Learn 242 articles

Cloudflare WAF Regex Outage 2019: Catastrophic Backtracking

Incidents & Outages NEW

July 2, 2019: a WAF rule with catastrophic backtracking drove all Cloudflare edge CPUs to 100% for 27 minutes, causing global 502 errors. Timeline, root cause, and lessons.

How DNS Blocklists Work: DNSBL, Spamhaus Zones, and RPZ

Security NEW

DNSBL reverse-IP query mechanics, Spamhaus SBL/XBL/PBL/ZEN zones, domain blocklists, Postfix postscreen integration, RPZ, Quad9, and false-positive risks with CGNAT.

How Port Scanning Works: SYN, FIN, UDP, and OS Detection

Security NEW

TCP connect vs SYN scans, FIN/NULL/Xmas stealth scans, UDP scanning, banner grabbing, OS fingerprinting, nmap usage, Zmap/Masscan, and hardening against scanners.

What Is DNS Cache Poisoning? Kaminsky Attack Explained

Security NEW

How DNS cache poisoning works, the 2008 Kaminsky attack exploiting 16-bit query IDs, and mitigations: source-port randomization, DNSSEC, DNS Cookies, and SAD DNS.

What is BGP? The Internet's Routing Protocol Explained

BGP & Routing

How the internet's routing protocol connects autonomous systems

Learn how the Border Gateway Protocol (BGP) routes traffic across the internet, connecting thousands of networks into a single global system.

What is an Autonomous System (AS)?

Understand what autonomous systems are, how AS numbers work, and why they are fundamental to how the internet routes traffic between networks.

What is a BGP Looking Glass?

Learn what a BGP looking glass is, how it works, and how network engineers use it to troubleshoot routing issues and verify BGP announcements.

How to Look Up an IP Address's BGP Route

Step-by-step guide to looking up the BGP route for any IP address, understanding the results, and what origin AS, AS paths, and prefixes mean.

Understanding BGP AS Paths

Learn how to read BGP AS paths, understand path selection, AS path prepending, and what the sequence of AS numbers in a route means.

What is RPKI? Securing BGP Routing

Learn how RPKI (Resource Public Key Infrastructure) secures internet routing by allowing networks to verify the legitimacy of BGP route announcements.

What is an Internet Exchange Point (IXP)?

Learn what Internet Exchange Points are, how they work, and why they are critical infrastructure for reducing latency and interconnection costs.

What is Peering? How Networks Interconnect

Understand BGP peering and transit — how networks interconnect, the difference between settlement-free peering and paid transit, and how this shapes internet routing.

Learn how BGP hijacking works, how attackers reroute internet traffic by announcing false routes, and how RPKI and monitoring help defend against it.

What is a BGP Hijack?

How BGP Communities Work: Tagging and Controlling Routes

Learn how BGP communities tag routes with metadata — standard, extended, and large communities, well-known values, blackholing, and traffic engineering.

How BGP Route Leaks Happen and How They're Prevented

Understand BGP route leaks — how misconfigurations propagate routes beyond their intended scope, real-world incidents, and defenses like RPKI and IRR filtering.

The Economics of Internet Peering

How settlement-free peering, paid transit, and IXPs shape the internet's business layer — from Tier 1 networks to cloud provider open peering and CDN edge caches.

BGP Hijacking Techniques and Defenses

Deep dive into BGP hijacking — prefix hijacking, sub-prefix attacks, AS path manipulation, interception attacks, and defenses with RPKI, ASPA, and IRR filtering.

How BGP Confederations Work: Scaling iBGP with Sub-AS Partitioning

How BGP confederations solve the iBGP full-mesh scalability problem by partitioning an AS into sub-ASes using CONFED_SEQUENCE, CONFED_SET, and modified eBGP procedures.

How BGP FlowSpec Works: Distributed DDoS Mitigation via BGP

How BGP FlowSpec (RFC 8955) distributes traffic filtering and rate-limiting rules across routers via BGP for real-time DDoS mitigation without manual ACL configuration.

How BGP Graceful Restart Works: Preserving Forwarding Across Restarts

How BGP Graceful Restart (RFC 4724) preserves forwarding state during BGP process restarts, preventing route withdrawals and traffic disruption during software upgrades.

How BMP Works: Real-Time BGP Route Monitoring Without CLI Scraping

How BGP Monitoring Protocol (RFC 7854) streams Adj-RIB-In, peer state changes, and statistics from routers to collectors over TCP without establishing BGP sessions.

How ECMP Works: Equal-Cost Multi-Path Routing and Flow Hashing

How ECMP installs multiple equal-cost next-hops and distributes traffic using per-flow hash algorithms across parallel links in data center fabrics and backbone networks.

How IS-IS Works: The Link-State IGP Behind ISP Backbones

How IS-IS runs directly on Layer 2 to route IP traffic within autonomous systems, covering LSPs, TLV extensibility, area hierarchy, and why ISPs prefer it over OSPF.

How OSPF Works: Link-State Routing and Dijkstra's Algorithm

Comprehensive guide to OSPF covering link-state advertisements, the LSDB, Dijkstra's SPF algorithm, area design, LSA types, stub areas, and OSPFv3 for IPv6.

How BGP Route Reflectors Work: Scaling iBGP Without Full Mesh

Deep dive into BGP route reflectors covering the iBGP full mesh problem, cluster design, ORIGINATOR_ID and CLUSTER_LIST loop prevention, and hierarchical RR topologies.

How Segment Routing Works: SR-MPLS and SRv6 Source Routing

Technical guide to Segment Routing covering node and adjacency SIDs, SR-MPLS and SRv6 data planes, IGP extensions, traffic engineering, and network slicing without RSVP-TE.

How MPLS Traffic Engineering Works: CSPF, RSVP-TE, and Fast Reroute

Comprehensive guide to MPLS-TE covering constraint-based path computation, RSVP-TE signaling, bandwidth reservation, link coloring, FRR protection, and IGP-TE extensions.

How BGP Best-Path Selection Works NEW

A deep dive into the BGP decision algorithm: weight, local-pref, AS path length, MED, eBGP vs iBGP, IGP metric, and why operators manipulate each step for traffic engineering.

How Route Collectors Work NEW

How RIPE RIS, RouteViews, and MRT archives capture global BGP data, how the RIS Live streaming API works, and how monitoring tools and looking glasses consume collector feeds.

What Is an Internet Routing Registry (IRR)? NEW

IRR, RPSL route and as-set objects, RADb vs RIPE DB, generating prefix filters with bgpq4, IRR's trust limitations versus RPKI, and how IXP route servers use IRR data.

What Is AS Path Prepending? BGP Inbound Traffic Engineering NEW

AS path prepending repeats your ASN in BGP announcements to make a link less attractive. Learn how it works, its limits, and better alternatives.

How BGP Multihoming Works: Redundancy and Load Sharing NEW

Multihoming connects your network to two or more ISPs for resilience. Learn about PI space, ASNs, session setup, failover, ROAs, and avoiding accidental transit.

What Is Route Aggregation? Supernetting and CIDR Explained NEW

Route aggregation combines multiple prefixes into a supernet, keeping the global BGP table manageable. Learn CIDR, ATOMIC_AGGREGATE, max-prefix limits, and why deaggregation persists.

What Is the Default-Free Zone (DFZ)? The Full BGP Routing Table NEW

The DFZ is the set of routers carrying the full internet routing table with no default route. Learn who operates in the DFZ, table size history, the 512K day, and full-table vs default strategies.

How Route Servers Work at Internet Exchange Points NEW

IXP route servers enable multilateral peering with a single BGP session. Learn how they preserve AS paths, use per-peer RIBs, enforce IRR and RPKI filters, and scale to thousands of members.

What Is Bogon Filtering? Martians, BCP38, and uRPF NEW

Bogon and martian IP address filtering explained: RFC 1918, full-bogon lists, Team Cymru feeds, uRPF strict/loose mode, BCP38/RFC 2827 ingress filtering, and why IP spoofing persists in 2026.

What is DNS? The Internet's Phone Book

Networking

Protocols and fundamentals that make the internet work

Learn how the Domain Name System translates human-readable domain names into IP addresses, enabling you to browse the web without memorizing numbers.

Understand what IP addresses are, how they identify devices on the internet, and the difference between public and private addresses.

What is an IP Address?

IPv4 vs IPv6: What's the Difference?

Compare IPv4 and IPv6 — address formats, capacity, adoption status, and why the transition to IPv6 matters for the future of the internet.

What is a Network Prefix (CIDR)?

Learn what IP prefixes are, how CIDR notation works, and why prefix length matters for BGP routing and IP address allocation.

How Does Traceroute Work?

Learn how traceroute maps the network path between your computer and a destination, using TTL values to discover each router hop along the way.

2026-04-23 · 2 min read

What is a CDN? Content Delivery Networks Explained

Learn how Content Delivery Networks use globally distributed servers and BGP anycast to deliver web content with low latency from locations near you.

What is DNS over HTTPS (DoH)?

Learn how DNS over HTTPS encrypts your DNS queries to protect privacy, how it works, and what it means for internet security.

What are TLDs? Top-Level Domains Explained

Learn what top-level domains (TLDs) are, how the DNS hierarchy works, and the role of root servers in resolving every domain on the internet.

What is Anycast? One IP, Many Servers

Learn how anycast routing lets multiple servers share a single IP address, enabling low-latency and resilient services like DNS and CDNs.

What is a Subnet? IP Subnetting Explained

Learn how IP subnetting divides networks into smaller segments, how CIDR notation works, and why subnetting matters for routing and security.

How NAT Works: Network Address Translation Explained

Learn how Network Address Translation maps private IP addresses to public ones — covering SNAT, DNAT, PAT, connection tracking, NAT traversal, and Carrier-Grade NAT.

How QUIC and HTTP/3 Work: The End of TCP for the Web

Learn how QUIC eliminates TCP head-of-line blocking with UDP-based multiplexed streams, 0-RTT handshakes, built-in TLS 1.3, and connection migration — and how HTTP/3 builds on top.

How DHCP Works: Dynamic Host Configuration Protocol Explained

Learn how DHCP automatically assigns IP addresses — the DORA handshake, lease management, relay agents, DHCPv6, and how devices get their network configuration.

How ARP Works: Address Resolution Protocol Explained

Learn how ARP maps IP addresses to MAC addresses on local networks — request/reply flow, ARP cache, proxy ARP, ARP spoofing attacks, and how IPv6 NDP replaces it.

How Ethernet Works: From Frames to Switches

Learn how Ethernet connects devices at Layer 2 — MAC addressing, frame format, VLANs (802.1Q), Spanning Tree, L2 switching, and the evolution to 400G Ethernet.

How TCP Works: Connections, Flow Control, and Congestion

Deep dive into TCP — the three-way handshake, sequence numbers, sliding windows, congestion control algorithms (Reno, CUBIC, BBR), fast retransmit, SACK, and connection lifecycle.

How Load Balancers Work: L4 vs L7 Load Balancing

Learn how load balancers distribute traffic — L4 vs L7, algorithms like consistent hashing, Direct Server Return, health checks, and tools like HAProxy and Envoy.

How MPLS Works: Multiprotocol Label Switching Explained

Learn how MPLS uses labels for fast packet forwarding — label format, LSPs, LDP signaling, VPNs, traffic engineering, and how it compares to segment routing.

How DNSSEC Works: Securing the Domain Name System

Learn how DNSSEC uses cryptographic signatures to protect DNS from spoofing — covering the chain of trust, RRSIG records, key management, and NSEC3.

Learn HTTP/2 internals — binary framing, multiplexed streams, HPACK header compression, server push, flow control, and why TCP HOL blocking led to HTTP/3.

How HTTP/2 Works

How Email Works: SMTP, IMAP, and the Mail System

Understand how email works — SMTP protocol, MX records, IMAP vs POP3, SPF/DKIM/DMARC authentication, STARTTLS, and email deliverability.

What is CGNAT? Carrier-Grade NAT Explained

CGNAT deep dive — RFC 6598, 100.64.0.0/10 shared address space, port exhaustion, deterministic NAT, logging, impact on gaming and P2P, and IPv6 transition.

IPv6 Transition Technologies: NAT64, DS-Lite, MAP-E, and Beyond

The full spectrum of IPv6 transition mechanisms — NAT64/DNS64, 464XLAT, DS-Lite, MAP-E, MAP-T, 6rd, happy eyeballs, and the current state of deployment.

How NAT64 Works: Translating IPv6 to IPv4 at Scale

Deep dive into NAT64 and DNS64 — stateful translation, synthetic AAAA records, well-known prefix 64:ff9b::/96, ALG issues, DNSSEC interaction, carrier deployments, and performance characteristics.

How 464XLAT Works: IPv4 over IPv6-Only Networks

How 464XLAT enables IPv4 connectivity on IPv6-only networks — CLAT and PLAT translation, Android clatd, iOS CLAT, mobile carrier deployments, and debugging double translation.

Testing Apps on IPv6-Only Networks: A Practical Guide

How to test applications on IPv6-only networks — macOS NAT64 setup, Linux Jool, Docker IPv6, common breakage patterns, CI integration, and language-specific pitfalls.

How Happy Eyeballs Works: Fast Fallback for Dual-Stack Connections

RFC 8305 Happy Eyeballs algorithm — connection racing with 250ms pacing, address interleaving, browser and OS implementations, QUIC racing, and why it matters for IPv6 adoption.

How DS-Lite Works: Dual-Stack Lite for IPv6 Transition

How DS-Lite works — B4 and AFTR elements, IPv4-in-IPv6 softwire tunneling, centralized NAT44, port allocation, ISP deployments, AFTR scaling, and comparison with MAP-E and 464XLAT.

IPv6 App Development Guide: Making Applications IPv6-Ready

Practical guide to IPv6 application development — dual-stack sockets, getaddrinfo best practices, address storage, rate limiting by prefix, Kubernetes dual-stack, and testing strategies.

How BFD Works: Sub-Second Failure Detection for Network Protocols

How Bidirectional Forwarding Detection (BFD) provides sub-second failure detection for BGP, OSPF, and IS-IS by decoupling link monitoring from control-plane timers.

How Bluetooth Works: Classic, BLE, and Mesh Networking Explained

Technical breakdown of Bluetooth Classic, BLE, and Mesh covering frequency hopping, adaptive power control, GATT profiles, pairing, and cryptographic key management.

How Cilium and eBPF Networking Works: Replacing iptables in Kubernetes

How Cilium uses eBPF programs at XDP, TC, and socket layers to replace iptables and kube-proxy with O(1) lookups for Kubernetes networking, policy, and observability.

How DNS Load Balancing Works: From Round-Robin to Global Server Load Balancing

How DNS-based traffic steering distributes clients across servers and data centers using round-robin, weighted records, health checks, geolocation, and latency-based routing.

How DNS over QUIC (DoQ) Works: Encrypted DNS Without Head-of-Line Blocking

How DNS over QUIC (RFC 9250) combines encrypted DNS with QUIC's zero-RTT resumption, stream multiplexing, and connection migration for faster, private name resolution.

How DNS over TLS (DoT) Works: Encrypting DNS on Port 853

How DNS over TLS (RFC 7858) encrypts DNS queries between stub and recursive resolvers on port 853, preventing ISP surveillance and on-path DNS manipulation.

How DPDK Works: Kernel-Bypass Packet Processing at 100 Gbps

How DPDK bypasses the Linux kernel to process packets in userspace using poll-mode drivers, hugepages, and lockless ring buffers for 100+ Gbps network throughput.

How FTP and SFTP Work: File Transfer Protocols Compared

How FTP's dual-channel architecture works, why it breaks with NAT and firewalls, and how FTPS and SFTP solve its security and traversal problems with TLS and SSH.

How IMAP Works: Server-Side Email Access and Synchronization

How IMAP (RFC 9051) provides server-side email storage with mailbox management, flag synchronization, IDLE push notifications, and multi-device access unlike POP3.

How the Internet Backbone Works: Tier 1 Networks, Peering, and Transit

How Tier 1 backbone networks interconnect via settlement-free peering, how transit economics shape internet topology, and how traffic flows across the global backbone.

How Kubernetes Networking Works: Pods, Services, CNI, and Ingress

How Kubernetes implements flat pod networking, ClusterIP service load balancing, CNI plugins, NetworkPolicy enforcement, and Ingress routing from packets to API abstractions.

How LACP Works: Link Aggregation for Bandwidth and Redundancy

How LACP (IEEE 802.1AX) negotiates link aggregation groups using LACPDUs, distributes traffic via hashing algorithms, and handles member link failures without disruption.

How LoRaWAN Works: Long-Range IoT Networking with Chirp Spread Spectrum

How LoRaWAN achieves 15 km range on battery-powered IoT sensors using chirp spread spectrum modulation, adaptive data rates, and Class A/B/C device profiles.

How LTE/4G Works: OFDMA, MIMO, and the Evolved Packet Core

How LTE delivers high-speed mobile data using OFDMA downlink, SC-FDMA uplink, MIMO antenna techniques, and the all-IP Evolved Packet Core architecture.

How IP Multicast Works: IGMP, PIM, and Multicast Distribution Trees

How IP multicast delivers one-to-many traffic using IGMP group membership, PIM sparse/dense mode distribution trees, and RPF checks across IPv4 and IPv6 networks.

How NAT Traversal Works: STUN, TURN, and ICE Explained

Deep dive into NAT traversal techniques including STUN, TURN, and ICE that enable peer-to-peer communication across NATs for WebRTC, VoIP, and gaming.

How NetFlow and sFlow Work: Flow-Based Traffic Analysis

Technical guide to NetFlow v5/v9, IPFIX, and sFlow flow monitoring protocols covering flow export, sampling, collectors, and real-world traffic analysis use cases.

How Network Monitoring Works: From Ping to Modern Observability

Full-stack guide to network monitoring covering ICMP reachability, SNMP polling, NetFlow traffic analysis, time-series metrics, alerting pipelines, and observability at scale.

How Linux Network Namespaces Work: Container Networking Internals

Deep dive into Linux network namespaces covering kernel-level isolation of interfaces, routing tables, iptables rules, veth pairs, and how Docker and Kubernetes use them.

How NTP Works: Network Time Protocol and Clock Synchronization

Technical explanation of NTP covering the stratum hierarchy, clock discipline algorithms, intersection and clustering, NTPv4 improvements, and NTP security considerations.

How Power over Ethernet (PoE) Works: 802.3af/at/bt Explained

Technical guide to Power over Ethernet covering PSE/PD negotiation, 802.3af through 802.3bt standards, power delivery modes, classification, and switch power budgeting.

How PROXY Protocol Works: Preserving Client IPs Through L4 Proxies

Technical guide to PROXY protocol v1 and v2 covering how client IP addresses are preserved through Layer 4 load balancers, HAProxy's design, and TLV extensions.

How Reverse Proxies Work: TLS Termination, Routing, and Connection Pooling

Technical guide to reverse proxy architecture covering forward vs reverse proxies, TLS termination, request routing, connection pooling, caching, and load balancing at Layer 7.

How SCTP Works: Multi-Streaming and Multi-Homing Transport Protocol

Deep dive into SCTP covering multi-streaming, multi-homing, the four-way handshake, chunk-based framing, and why SCTP is mandatory for 4G LTE and 5G signaling.

How SD-WAN Works: Software-Defined Wide Area Networking

Comprehensive guide to SD-WAN covering overlay tunnels, centralized controllers, application-aware path selection, local internet breakout, and comparison with MPLS WANs.

How Service Meshes Work: Istio, Linkerd, and Envoy Sidecars

Deep dive into service mesh architecture covering sidecar proxy injection, data plane vs control plane, mTLS, traffic routing, observability, and Istio vs Linkerd tradeoffs.

How SIP and VoIP Work: Telephony Signaling Over IP Networks

Technical guide to SIP, SDP, and RTP covering call setup and teardown, codec negotiation, NAT traversal for VoIP, SIP trunking, and VoLTE on LTE/5G networks.

How SNMP Works: Network Monitoring with MIBs, OIDs, and Traps

Deep dive into SNMP covering the MIB hierarchy, OID tree, GET/SET/TRAP operations, SNMPv2c vs SNMPv3 security, and practical monitoring with community strings and USM.

How Spanning Tree Protocol Works: Preventing Layer 2 Loops

Deep dive into STP, RSTP, and MSTP covering root bridge election, port roles and states, BPDU processing, rapid convergence, and why Layer 2 loops are catastrophic.

How TCP Congestion Control Works: From Reno to BBR

Technical guide to TCP congestion control covering slow start, congestion avoidance, cwnd and ssthresh, loss-based algorithms (Reno, CUBIC), and delay-based BBR.

How VPC Networking Works: Subnets, Route Tables, and Gateways in the Cloud

Technical guide to Virtual Private Cloud networking covering CIDR allocation, subnets, implicit routers, internet and NAT gateways, VPC peering, and cloud security groups.

How VXLAN Works: Virtual Extensible LAN Overlay Networking

Deep dive into VXLAN covering UDP encapsulation, 24-bit VNI addressing, VTEP operation, BUM traffic handling, and EVPN-VXLAN as the modern data center fabric control plane.

How Zigbee, Thread, and Matter Work: IoT Mesh Networking Protocols

Technical guide to Zigbee, Thread, and Matter covering IEEE 802.15.4 radio, mesh routing, IPv6 networking, border routers, and how Matter unifies smart home interoperability.

UDP's 8-byte header, connectionless semantics, when UDP beats TCP, DNS/QUIC/NTP on UDP, NAT binding timeouts, amplification attacks, and QUIC rebuilding reliability on top of UDP.

How UDP Works NEW

ICMP message types and codes, how ping and traceroute use ICMP, ICMPv6's expanded role in NDP and PMTUD, why blocking all ICMP breaks connectivity, and ICMP tunneling.

How ICMP Works NEW

What Is MTU? Path MTU Discovery Explained NEW

MTU vs MSS, Ethernet's 1500-byte default, IPv4 fragmentation and the DF bit, why IPv6 never fragments in-network, PMTUD failure and ICMP black holes, and tunnel overhead.

How WHOIS and RDAP Work: Domain and IP Lookup Explained NEW

Learn how WHOIS (RFC 3912) and its JSON successor RDAP work, including referral chains, thick vs thin registries, GDPR redaction, and the IANA bootstrap registry.

How Reverse DNS Works: PTR Records and in-addr.arpa NEW

Understand PTR records, in-addr.arpa nibble format, reverse zone delegation by RIRs and ISPs, classless delegation (RFC 2317), and why FCrDNS matters for email.

2026-06-12 · 6 min read

RIB vs FIB: Routing Table vs Forwarding Table NEW

The difference between the Routing Information Base and Forwarding Information Base: control plane vs data plane, administrative distance, TCAM, recursive next-hop resolution, and the 512K routing table event.

2026-06-12 · 12 min read

How DNS Root Servers Work: The 13 Identities Explained NEW

How the 13 DNS root server identities work: why there are 13, anycast scale with 1900+ instances, root zone management by IANA and Verisign, DNSSEC KSK ceremonies, priming queries, and DDoS resilience.

2026-06-12 · 12 min read

How IPv6 SLAAC Works: Autoconfiguration Explained NEW

IPv6 Stateless Address Autoconfiguration: Router Solicitation and Advertisement, EUI-64 address formation with U/L bit flip, RFC 7217 stable-privacy and RFC 8981 temporary addresses, DAD, RDNSS, M/O flags, and Android's DHCPv6 refusal.

What Is TTL? IP Hop Limit and DNS Cache TTL Explained NEW

TTL means two different things: the IP hop-limit field that enables traceroute and GTSM BGP security (RFC 5082), and the DNS cache duration that controls record propagation. Both concepts explained with OS defaults and practical strategy.

How VRRP Works: First-Hop Redundancy Explained NEW

VRRP creates a virtual IP and virtual MAC shared by multiple routers. Learn master election, failover timers, VRRPv3, load sharing with multiple VRIDs, and split-brain causes.

How GRE Tunnels Work: Encapsulation, MTU, and Uses NEW

GRE (IP protocol 47) encapsulates any routable protocol inside IP with 24-byte overhead. Covers packet format, MTU/MSS clamping, multicast tunneling, DDoS scrubbing, and comparison with VXLAN and WireGuard.

What Is a MAC Address? Format, Bits, and How Switches Use It NEW

MAC addresses are 48-bit Layer 2 identifiers. Learn the OUI vendor prefix, I/G and U/L bits, multicast mappings, CAM table learning, MAC flooding attacks, EUI-64, and privacy randomization.

How API Gateways Work: Routing, Auth, Rate Limiting, and Protocol Translation

Web & APIs

HTTP, browsers, and the APIs that power the web

Technical deep dive into API gateway architecture covering request routing, authentication, rate limiting, circuit breaking, and protocol translation with Kong and Envoy.

How GraphQL Works: Schema, Queries, Resolvers, and Execution

How GraphQL's type system, query language, and resolver execution model let clients request exactly the data they need, solving REST's over-fetching and N+1 problems.

How HTTP Caching Works: Cache-Control, ETags, and CDN Edge Caching

How HTTP caching works across browsers, proxies, and CDNs using Cache-Control directives, ETags, conditional requests, and stale-while-revalidate patterns per RFC 9111.

How HTTP Cookies Work: Set-Cookie, Security Attributes, and SameSite

How cookies maintain state in HTTP using Set-Cookie headers, domain scoping, path restrictions, HttpOnly, Secure, SameSite attributes, and cookie prefixes per RFC 6265bis.

How Server-Sent Events (SSE) Work: HTTP Streaming for Real-Time Updates

Technical guide to Server-Sent Events covering the text/event-stream format, EventSource API, automatic reconnection, event IDs, and comparison with WebSockets.

How DOCSIS Works: Cable Internet Technology Explained

Infrastructure

Physical and virtual systems that carry internet traffic

Learn how DOCSIS technology delivers internet over cable TV infrastructure, from frequency division and channel bonding to OFDM and the path toward multi-gigabit speeds.

2026-04-23 · 12 min read

How DSL Works: Internet Over Telephone Lines

Learn how DSL delivers internet over copper phone lines, from frequency division and DMT modulation to VDSL2 vectoring and G.fast — and why line length is everything.

2026-04-23 · 10 min read

How Submarine Cables Work: The Physical Internet

Learn how undersea fiber optic cables carry 99% of intercontinental internet traffic — cable construction, DWDM technology, landing stations, and how cable cuts affect BGP routing.

Understand rate limiting algorithms — token bucket, leaky bucket, sliding windows, distributed rate limiting with Redis, and rate limiting at every network layer.

How Rate Limiting Works

How Fiber to the Home (FTTH) Works

Learn how FTTH works — PON architectures (GPON, XGS-PON), OLT/ONT infrastructure, wavelength multiplexing, deployment economics, and the future of 25G/50G-PON.

How WiFi Works: 802.11 from Radio to Router

Deep dive into WiFi — radio fundamentals, 802.11 standards evolution, CSMA/CA, WPA3, OFDMA, MU-MIMO, WiFi 7, mesh networking, and enterprise 802.1X.

How eBPF Works: Programmable Networking in the Linux Kernel

Understand eBPF — XDP, the verifier, JIT compilation, BPF maps, CO-RE, Cilium, Cloudflare DDoS mitigation, observability with bpftrace, and security with Tetragon.

How DOCSIS 4.0 Works: The Future of Cable Internet

Learn DOCSIS 4.0 — FDX full-duplex and ESD extended spectrum, how they fix cable upload speeds, Low Latency DOCSIS, and comparison to fiber.

How Container Networking Works: Docker, Kubernetes, and CNI

Understand container networking — Linux namespaces, veth pairs, Docker bridge, Kubernetes CNI plugins, Calico BGP, kube-proxy modes, and NetworkPolicy.

How HAProxy Works: High-Performance Load Balancing

Deep dive into HAProxy — L4/L7 load balancing, stick tables, ACLs, health checks, connection handling, and how it fits into modern infrastructure.

How Nginx Works: Architecture and Internals

Nginx internals — event-driven architecture, master/worker processes, reverse proxy, upstream load balancing, caching, TLS termination, and request processing phases.

How Envoy Proxy Works: The Service Mesh Data Plane

Envoy Proxy internals — xDS API, listeners, filter chains, clusters, circuit breaking, outlier detection, observability, and Wasm extensions.

How xDS Works: The Service Mesh Control Plane Protocol

xDS protocol deep dive — EDS, CDS, RDS, LDS, SDS, ADS, incremental xDS, control plane implementations, and the parallels between xDS and BGP.

How 5G Works: NR, mmWave, and Network Slicing

5G internals — New Radio, mmWave vs sub-6 GHz, massive MIMO, beamforming, network slicing, SA vs NSA architecture, 5G Core, and real-world performance.

How Starlink Works: LEO Satellite Internet

Starlink architecture — LEO constellation, laser inter-satellite links, ground stations, user terminals, latency, BGP peering (AS14593), and routing design.

How IP Geolocation Works — and Why It Gets It Wrong NEW

How MaxMind and other providers build IP geolocation databases from RIR data, latency triangulation, and geofeeds (RFC 8805) — and why VPNs, CGNAT, and anycast break them.

What Is Network Latency? Propagation, Queuing, and RTT NEW

Network latency is the time delay in data delivery — propagation, serialization, queuing, and processing. Covers RTT examples, bandwidth-delay product, bufferbloat, AQM, CDNs, and hollow-core fiber.

How Data Center Networks Work: Leaf-Spine, BGP, and VXLAN NEW

Modern data centers use Clos leaf-spine fabrics with eBGP per RFC 7938, ECMP, VXLAN-EVPN overlays, and ToR switching. Covers the shift from three-tier to spine-leaf, oversubscription, and GPU fabrics.

How TLS/HTTPS Works: Securing the Internet's Traffic

Security

Attacks, defenses, and securing internet traffic

A deep dive into how TLS and HTTPS encrypt internet traffic, covering the handshake, certificate chains, public key cryptography, and modern TLS 1.3.

2026-04-23 · 12 min read

Certificate Transparency: How CT Logs Secure the Web's PKI

How Certificate Transparency works — append-only Merkle tree logs, SCTs, browser enforcement, and why CT exists after DigiNotar, Comodo, and Symantec CA failures.

How Firewalls Work: Packet Filtering, Stateful Inspection, and Beyond

Learn how firewalls protect networks — from basic packet filtering and iptables rules to stateful connection tracking, application-layer inspection, and cloud security groups.

What is Cross-Site Scripting (XSS)?

Understand XSS attacks — how attackers inject malicious scripts into web pages, the three types of XSS, and how to defend against them.

What is Cross-Site Request Forgery (CSRF)?

Learn how CSRF attacks trick browsers into making unintended authenticated requests, and how tokens, SameSite cookies, and origin checks prevent them.

What is Server-Side Request Forgery (SSRF)?

Learn how SSRF attacks trick servers into making requests to internal services and cloud metadata endpoints, and how to defend against them.

Understand SQL injection — how attackers exploit unsanitized input to read, modify, or delete databases, and how parameterized queries prevent it.

What is SQL Injection?

Learn how IP spoofing works at the packet level, why IPv4 makes it easy, how BCP38 ingress filtering and uRPF defend against it, and its role in DDoS attacks.

What is IP Spoofing?

Understand how DNS tunneling encodes data in DNS queries for exfiltration and C2, tools like iodine and dnscat2, and detection and defense strategies.

What is DNS Tunneling?

What is HTTP Request Smuggling?

Learn how HTTP request smuggling exploits Content-Length vs Transfer-Encoding disagreements between proxies to poison caches and hijack requests.

What are TLS Downgrade Attacks?

Learn how POODLE, BEAST, FREAK, and Logjam attacks exploit cipher negotiation, and how TLS 1.3 anti-downgrade mechanisms and HSTS defend against them.

What is an Open Redirect Vulnerability?

Understand open redirect vulnerabilities — how unvalidated redirects enable phishing, OAuth token theft, and SSRF bypasses, and how to defend against them.

What is a Man-in-the-Middle (MITM) Attack?

Learn how MITM attacks work — ARP spoofing, DNS poisoning, BGP hijacking, SSL stripping, and evil twin Wi-Fi — and how TLS, DNSSEC, and RPKI defend against them.

Domain Fronting, SNI Spoofing, and Encrypted Client Hello

How domain fronting hides traffic behind CDNs, why providers blocked it, and how Encrypted Client Hello (ECH) changes the game for privacy and censorship.

Understand DDoS attacks — volumetric floods, protocol attacks, application layer attacks, botnets like Mirai, and mitigation via scrubbing, anycast, and BGP blackholing.

How DDoS Attacks Work

Learn how DNS rebinding bypasses the same-origin policy by manipulating DNS TTLs to target internal services, routers, and cloud metadata endpoints.

What is DNS Rebinding?

What is CORS (Cross-Origin Resource Sharing)?

Understand CORS — same-origin policy, preflight requests, credentialed requests, common errors, CORS vs CSRF, Private Network Access, and security pitfalls.

Post-Quantum Cryptography and Its Impact on the Internet

How quantum computers threaten RSA, ECDSA, and DH — NIST PQC standards (Kyber, Dilithium), hybrid TLS, impact on JWTs, SSH, RPKI, and blockchain.

Understand the SSH protocol — key exchange, host verification, authentication methods, channel multiplexing, port forwarding, SSH certificates, and hardening.

How SSH Works

How mTLS Works: Mutual TLS and Zero Trust Networking

Learn mTLS — client certificate authentication, SPIFFE/SPIRE, service mesh auto-mTLS, zero trust architecture, and certificate rotation challenges.

How SSH Certificates Work

SSH certificates vs raw keys — CA setup, user and host certificates, principals, short-lived certs, Netflix BLESS, and production certificate infrastructure.

How Internet Censorship Circumvention Works: Protocols and Evasion Techniques

Technical analysis of censorship circumvention tools covering DPI evasion, pluggable transports, domain fronting, Tor bridges, and the detection/evasion arms race.

How Content Security Policy (CSP) Works: Preventing XSS and Script Injection

How CSP directives whitelist trusted content sources, block unauthorized scripts with nonces and hashes, and provide violation reporting for defense-in-depth against XSS.

How DKIM, SPF, and DMARC Work: Email Authentication Explained

How SPF declares authorized senders via DNS, DKIM signs messages with cryptographic headers, and DMARC ties them together with policy enforcement and reporting.

How IDS and IPS Work: Intrusion Detection and Prevention Systems Explained

How IDS/IPS systems detect attacks using signature matching, protocol analysis, and anomaly detection, covering Snort/Suricata rules, inline deployment, and evasion techniques.

How IPsec Works: Tunnel Mode, Transport Mode, IKEv2, ESP, and AH

How IPsec provides network-layer encryption using ESP and AH protocols, IKEv2 key negotiation, tunnel vs transport mode, NAT traversal, and security association management.

How Kerberos Works: Ticket-Based Authentication Without Sending Passwords

How Kerberos v5 authenticates users via TGTs and service tickets issued by the KDC, enabling single sign-on in Active Directory without transmitting passwords over the network.

How LDAP Works: Directory Services, DIT Structure, and Active Directory

How LDAP v3 (RFC 4511) organizes identity data in a hierarchical DIT, performs bind authentication, search queries, and replication across distributed directory services.

How MACsec Works: Layer 2 Ethernet Encryption with 802.1AE

How MACsec (IEEE 802.1AE) encrypts Ethernet frames hop-by-hop using GCM-AES, SecTAG headers, and MKA key agreement for wire-speed Layer 2 confidentiality and integrity.

How Network ACLs Work: Packet Filtering on Routers, Linux, and Cloud

Comprehensive guide to network access control lists covering standard and extended ACLs, stateful vs stateless filtering, rule ordering, and cloud NACL vs security group design.

2026-04-24 · 28 min read

How OCSP and CRL Work: Certificate Revocation Explained

Deep dive into certificate revocation mechanisms including CRL distribution points, OCSP responders, OCSP stapling, and why soft-fail semantics undermine revocation checking.

How OpenID Connect (OIDC) Works: Identity on Top of OAuth 2.0

Technical guide to OpenID Connect covering ID Tokens, JWT validation, authorization code flow, UserInfo endpoint, discovery metadata, and how OIDC replaced SAML for modern auth.

How RADIUS Works: Network Authentication, Authorization, and Accounting

Deep dive into the RADIUS protocol covering the AAA model, Access-Request/Accept/Reject flows, RADIUS attributes, EAP integration, and 802.1X network access control.

How SAML Works: Enterprise Single Sign-On and Federation

Technical guide to SAML 2.0 covering SP-initiated and IdP-initiated flows, SAML assertions, XML signature validation, attribute mapping, and comparison with OpenID Connect.

How SIEM Works: Security Information and Event Management

Comprehensive guide to SIEM systems covering log collection and normalization, correlation rules, threat intelligence integration, UEBA, SOAR automation, and deployment at scale.

How SOCKS Proxies Work: Protocol-Agnostic Network Proxying

Technical guide to SOCKS4 and SOCKS5 proxy protocols covering session-layer proxying, GSSAPI and username/password auth, UDP ASSOCIATE, and use with SSH and Tor.

How the TLS 1.3 Handshake Works: 1-RTT, 0-RTT, and Removed Features

Deep dive into TLS 1.3 covering the 1-RTT handshake, 0-RTT resumption, mandatory forward secrecy, AEAD-only ciphers, and every feature removed from TLS 1.2.

How Web Application Firewalls Work: Layer 7 HTTP Security

Comprehensive guide to WAFs covering signature-based and positive security models, SQL injection and XSS detection, ModSecurity CRS, cloud WAF architectures, and bypass techniques.

How X.509 Certificates Work: ASN.1, DER Encoding, and PKI Validation

Technical guide to X.509 certificates covering ASN.1 structure, DER and PEM encoding, certificate fields, extension processing, chain building, and path validation algorithms.

How Zero Trust Networking Works: Beyond the Perimeter Model

Deep dive into zero trust architecture covering BeyondCorp, NIST SP 800-207, policy engines, device posture checks, micro-segmentation, and ZTNA as a VPN replacement.

What Is BGP Blackholing? RTBH and DDoS Mitigation Explained NEW

How remotely-triggered black holes (RTBH) use BGP community 65535:666 (RFC 7999) to drop DDoS traffic, including source vs destination RTBH, IXP blackholing, and FlowSpec.

What Is DNS Cache Poisoning? Kaminsky Attack Explained NEW

How DNS cache poisoning works, the 2008 Kaminsky attack exploiting 16-bit query IDs, and mitigations: source-port randomization, DNSSEC, DNS Cookies, and SAD DNS.

How Port Scanning Works: SYN, FIN, UDP, and OS Detection NEW

TCP connect vs SYN scans, FIN/NULL/Xmas stealth scans, UDP scanning, banner grabbing, OS fingerprinting, nmap usage, Zmap/Masscan, and hardening against scanners.

How DNS Blocklists Work: DNSBL, Spamhaus Zones, and RPZ NEW

DNSBL reverse-IP query mechanics, Spamhaus SBL/XBL/PBL/ZEN zones, domain blocklists, Postfix postscreen integration, RPZ, Quad9, and false-positive risks with CGNAT.

How the Tor Network Works: Onion Routing and Internet Anonymity

Privacy & Anonymity

VPNs, Tor, and tools for private communication

Deep dive into how Tor provides anonymous internet access — onion routing, circuit construction, relay types, guard nodes, exit relays, bridges, and the relationship between Tor and BGP.

How Tor Onion Services Work: .onion Addresses and the Rendezvous Protocol

Learn how Tor onion services provide anonymous hosting — .onion address cryptography, the rendezvous protocol, HSDir DHT, v2 vs v3 addresses, and real-world deployments.

How VPNs Work: Tunneling Protocols and Encryption

Deep dive into VPN technology — WireGuard's Noise protocol, IPsec IKE/ESP, OpenVPN internals, split tunneling, and how encrypted tunnels route traffic across the internet.

How Tailscale Works: Building a Mesh VPN on WireGuard

Learn how Tailscale builds a zero-config mesh VPN on WireGuard — coordination servers, DERP relays, NAT traversal, MagicDNS, ACL policies, and how it differs from traditional VPNs.

How WireGuard Works: Modern VPN Protocol Explained

Deep dive into WireGuard — the Noise protocol handshake, Cryptokey Routing, ChaCha20-Poly1305 encryption, kernel-space performance, and why it's replacing IPsec and OpenVPN.

How OAuth 2.0 Works: Delegated Authorization Explained

Identity & Auth

Authentication, authorization, and credential management

Learn how OAuth 2.0 enables secure delegated authorization, how the authorization code flow works, what access and refresh tokens do, and how OpenID Connect adds authentication.

2026-04-23 · 14 min read

How JWT Works: JSON Web Tokens Explained

Learn how JSON Web Tokens encode claims as signed payloads for stateless authentication — covering JWT structure, signing algorithms, validation, common attacks, and best practices.

2026-04-23 · 7 min read

How JWKS and JWT Validation Work

Learn how identity providers publish keys via JWKS, how JWT signatures are validated, key rotation strategies, and security pitfalls like alg=none attacks.

Understand gRPC — HTTP/2 transport, Protocol Buffers, streaming RPCs, deadlines, interceptors, load balancing, and comparison to REST/JSON.

gRPC & Protobuf

High-performance RPC framework and binary serialization

How gRPC Works

How Protocol Buffers Work

Learn protobuf wire format — varints, tag-value encoding, schema evolution, proto2 vs proto3, and comparison to JSON, FlatBuffers, and Cap'n Proto.

Understand gRPC-Web — why browsers can't use native gRPC, the Envoy proxy gateway, Connect protocol, and comparison to REST and GraphQL for frontends.

How gRPC-Web Works

gRPC Load Balancing: Strategies and Patterns

Why L4 load balancing fails for gRPC, L7 proxying with Envoy, client-side balancing, xDS API, health checking, retry policies, and hedging.

gRPC and Service Mesh: Istio, Envoy, and Linkerd

How service meshes handle gRPC — sidecar proxies, mTLS, traffic splitting, circuit breaking, distributed tracing, ambient mesh, and eBPF approaches.

gRPC Security: Authentication, TLS, and Authorization

gRPC security patterns — channel vs call credentials, mTLS, JWT auth, Google ALTS, per-RPC authorization, interceptor-based auth, and common pitfalls.

gRPC Reflection, Testing, and Debugging

gRPC testing and debugging — server reflection, grpcurl, in-process testing, load testing with ghz, distributed tracing, channelz, and common error patterns.

gRPC vs REST: When to Use Which

Compare gRPC and REST — performance, type safety, browser support, tooling, versioning, and when each approach wins. Includes GraphQL as alternative.

gRPC Streaming: Patterns and Best Practices

Master gRPC streaming — server, client, and bidirectional streaming patterns, flow control, backpressure, error handling, and real-world patterns from Kubernetes and Spanner.

gRPC Error Handling and Status Codes

Understand gRPC's 17 status codes, rich error details, error propagation, retry policies, deadline propagation, circuit breaking, and streaming error handling.

gRPC Interceptors and Middleware Patterns

Learn gRPC interceptors — unary vs stream, server vs client, chaining, logging, metrics, auth, rate limiting, and implementation in Go, Java, Python, and Rust.

gRPC in Kubernetes: Deployment Patterns

Deploy gRPC in Kubernetes — why L4 fails, headless services, Envoy/Istio L7 balancing, health checking, graceful shutdown, ingress controllers, and keepalive tuning.

gRPC Performance Tuning and Optimization

Optimize gRPC — HTTP/2 settings, connection pooling, compression, keepalive, flow control, protobuf optimization, TCP tuning, and benchmarking methodology.

gRPC Observability: Metrics, Tracing, and Logging

Instrument gRPC with OpenTelemetry — Prometheus metrics, distributed tracing, channelz diagnostics, structured logging, dashboards, and tail-based sampling.

gRPC-Gateway and HTTP/JSON Transcoding

Expose gRPC as REST — google.api.http annotations, grpc-gateway, Envoy transcoding, request mapping, streaming limitations, and OpenAPI generation from proto files.

Protocol Buffers Schema Evolution and Versioning

Master protobuf schema evolution — wire compatibility rules, reserved fields, oneof pitfalls, Buf CLI, API versioning, well-known types, and migration from proto2 to proto3.

How Blockchain Domains Work: ENS, Unstoppable Domains, and Web3 Naming

Blockchain & Web3

Decentralized networks, consensus, and Web3 protocols

Learn how blockchain domains like .eth and .crypto work — ENS smart contracts, namehash algorithm, browser integration, IPFS content addressing, and how they compare to traditional DNS.

How IPFS Works: Content-Addressed Storage

Learn how IPFS uses content addressing, Merkle DAGs, and DHT-based peer discovery to create a decentralized alternative to HTTP for hosting and distributing content.

How ENS (Ethereum Name Service) Works

Understand the ENS architecture — registry, resolvers, .eth registration, text records, IPFS content hashes, CCIP-Read for L2, and ENS vs DNS.

How the Bitcoin Network Works

Deep dive into Bitcoin's P2P protocol — node discovery, compact block relay, transaction propagation, Erlay, Tor support, and eclipse attack defenses.

How Blockchain Consensus Mechanisms Work

Compare Proof of Work, Proof of Stake, BFT variants, and DPoS — covering finality, 51% attacks, nothing-at-stake, and the CAP theorem applied to blockchains.

How the Lightning Network Works

Understand Lightning payment channels, HTLCs, onion routing, channel capacity, watchtowers, splicing, Taproot channels, and comparison to L2 rollups.

How Cross-Chain Bridges Work

Learn how cross-chain bridges move assets between blockchains — lock-and-mint, light clients, optimistic verification, the $2B+ in bridge hacks, and IBC/CCIP.

How Zero-Knowledge Proofs Work

Understand ZKPs — SNARKs vs STARKs, Groth16 and PLONK, ZK-rollups, ZK-EVMs, recursive proofs, and folding schemes like Nova.

How Layer 2 Scaling Works

Compare L2 scaling solutions — optimistic rollups, ZK-rollups, state channels, Plasma, validiums, EIP-4844 blobs, and the rollup-centric roadmap.

How the Ethereum P2P Network Works

Deep dive into Ethereum networking — devp2p, RLPx, node discovery, GossipSub, EIP-4844 blob propagation, MEV/PBS, and client diversity.

Understand smart contracts — EVM architecture, Solidity, contract deployment, ABI encoding, ERC-20/721, security vulnerabilities, the DAO hack, and Solana programs.

How Smart Contracts Work

How Distributed Hash Tables (DHTs) Work

Learn how DHTs work — Kademlia XOR distance, k-buckets, iterative lookup, BitTorrent Mainline DHT, IPFS libp2p, Ethereum discv5, Sybil attacks, and NAT traversal.

Deep dive into the BitTorrent protocol — peer wire protocol, rarest-first piece selection, tit-for-tat choking, DHT, PEX, uTP, encryption, and BitTorrent v2.

Real-Time & P2P

WebSockets, WebRTC, and peer-to-peer protocols

How BitTorrent Works

Learn WebSockets — HTTP upgrade handshake, frame format, text vs binary, scaling with Redis pub/sub, compression, and comparison to SSE and WebTransport.

How WebSockets Work

Understand WebRTC — ICE framework, STUN/TURN, SDP offer/answer, DTLS encryption, SRTP, data channels, codec negotiation, and SFU vs MCU architectures.

How WebRTC Works

The Pakistan YouTube BGP Hijack (2008)

Incidents & Outages

Real-world failures that shaped internet resilience

How Pakistan Telecom accidentally took YouTube offline worldwide by announcing a more-specific BGP prefix — the incident that catalyzed RPKI adoption.

The Facebook DNS Outage (October 2021)

How a routine BGP maintenance change withdrew Facebook's DNS routes, making Facebook, Instagram, and WhatsApp unreachable for 6 hours worldwide.

The Cloudflare-Verizon BGP Leak (2019)

How a small ISP's BGP optimizer leak, amplified by Verizon's lack of route filtering, rerouted Cloudflare traffic through a steel company's network.

The AWS S3 Outage (February 2017)

How a single mistyped command during routine maintenance took down S3 us-east-1, cascading across the internet and revealing dangerous cloud concentration risk.

The Dyn DNS DDoS Attack and Mirai Botnet (2016)

How the Mirai botnet weaponized IoT devices to launch a massive DDoS attack on Dyn's DNS infrastructure, taking down Twitter, Netflix, Reddit, and dozens of major sites.

The CenturyLink/Level3 Flowspec Outage (2020)

How a single bad flowspec rule cascaded across CenturyLink's global backbone, disrupting internet service for millions and knocking 911 systems offline.

The Fastly CDN Global Outage (June 2021)

How a single customer configuration change triggered a latent bug in Fastly's edge network, taking down Amazon, Reddit, GitHub, and gov.uk for nearly an hour.

The China Telecom BGP Hijack (2010)

How China Telecom's AS4134 announced 50,000 prefixes belonging to other networks for 18 minutes, rerouting traffic from US military, government, and commercial networks through China.

The Google Nigeria BGP Leak (2018)

How MainOne, a Nigerian ISP, accidentally leaked Google's prefixes through a BGP peering configuration error, rerouting Google traffic through China Telecom and Russia.

The Akamai Edge DNS Outage (July 2021)

How a software configuration update triggered a bug in Akamai's Edge DNS platform, taking major banks, airlines, and gaming networks offline worldwide.

The GitHub 1.35 Tbps DDoS Attack (2018)

How attackers used memcached amplification to launch the largest DDoS attack ever recorded at the time against GitHub, and how Akamai Prolexic mitigated it in 10 minutes.

The MyEtherWallet BGP Hijack (2018)

How attackers hijacked Amazon Route 53 DNS via BGP to redirect MyEtherWallet users to a phishing site, stealing $152,000 in cryptocurrency.

The Rostelecom BGP Hijacks (2020)

How Russia's state-owned Rostelecom hijacked BGP prefixes belonging to Google, AWS, Cloudflare, and 200+ CDN/cloud providers, rerouting traffic through Russia.

The Cloudflare Backbone Outage (July 2020)

How a router configuration error in Cloudflare's Atlanta backbone caused a 27-minute outage affecting 50% of their network — and why their architecture saved them.

The Cogent-Sprint Depeering Incident (2008)

How Sprint severed its peering with Cogent in 2008, splitting the internet in two for three days and exposing the fragility of voluntary peering agreements.

The Spamhaus DDoS Attack (2013)

How a 300 Gbps DNS amplification attack against Spamhaus became the largest DDoS in history at the time, disrupting internet infrastructure worldwide.

The Indosat BGP Route Leak (2014)

How Indonesia's Indosat leaked 417,000 BGP routes through a misconfigured route optimizer, rerouting global traffic through Jakarta for two hours.

The Turkish Telecom DNS Hijack (2014)

How Turkey used BGP hijacking to intercept Google DNS and Level 3 DNS traffic to enforce government censorship of Twitter and YouTube.

The Telekom Malaysia BGP Route Leak (2015)

How Telekom Malaysia accidentally leaked 179,000 BGP prefixes to Level3, funneling global traffic through Malaysian infrastructure for hours.

The 3ve Ad Fraud BGP Hijack Operation (2018)

How a $36 million ad fraud ring used BGP hijacking to generate 12 billion fake ad impressions daily — the first major case of BGP abuse for financial fraud.

The Telia-Verizon AS Path Leak (2019)

How a Swiss hosting provider's route leak propagated through Telia and Verizon unfiltered, rerouting Cloudflare and AWS traffic for three hours.

The Google Global Outage (December 2020)

How a storage quota bug in Google's User ID Service took down Gmail, YouTube, and every Google service for 47 minutes — despite the network being fine.

The CrowdStrike Windows Outage (July 2024)

How a faulty CrowdStrike Falcon update crashed 8.5 million Windows machines simultaneously, causing the largest IT outage in history.

Azure DNS Outage 2023: How a Misconfigured Deployment Took Down Microsoft Services

Deep dive into the July 2023 Azure DNS outage caused by a misconfigured deployment that triggered cascading DNS failures across multiple Azure regions for two hours.

2026-04-24 · 9 min read

Comcast BGP Route Leak 2017: How a Filtering Failure Hijacked Traffic

Analysis of the November 2017 Comcast BGP route leak where AS7922 leaked routes to peers for 90 minutes, misdirecting traffic for major content providers and CDNs.

2026-04-24 · 11 min read

Optus BGP Outage 2023: How a Routing Change Took Down an Entire National Carrier

Post-mortem of the November 2023 Optus outage that left 10 million Australians without service for 14 hours after a BGP routing change cascaded through the carrier's core network.

2026-04-24 · 10 min read

Rogers Outage 2022: How a Routing Filter Took Down Canada NEW

On July 8 2022 a maintenance change removed a BGP routing filter at Rogers, flooding distribution routers and knocking 12M users offline for 19 hours, taking down Interac and 911.

Orange Spain BGP Hijack 2024: RPKI Weaponized via Stolen RIPE Credentials NEW

In January 2024 an attacker used infostealer-stolen credentials to log into Orange Spain's RIPE account and create invalid ROAs, making Orange's own BGP routes RPKI-invalid for hours.

Cloudflare WAF Regex Outage 2019: Catastrophic Backtracking NEW

July 2, 2019: a WAF rule with catastrophic backtracking drove all Cloudflare edge CPUs to 100% for 27 minutes, causing global 502 errors. Timeline, root cause, and lessons.

AWS US-East-1 Outage 2021: Internal Network Congestion NEW

December 7, 2021: automated scaling triggered a connection storm on AWS's internal network, congesting IAM, monitoring, and EC2 APIs for 7+ hours. Timeline, root cause, and lessons.