notification
ECN: routers mark packets Congestion Experienced instead of dropping them, the receiver echoes ECE, the sender slows and sets CWR. Plus DCTCP and L4S.
Read article →gRPC Architecture in Depth
How gRPC works: the HTTP/2 foundation, length-prefixed framing and trailing status, the four call types, protobuf evolution rules, deadline propagatio…
Read article →Happy Eyeballs (RFC 8305): Racing IPv6 and IPv4 Connections
Happy Eyeballs: RFC 8305 races IPv6 and IPv4 so dual-stack clients never stall, with parallel AAAA and A lookups, address interleaving, a 250 ms stagg…
Read article →HTTP/2, in depth: negotiation, one connection many streams, flow-control windows, coalescing, priorities, proxies and the attacks that shaped server limits
HTTP/2 as an operator meets it: ALPN and prior-knowledge negotiation, a request traced frame by frame, why the 65,535-byte default windows cap through…
Read article →HTTP/3 and QUIC Architecture in Depth: streams over UDP, the handshake, QPACK, migration and deployment
How HTTP/3 and QUIC work and how to deploy them: why TCP head-of-line blocking motivated a new transport, QUIC packets, frames and packet number space…
Read article →HTTP/3 and QUIC, in depth: how HTTP maps onto QUIC streams, the control stream and SETTINGS, frames and varints, cancellation, GOAWAY, error codes and reading the bytes
The HTTP/3 layer on the wire, per RFC 9114: which QUIC streams HTTP/3 opens and why, the control stream and SETTINGS, the frame format and variable-le…
Read article →IPv6 architecture, in depth: addressing plans, Neighbor Discovery, SLAAC vs DHCPv6, dual stack and IPv6-only with NAT64
How IPv6 works and how to deploy it: header and MTU rules, address scopes, planning a /48, Neighbor Discovery, SLAAC versus DHCPv6 and the RA flags, s…
Read article →Multipath TCP architecture
Deep-dive on Multipath TCP: MP_CAPABLE/MP_JOIN subflow establishment, dual sequence numbers (subflow SEQ and connection-level DSN), the path manager a…
Read article →NAT, in depth: SNAT, DNAT and port translation from first principles, mapping behaviour, port exhaustion arithmetic and production failure modes
A practical guide to network address translation: what SNAT, DNAT and NAPT rewrite and why, a packet-level worked example, RFC 4787 mapping and filter…
Read article →NAT Traversal Explained: STUN, TURN, ICE and Hole Punching
How NAT traversal connects peers for WebRTC, VoIP, gaming and P2P: STUN address discovery, UDP hole punching, cone vs symmetric NAT, TURN relays and I…
Read article →How NTP Clock Synchronization Works: Stratum, Offset, Slewing
NTP explained: the stratum hierarchy, offset and round-trip delay estimates, slewing vs jumping the clock, leap-second smearing, PTP, TrueTime and NTS…
Read article →Path MTU Discovery (PMTUD): ICMP Blackholes and MSS Clamping
How Path MTU Discovery finds the largest packet a path accepts using DF and ICMP, why filtered ICMP causes PMTUD blackholes, and MSS clamping and PLPM…
Read article →QUIC Architecture, in depth: packets, the TLS 1.3 handshake, streams, loss recovery, connection migration and operations
How QUIC works from the datagram up: why it runs over UDP, packet number spaces and frames, the TLS 1.3 handshake and 0-RTT replay, streams and flow c…
Read article →What Is RDMA? Verbs, Queue Pairs, Kernel Bypass and RoCEv2
RDMA (remote direct memory access) explained: the verbs API, queue pairs, memory registration, kernel bypass, one-sided reads/writes, lossless RoCEv2 …
Read article →SRv6 architecture
Deep-dive on SRv6: the Segment Routing Header and segments-left, SID structure as locator:function, endpoint behaviors (End, End.X, End.DT4/6), flex-a…
Read article →TLS/SSL architecture, in depth: the record layer, the TLS 1.3 handshake, key schedule, certificates and operations
How TLS works from first principles: what it protects and what it leaves visible, the record layer and AEAD nonces, the TLS 1.3 one-round-trip handsha…
Read article →TCP Architecture, in depth: inside the Linux TCP stack, from accept queues and buffers to loss recovery and TIME_WAIT
How TCP is implemented and operated in the Linux kernel: listen and accept queues, SYN cookies, the send and receive paths, buffer autotuning and the …
Read article →TCP Fast Open architecture
Deep-dive on TCP Fast Open: how a per-destination cryptographic cookie lets a client carry request data in the SYN for a zero-RTT open, how cookies ar…
Read article →TCP/IP Protocol Stack: Layers, Handshake, Flow Control
The TCP/IP stack layer by layer: the four-layer model vs OSI, encapsulation, IP addressing, TCP 3-way handshake, retransmission, flow and congestion c…
Read article →TLS, in depth: where to terminate it, how certificates are issued and rotated, configuring clients that verify, and debugging failed handshakes
Deploying TLS correctly: edge, re-encrypt and passthrough termination, SNI and ALPN routing, certificate anatomy, ACME automation and the CA/Browser F…
Read article →UDP, in depth: the 8-byte header, socket semantics, the Linux receive path, batching and offload, NAT timers and amplification
UDP from first principles to production: header and checksum rules, what a UDP socket does and does not promise, safe datagram sizes, where Linux drop…
Read article →VXLAN Explained: VNI, VTEP, EVPN and Overlay Network Design
How VXLAN overlays work: encapsulation and the 24-bit VNI, the VTEP data path, EVPN Type-2/3 routes, ARP suppression, BUM traffic, MTU and leaf-spine …
Read article →WireGuard architecture
Deep-dive on WireGuard: static-key identity and cryptokey routing, the 1-RTT Noise IK handshake, ChaCha20-Poly1305 transport with anti-replay, the tim…
Read article →Service Mesh Traffic Management, in depth: routing, weighted canaries, timeouts and retry budgets, circuit breaking, outlier detection, locality failover and mirroring in Istio and the Gateway API
How a service mesh routes and protects calls: the caller-side proxy's decision sequence, Istio VirtualService and DestinationRule with a worked c…
Read article →TCP vs UDP, in depth: what each transport really gives you, what you must rebuild on UDP, and how to choose per workload
A practical guide to choosing between TCP, UDP and QUIC: the guarantees and costs of each, head-of-line blocking with numbers, the features you must r…
Read article →TLS 1.3 Internals, in depth: record bytes, nonces, the key schedule checked against RFC 8448, HelloRetryRequest, downgrade sentinels, binders, KeyUpdate and exporters
A byte-level, verify-it-yourself tour of TLS 1.3 for engineers who debug or implement it: record framing and inner plaintext, nonce construction and A…
Read article →TLS Handshake Optimization, in depth: counting round trips, smaller first flights, resumption and ticket keys, 0-RTT safely, revocation and CPU cost
A practical guide to making TLS handshakes faster and rarer: where the round trips go in TLS 1.2, TLS 1.3 and QUIC, how to measure handshake time, avo…
Read article →Understanding MTU and Fragmentation, in depth: header arithmetic, IPv4 and IPv6 fragmentation, MSS clamping and overlay budgets
MTU and IP fragmentation from first principles: what the MTU counts, header arithmetic for IPv4, IPv6 and TCP, how IPv4 fragments and reassembles, why…
Read article →Understanding TCP Window Scaling, in depth: the 64 KB ceiling, SYN-time negotiation, bandwidth-delay product math and debugging slow long-distance transfers
How the TCP window scale option works and why it decides throughput on long, fast paths: the 16-bit window limit, negotiation in the SYN and SYN-ACK, …
Read article →