Top all-time · #1380
ipSpace.net blog
Personal blog · blog.ipspace.netsystemsprogramming
ipSpace.net blog is a personal blog at blog.ipspace.net about systems and programming. Since 2013, 54 different Hacker News readers have linked it 82 times, most often “Goodbye, Leaf-and-Spine Networks?”. It is still writing: the last post was on 2026-10-30, and you can follow it by feed.
Most-linked posts?
- /2011/12/is-nat-security-feature/4 people · 6 mentions · first linked 2024-07-27
- /2017/01/never-take-two-chronometers-to-sea.html2 people · 2 mentions · first linked 2018-12-27
- /2025/09/android-dhcpv6-prefix-delegation/2 people · 2 mentions · first linked 2025-12-20
- /2014/03/facebook-is-close-to-having-ipv6-only.html2 people · 2 mentions · first linked 2016-03-06
- Goodbye, Leaf-and-Spine Networks?2 people · 2 mentions · first linked 2026-06-10
- Snabb Switch and NFV on OpenStack in Software Gone Wild2 people · 2 mentions · first linked 2014-06-25
- /2 people · 2 mentions · first linked 2016-12-11
- Ansible Release 12: The Windows Vista Moment2 people · 2 mentions · first linked 2025-11-03
What Hacker News says?
> https://blog.ipspace.net/2011/12/is-nat-security-feature/ >>Basic NAT (as defined in RFC 2663) performs just the IP address translation (one inside host to one IP address in the NAT pool). The moment the inside host starts a session through the NAT, it becomes fully exposed to the outside world. This is a lie. A "session through the NAT" does not really expose the host to the outside world, because in 99% of the c…
Comment linking /2011/12/is-nat-security-feature/
on “The New Internet”Submitted The Lack of Historic Knowledge Is Frustrating as a story · 87 points
HN discussion> Also, NAT is desirable for security/network isolation reasons […] This is security theatre. People have been saying that NAT is not a security feature for over a decade: * https://blog.ipspace.net/2011/12/is-nat-security-feature/ but the message still has not sunk in. The "Zero Trust" paper was published by John Kindervag in 2010: * https://media.paloaltonetworks.com/documents/Forrester-No-Mo... Most modern attack…
Comment linking /2011/12/is-nat-security-feature/
on “The New Internet”Submitted What went wrong: SCTP (2009) as a story · 48 points
HN discussionI got an error message that said it rejects hotlinking, but you can see the picture in this post: https://blog.ipspace.net/2019/11/why-are-you-always-so-negat...
Comment linking /2019/11/why-are-you-always-so-negative.html
on “iPhone 12 and iPhone 12 Pro”Submitted MPLS/LDP Creation Myths as a story · 25 points
HN discussionI don't know if you've seen this, but working with Eastern Europeans for a year, this really hit home: https://blog.ipspace.net/2019/11/s1600-Its-All-Garbage-Short...
Comment linking /2019/11/s1600-Its-All-Garbage-Short.jpeg
on “iPhone 12 and iPhone 12 Pro”Submitted Ultra Ethernet: Reinventing X.25 as a story · 16 points
HN discussionMultihoming is broken for most people in IPv6 space. It's stupid easy in IPv4. https://blog.ipspace.net/2010/12/small-site-multihoming-in-i...
Comment linking /2010/12/small-site-multihoming-in-ipv6-mission/
on “HTTP/3 is everywhere but nowhere”Submitted Unnumbered IPv4 Interfaces as a story · 9 points
HN discussion> see TCP/IP as not being the "obvious design It is far from obvious, TCP has it's problems over fast and relatively reliable networks. For a random example see [1] [1] https://blog.ipspace.net/2019/06/do-packet-drops-matter-for-...
Comment linking /2019/06/do-packet-drops-matter-for-tcp.html
on “Project Oberon”Submitted Snabb Switch and NFV on OpenStack in Software Gone Wild as a story · 5 points
HN discussionThis is one rack of equipment; no spines are needed. http://blog.ipspace.net/2014/10/all-you-need-are-two-top-of-... Cumulus isn't really SDN so I'm not sure what you're saying there. Traditional networking is fine but it's totally different than Linux so you need dedicated netops people to manage it. And Cisco is the most expensive traditional vendor.
Comment linking /2014/10/all-you-need-are-two-top-of-rack.html
on “Proposed server purchase for GitLab.com”Submitted AWS Networking 101 as a story · 4 points
HN discussion> We want to dual bound the network connections to increase performance and reliability. This will allow us to take routers out of service during low traffic times, for example to restart them after a software upgrade. does not really agree with > Each of the two physical network connections will connect to a different top of rack router. Sure, you can do it with something like MLAG, but that's really just moving yo…
Comment linking /
on “Proposed server purchase for GitLab.com”Submitted Ansible Release 12: The Windows Vista Moment as a story · 3 points
HN discussionI'm the Snabb Switch originator. The project is new: I and other open source contributors are currently under contract to build a Network Functions Virtualization platform for Deutsche Telekom's TeraStream project [1] [2]. This is called Snabb NFV [3] and it's going to be totally open source and integrated with OpenStack. Currently we are doing a lot of virtualization work from the "outside" of the VM: implementing…
Comment linking /2013/11/deutsche-telekom-terastream-designed.html
on “The C10M problem”Submitted Ansible Release 12: The Windows Vista Moment as a story · 3 points
HN discussionBuy some routers that have BGP implementations (there are some cheap ones, Mikrotik for example), or use open source implementations. The article lists bird, another very popular one is FRR (free range routing). You can trivially stand up two docker containers, stand up a BGP session between them, and - for example - propagate static routes you set up within them. If you like guided tutorials, https://blog.ipspace.n…
Comment linking /2023/08/bgp-labs-basic-setup/
on “BGP handling bug causes widespread internet routing instability”Submitted Has Ansible Team Abandoned Network Automation? as a story · 2 points
HN discussionYou obviously need edge devices that translate for you, e.g. using NAT64 (which maps IPv4 to a /96 IPv6 subnet. Since you then have an IPv6 address for each IPv4 address, you don't even need to maintain state on the gateway, so it scales very well) Facebook does data centers that internally only use IPv6 using these techniques: http://blog.ipspace.net/2014/03/facebook-is-close-to-having-...
Comment linking /2014/03/facebook-is-close-to-having-ipv6-only.html
on “Let's code a TCP/IP stack, 1: Ethernet and ARP”Submitted Why Can't We Have Good Documentation as a story · 2 points
HN discussion> I’m assuming it’s somewhat justified. in a sense, yes. People claiming software based solutions can match performance of hardware basic ASIC's are simply not thinking about the scale and speeds of modern core routers and switches. For instance, taken from the blog of ivan pepaljnak[0] > It’s hard to imagine how fast switching ASICs have to work – a modern data center switching ASIC can forward billions of packets…
Comment linking /2022/06/data-center-switching-asic-tradeoffs.html
on “40% of Google users now connect via IPv6”Submitted When Switches Flood LLDP Traffic as a story · 2 points
HN discussionThe opposite pattern is much more convenient: IPv4 on the public endpoint and IPv6-only internally. AWS is now close to supporting this. http://blog.ipspace.net/2014/03/facebook-is-close-to-having-...
Comment linking /2014/03/facebook-is-close-to-having-ipv6-only.html
on “IPv6 Support for EC2 Instances in Virtual Private Clouds”Submitted Always Check Your Tests Against Faulty Inputs as a story · 2 points
HN discussionI'm not a network engineer, rather a security-focused guy, and I'm also very interested in this topic because the basis for a secure network is a well managed network without any unknown/undocumented assets (network equipment incl. layer 2 as well as network participants). Few months ago I attended a talk of Ivan Pepelnjak, the author of a network engineering blog called ipspace. He talked a lot on network automatio…
Comment linking /2018/03/presentation-and-video-real-life.html
on “Ask HN: What problem in your industry is a potential startup?”Submitted Networking Fundamentals as a story · 2 points
HN discussionThis has already been done at scale with HTTP/3 (QUIC), it's just not widely distributed beyond the largest sites & most popular web browsers. gRPC for example is still on multiplexed TCP via HTTP/2, which is "good enough" for many. Though it doesn't really replace TCP, it's just that the predominant requirements have changed (as Ousterhout points out). Bruce Davie has a series of articles on this: https://systemsap…
Comment linking /2023/01/data-center-tcp-replacement/
on “It's time to replace TCP in the datacenter (2023)”Submitted Tagged VLAN 1 in a Trunk Is a Bad Idea as a story · 2 points
HN discussion
