# Ip Published articles for Ip. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Secure Compute and Static IP builds start 64% faster DevFeed: [Secure Compute and Static IP builds start 64% faster]() Original publisher: [Read original article]() Author: Karim Hasebou Published: 2026-09-16T17:00:00Z Content type: release Language: en Sources: [Vercel News]() Topics: [Deployment](), [Containers](), [Network Configuration]() Tags: [automatically](), [build](), [compute](), [containers](), [faster](), [ip](), [network-configuration](), [static]() ### AI overview Vercel reports that builds using Secure Compute or Static IPs now start 64% faster on average, improving from 6.7 seconds to 2.4 seconds. The change uses prewarmed build containers with network configuration attached at build start and requires no configuration changes. ### Source excerpt Builds using Secure Compute or Static IPs now start 64% faster, with the average time from deployment creation to build start dropping from 6.7 seconds to 2.4 seconds. Previously, each build waited for a new build container to boot with its network configuration. These builds now use prewarmed build containers, with your network configuration attached when the build starts. The improvement is applied automatically to builds using Secure Compute or Static IPs, with no configuration changes required. Learn more about Secure Compute and Static IPs. Read more ## Configuring Management IP Addresses to Virtual Network Devices DevFeed: [Configuring Management IP Addresses to Virtual Network Devices]() Original publisher: [Read original article]() Published: 2026-09-14T05:29:00Z Content type: article Language: en Sources: [ipSpace.net blog]() Topics: [networking](), [configuration](), [Orchestration](), [Vagrant](), [Cloud](), [ssh]() Tags: [cli](), [cloud](), [devices](), [dhcp](), [ip](), [ipv4](), [ipv6](), [management](), [netlab](), [network](), [networking](), [orchestration](), [server](), [ssh]() ### AI overview The article explains how to assign predictable management IP addresses to virtual network devices. It contrasts manual console-based setup with automated assignment through orchestration, containers, DHCPv4/DHCPv6, custom Vagrant boxes, and IPv6 mechanisms such as SLAAC. ### Source excerpt It goes without saying that if you want to configure (virtual) network devices with any semi-sane configuration mechanism1, the device must have a working IP address. Here's the time-honored method2 to assign an IP address to a virtual network device: Start the virtual machine (using a GUI)3 Open a new window: either a telnet session to the virtual console port or a full-blown virtual console (GUI) session. Manually configure the IP address, the SSH server, and the user credentials on the first interface. Read more ... ## Introducing IP Allowlisting DevFeed: [Introducing IP Allowlisting]() Original publisher: [Read original article]() Author: Postmark team (fdossetto+postmark@activecampaign.com) Published: 2026-09-08T17:37:00Z Content type: release Language: en Sources: [Postmark (en-US)]() Topics: [Security](), [API](), [Network](), [Cloud]() Tags: [api](), [infrastructure](), [ip](), [nat](), [network](), [product-news](), [protection](), [range](), [request](), [security](), [token]() ### AI overview Postmark introduces IP Allowlisting, a security feature that restricts email sending through the Postmark API to up to 10 configured IP ranges in CIDR format. Requests from outside the allowed ranges are rejected with a 403 response. The ranges can be configured at the Server or account level, with Server settings overriding account settings. ### Source excerpt Good security is layered and each layer does a job the others can't. Scoping a token to a Server limits what it reaches. Rotating a token limits how long it lasts. Neither can say anything about where a request came from. We've been hard at work to ship a new layer of protection that can. IP Allowlisting is a new Postmark security feature that lets you name the infrastructure your email should come from. It's available now on all Postmark plans at no extra cost. It's off until you turn it on. How IP Allowlisting works You add up to 10 IP ranges, in CIDR format, that are allowed to send email using the Postmark API. Send requests from outside those ranges are rejected with a 403 status code that includes the IP the request came from. You can set your ranges in two places: On a Server. The ranges apply to that Server, covering every Message Stream on it. This is where we'd suggest starting. On your account. The ranges apply to every Server you have. When a Server has ranges of its own they will override account level settings. That's it! A straightforward security control to protect your API sending. Protect individual Servers or across your account. Set your Allowlist ranges on the account or Server. If you don't write CIDR blocks often, it's a quick 30 seconds to get familiar with them and the correct notation. CIDR blocks allow you to enable a grouped collection of IP addresses (aka ranges.) A CIDR block is an IP address followed by a suffix that says how many addresses it covers. The smaller the suffix, the wider the range: 198.51.100.24/32 one address, and only that address 203.0.113.0/24 256 addresses: 203.0.113.0 through 203.0.113.255 203.0.0.0/16 65,536 addresses: 203.0.0.0 through 203.0.255.255 So a /32 pins the allowlist to a single machine, and a /24 covers a subnet. Most teams end up somewhere in that span. Where you find your own ranges depends on how you send. A single VM has a static public IP you can read off your provider's dashboard. Cloud workloads ## kube-proxy in iptables Mode and Native nftables Rules in the Forward Chain DevFeed: [kube-proxy in iptables Mode and Native nftables Rules in the Forward Chain]() Original publisher: [Read original article]() Author: Philipp Lehmann (philipp.lehmann@gruppe.ai) Published: 2026-09-08T07:00:00Z Content type: article Language: en Sources: [Philipp Lehmann]() Topics: [proxy](), [Kernel](), [Virtual Private Network]() Tags: [firewall](), [handle](), [ip](), [kernel](), [kubernetes](), [linux](), [networking](), [proxy](), [reliability](), [vpn]() ### AI overview The article explains how native nftables rules added by a WireGuard-based mesh agent to the FORWARD chain can cause kube-proxy in iptables mode to abort synchronization silently, leaving service endpoints stale. It describes removing the conflicting rules by handle. ### Source excerpt kube-proxy iptables-nft sync silently aborts on native nftables rules a mesh agent adds to the FORWARD chain. Fix: nft delete rule by handle, ip and ip6. ## Parsing common IPv4 addresses in C# with AVX-512 DevFeed: [Parsing common IPv4 addresses in C# with AVX-512]() Original publisher: [Read original article]() Author: Daniel Lemire Published: 2026-08-19T19:07:48Z Content type: article Language: en Sources: [Daniel Lemire]() Topics: [C#](), [Parsing](), [performance-optimization](), [.NET]() Tags: [avx](), [c-sharp](), [ip](), [ipv4](), [parsing](), [performance]() ### AI overview The article examines parsing common IPv4 address strings in C# for performance. It discusses using SIMD and AVX-512 support in .NET 10, including masked loads for safely loading strings shorter than a SIMD register width. ### Source excerpt We are all familiar with IP addresses such as 192.168.0.1. They are typically written as four numbers in the range 0 to 255 inclusive, separated by dots. In C#, you can parse them with the standard library using IPAddress.TryParse. Pedantic people are quick to point out that IP addresses can take different forms: they can ... Continue reading Parsing IP addresses in C# at crazy speeds ## Deploying IPv6-first EKS on AWS: What Still Doesn't Work, and What It Saves DevFeed: [Deploying IPv6-first EKS on AWS: What Still Doesn't Work, and What It Saves]() Original publisher: [Read original article]() Author: Spiro Stathakis Published: 2026-08-14T08:57:28Z Content type: article Language: en Sources: [RIPE Labs]() Topics: [Amazon Elastic Kubernetes Service](), [Amazon Web Services](), [VPC](), [networking](), [cloud-infrastructure](), [Kubernetes]() Tags: [2026](), [amazon](), [amazon-elastic-kubernetes-service](), [aws](), [cni](), [competition](), [cost](), [ip](), [ipv4](), [ipv6](), [kubernetes](), [nat](), [networking](), [networks](), [vpc]() ### AI overview A field report on deploying an IPv6-first Amazon Elastic Kubernetes Service platform on AWS. It explains how IPv6 pods, VPC networking, and an egress-only Internet gateway reduce dependence on NAT gateways and public IPv4 addresses, while legacy IPv4-only dependencies such as databases, payment APIs, and container registries still impose compatibility requirements and costs. ### Source excerpt In this field report on IPv6-first Amazon Elastic Kubernetes Service (EKS), the isp6 team shares which dependencies still drag IPv4 back in, what they learnt from /28s, and why the saving is large but not automatic. ## Multiple LIR Accounts: Looking Back and Thinking Ahead DevFeed: [Multiple LIR Accounts: Looking Back and Thinking Ahead]() Original publisher: [Read original article]() Author: Marco Schmidt Published: 2026-08-12T12:47:22Z Content type: article Language: en Sources: [RIPE Labs]() Topics: [Internet](), [Networks](), [.NET 11]() Tags: [administration](), [article](), [complexity](), [ip](), [ipv4](), [networks](), [operational](), [policy]() ### AI overview The article examines how allowing RIPE NCC members to operate multiple Local Internet Registry (LIR) accounts evolved from a solution for limited organizational situations into a source of disproportionate operational complexity. It reviews the effects of IPv4 exhaustion, the last /8 policy, and the IPv4 transfer market, then explains the Internet Registry System and the rationale for simplifying the current model. ### Source excerpt Why a feature introduced for a handful of members became one of the RIPE NCC's most complex operational challenges. ## IP Addressing, Part II: Scaling IPv4 Across the Internet DevFeed: [IP Addressing, Part II: Scaling IPv4 Across the Internet]() Original publisher: [Read original article]() Author: Franco Fernando Published: 2026-08-01T11:36:30Z Content type: article Language: en Sources: [The Polymathic Engineer]() Topics: [Internet]() Tags: [internet](), [ip](), [ipv4](), [nat]() ### AI overview This article explains how CIDR replaced classful addressing and how private addresses and NAT helped extend the usable life of IPv4. ### Source excerpt How classful addressing gave way to CIDR, and how private addresses and NAT kept the world from running out of IPv4. ## Vercel WAF for Blob is now in beta DevFeed: [Vercel WAF for Blob is now in beta]() Original publisher: [Read original article]() Author: Can Temizyurek Published: 2026-07-24T17:48:00Z Content type: release Language: en Sources: [Vercel News]() Topics: [Vercel](), [Deployment](), [dashboards](), [browser](), [data](), [Server]() Tags: [browser](), [data](), [deployment](), [documentation](), [edge](), [ip](), [server](), [vercel]() ### AI overview Vercel WAF for Blob is now available in beta, applying deployment-style deny, challenge, rate-limit, redirect, and logging rules to Vercel Blob traffic at the edge. Protection is enabled from the dashboard and is available on all plans. ### Source excerpt The Vercel WAF can now protect a Vercel Blob store. The same rules that guard your deployments (deny, challenge, rate limit) now apply to blob traffic with no changes to your code, blob URLs, or @vercel/blob. Every blob is already served through Vercel's CDN, so protection is a switch on the store, not a new proxy. Stop scrapers, geo-restrict downloads, rate limit expensive assets, or block abusive IPs before a byte is served. Rules evaluate at the edge, matching on IP, country, path, and more: Deny returns a 403 and stops the request early, so no data transfer is incurred. Challenge serves the standard browser challenge, and a request that fails it is blocked. Rate limit returns a 429 when a client exceeds your limit. Redirect and log behave as they do for deployment traffic. The OWASP Core Ruleset is not supported, since it targets dynamic application traffic, not object delivery. Protecting a store Setup is a single switch in the dashboard: Open your Blob store, select Settings, then Protect your store. Vercel connects it to a shared vercel-blob-default-project on your team. You author its rules with the standard rule builder, and they take effect immediately. One rule set covers every protected store, so rules can't be scoped per store. During the beta, setup is dashboard-only, and challenges need a browser to solve, so server-side @vercel/blob requests matching a challenge rule are blocked. Use challenge rules for browser traffic. Vercel WAF for Blob is available in beta on all plans. See the documentation for the full setup. Read more ## Hedge 312: Keys and DNS DevFeed: [Hedge 312: Keys and DNS]() Original publisher: [Read original article]() Author: Russ Published: 2026-07-17T16:16:02Z Content type: article Language: en Sources: [rule 11 reader]() Topics: [Internet]() Tags: [cryptographic](), [hedge](), [internet](), [ip]() ### AI overview A Hedge episode discusses a paper proposing cryptographic keys as the primary host identifier instead of IP addresses, alongside an article about DNS's central role on the Internet. ### Source excerpt The entire technology world has, for decades, treated the IP address as a shorthand host identifier. This is clearly not the way IP was designed, but what are our other choices? In this episode of the Hedge, Scott Robohn joins Russ And Tom to discuss a recent paper arguing cryptographic keys should be the primary host identifier, and another article on the centrality of DNS to the Internet. ## AES67 audio-over-IP on the ESP32-P4 DevFeed: [AES67 audio-over-IP on the ESP32-P4]() Original publisher: [Read original article]() Author: John Lee Published: 2026-06-24T00:00:00Z Content type: tutorial Language: en Sources: [Blog on Developer Portal]() Topics: [ESP32-P4](), [ESP-IDF](), [Ethernet](), [Latency](), [RISC-V](), [Protocol (disambiguation)](), [Toit](), [Raspberry Pi]() Tags: [aes67](), [audio](), [blog](), [esp-idf](), [esp32](), [esp32-p4](), [ethernet](), [hardware](), [ip](), [latency](), [low-latency](), [network](), [networking](), [protocol](), [ptp](), [ravenna](), [risc-v](), [rtp](), [sync]() ### AI overview This article describes implementing a working, PTP-synchronized AES67/RAVENNA audio endpoint on the ESP32-P4 as an ESP-IDF component. It covers clock synchronization, low-latency packet reception, and I2S playout, reporting best-case end-to-end latency of about 0.7 ms and noting which parts are solid or still limited. ### Source excerpt AES67/RAVENNA is the audio transport behind a lot of broadcast and live-sound infrastructure, and it normally runs on dedicated silicon or Linux boxes. This article is about getting a working, PTP-synchronized AES67 endpoint onto an ESP32-P4 -- how the clock sync, the low-latency receive path, and the I2S playout fit together, what the measured latency is, and where the edges are. ## MetaStealer traffic, new DGAs and analyzing the "tracker" backdoor DGA with AI DevFeed: [MetaStealer traffic, new DGAs and analyzing the "tracker" backdoor DGA with AI]() Original publisher: [Read original article]() Author: Jason Reaves Published: 2026-06-17T21:54:01Z Content type: article Language: en Sources: [Walmart Global Tech]() Topics: [Malware](), [backdoor](), [payload](), [Python](), [Claude](), [Artificial Intelligence]() Tags: [ai](), [backdoor](), [capture](), [claude](), [claude-ai](), [infosec](), [ip](), [malware](), [payload](), [port](), [python](), [reverse-engineering]() ### AI overview The article examines new MetaStealer domain-generation algorithms and explains that its gate servers rely more on IP addresses, ports, URIs, and HTTP headers than on domains. It also analyzes RuntimeSync, a developing malware sample with RAT and backdoor capabilities, and describes using Claude.ai Sonnet 4.6 to reverse engineer its DGA and produce Python simulation code. ### Source excerpt By: Jason Reaves and Joshua Platt In this blog we simply want to highlight a few new additions to what appears to be related to MetaStealer, one is a new wordlist based DGA used by MetaStealer. We also want to highlight that MetaStealer's proxies or 'gates' don't actually care what domain gets used as it's just a config item; they simply pass on the traffic to another server. We also want to highlight a task that was seen delivered to a few bots which is related to MetaStealer but appears to still be in development. This turned out to be a piece of malware that contains RAT/backdoor functionality. Leveraging Claude.ai Sonnet 4.6 we were able to systematically guide the AI to automatically reverse engineer the DGA used in the backdoor malware and provide working python code to simulate it. MetaStealer DGA: As previously mentioned MetaStealers new DGA is based on a wordlist. Below are some recent examples: sea-vast-send.com 46bbaceb6073f196bf7737c67f5394a6465e396bbcbbac1afe5f2f866c995fd0hxxp://pestrear-lamp.xyz:443 d57e132866286f9b4227c7fb1cd77f16a461e76a3f3e71362734741aab6b9a96hxxp://anus-staylard.xyz:443 d1b88ded80f0e616362b8984334c69da1ea2f32d0828480e32978d1a710f40c5 This does not mean, however, that the older DGA is no longer in use; it remains active. The threat actor (TA) has designed their gate servers in such a way that they are largely agnostic to the domain being used. Instead, the IP address, port, URI, and HTTP headers are the more important factors. 155.117.20.75 qocyeicmusmegouw.xyz 213.139.77.254 uumcceymkuymmqou.xyz We didn't focus on this DGA though because during our investigation we stumbled on a piece of malware being actively developed by the same TA that also had a DGA. Backdoor "tracker" During the investigation, we observed a peculiar payload being delivered to several machines: an installer named RuntimeSync, example hash: 82c218357266ce314f523946bdd661cc335a120981c471e95d70af7fbd4d9141 RuntimeSyncExe: PE32+ executable (GUI) x86-64, for MS Win ## Security Week 2624: троян в хентай-играх DevFeed: [Security Week 2624: троян в хентай-играх]() Original publisher: [Read original article]() Author: Kaspersky\_Lab ("Лаборатория Касперского") Published: 2026-06-08T17:00:51Z Content type: news Language: ru Sources: ["Лаборатория Касперского" RU]() Topics: [Security](), [FFmpeg (Fast Forward Moving Picture Experts Group)](), [PowerShell](), [Windows](), [GitHub]() Tags: [argamal](), [ffmpeg](), [github](), [ip](), [powershell](), [security](), [tag-9fe8963de219](), [trojan](), [udp](), [windows]() ### AI overview Kaspersky researchers analyzed the Argamal remote-access trojan, distributed with hentai games through file-sharing sites and torrent trackers. Modified ffmpeg.dll files trigger a PowerShell-based infection chain that retrieves an encrypted payload from GitHub and establishes persistence on Windows. The trojan can collect system information, execute commands, manipulate files, capture screenshots, and control the keyboard and mouse. ### Source excerpt Исследователи "Лаборатории Касперского" опубликовали подробный разбор вредоносного ПО Argamal, распространяемого на специализированных ресурсах вместе с хентай-играми. Данная вредоносная кампания была обнаружена в этом году, хотя некоторые связанные с ней DLL-файлы существовали как минимум с 2024 года. Игры с вредоносным довеском, как правило, заливались на публичный файлообменник, ссылки на который публиковались на тематических веб-сайтах. Распространялись они и через торрент-трекеры. Во всех случаях это был архив с полностью функциональной игрой, которая дополнялась модифицированной библиотекой ffmpeg.dll. Читать далее ## I tested every IP KVM in my Homelab DevFeed: [I tested every IP KVM in my Homelab]() Original publisher: [Read original article]() Author: jeff@jeffgeerling.com (Jeff Geerling) Published: 2026-06-05T14:00:00Z Content type: comparison Language: en Sources: [Jeff Geerling]() Topics: [Pikvm](), [Homelab](), [Raspberry Pi](), [Security](), [benchmarking](), [Vulnerabilities](), [Virtual Private Network](), [GPU](), [hdmi](), [ssh]() Tags: [benchmarking](), [glinet](), [hardware](), [hdmi](), [homelab](), [ip](), [jetkvm](), [kvm](), [network](), [pikvm](), [raspberry-pi](), [security](), [sipeed](), [ssh](), [vpn](), [vulnerabilities]() ### AI overview A comparison of IP KVM devices, explaining how they provide remote keyboard, video, and mouse control over an IP network and when they are useful alongside Remote Desktop, VNC, screen sharing, or SSH. The article emphasizes security risks, including remote BIOS access and vulnerabilities, and begins its review with PiKVM. ### Source excerpt Since the PiKVM came out in 2017, there's been an explosion of IP KVMs. I've tested almost every one. But what are they good for? You can use Remote Desktop, Screen Sharing, or VNC to remote control a computer from anywhere on a LAN. And if you don't have a private VPN, you could use RealVNC, Raspberry Pi Connect, or wire up Tailscale or Pangolin for fully remote access. Those solutions are great, and so is SSH if you don't need a full desktop. ## Webworm: New burrowing techniques DevFeed: [Webworm: New burrowing techniques]() Original publisher: [Read original article]() Author: Eric Howard Published: 2026-05-20T08:40:00Z Content type: article Language: en Sources: [WeLiveSecurity]() Topics: [Malware](), [backdoor](), [Reconnaissance](), [Discord](), [GitHub](), [API](), [Microsoft](), [Bash](), [Virtual Private Network](), [Amazon S3]() Tags: [api](), [apt](), [backdoor](), [bash](), [china](), [discord](), [eset-research](), [europe](), [github](), [ip](), [malware](), [microsoft](), [s3](), [server](), [techniques](), [tools]() ### AI overview ESET researchers analyze Webworm's 2025 activity, including its shift toward Europe, new Discord- and Microsoft Graph API-based backdoors, proxy tools, reconnaissance activity, and GitHub-hosted malware staging. ### Source excerpt ESET researchers describe new tools and techniques that the Webworm APT group recently added to its arsenal ## Kubernetes v1.36: Deprecation and removal of Service ExternalIPs DevFeed: [Kubernetes v1.36: Deprecation and removal of Service ExternalIPs]() Original publisher: [Read original article]() Author: Adrian Moisey; Dan Winship Published: 2026-05-14T18:35:00Z Content type: article Language: en Sources: [Kubernetes Blog]() Topics: [Kubernetes](), [Security](), [Network](), [API](), [Cloud]() Tags: [api](), [exploits](), [ip](), [kubernetes](), [network](), [release](), [security](), [update]() ### AI overview Kubernetes 1.36 formally deprecates the Service API's .spec.externalIPs field because its trust assumptions can enable security exploits, including CVE-2020-8554. The article explains the scope of the deprecation, recommends the DenyServiceExternalIPs admission controller, and discusses alternatives for non-cloud clusters needing load-balancer-like functionality. ### Source excerpt The .spec.externalIPs field for Service was an early attempt to provide cloud-load-balancer-like functionality for non-cloud clusters. Unfortunately, the API assumes that every user in the cluster is fully trusted, and in any situation where that is not the case, it enables various security exploits, as described in CVE-2020-8554. Since Kubernetes 1.21, the Kubernetes project has recommended that all users disable .spec.externalIPs. To make that easier, Kubernetes also added an admission controller (DenyServiceExternalIPs) that can be enabled to do this. At the time, SIG Network felt that blocking the functionality by default was too large a breaking change to consider. However, the security problems are still there, and as a project we're increasingly unhappy with the "insecure by default" state of the feature. Additionally, there are now several better alternatives for non-cloud clusters wanting load-balancer-like functionality. As a result, the .spec.externalIPs field for Service is now formally deprecated in Kubernetes 1.36. We expect that a future minor release of Kubernetes will drop implementation of the behavior from kube-proxy, and will update the Kubernetes conformance criteria to require that conforming implementations do not provide support. A note on terminology, and what hasn't been deprecated The phrase external IP is somewhat overloaded in Kubernetes: The Service API has a field .spec.externalIPs that can be used to add additional IP addresses that a Service will respond on. The Node API's .status.addresses field can list addresses of several different types, one of which is called ExternalIP. The kubectl tool, when displaying information about a Service of type LoadBalancer in the default output format, will show the load balancer IP address under the column heading EXTERNAL-IP. This deprecation is about the first of those. If you are not setting the field externalIPs in any of your Services, then it does not apply to you. That said, as a precaution ## Create Vercel Firewall rules with natural language DevFeed: [Create Vercel Firewall rules with natural language]() Original publisher: [Read original article]() Author: Yash Kothari Published: 2026-05-12T19:00:00Z Content type: release Language: en Sources: [Vercel News]() Topics: [Firewall](), [Vercel](), [Command-line interface](), [dashboards](), [Authorization]() Tags: [authorization](), [checkout](), [cli](), [documentation](), [firewall](), [generate](), [ip](), [logging](), [us](), [vercel]() ### AI overview Vercel Firewall now supports creating WAF custom rules from natural-language descriptions. The dashboard or Vercel CLI can generate rules that log, block, challenge, rate limit, or redirect requests based on conditions such as IP address, path, country, and user agent. ### Source excerpt Vercel Firewall now lets you create WAF custom rules using natural language. Describe the behavior you need and the dashboard will generate the rule. Visit the firewall custom rules page to try creating a rate-limiting rule: Or use the Vercel CLI: WAF custom rules let you control traffic to your site by logging, blocking, challenging, rate limiting, or redirecting requests based on conditions like IP address, path, country, user agent, and more. For example, you can: Log all requests to /api/webhook with a missing authorization header Block all requests to /wp-admin Challenge all traffic to /checkout that doesn't come from the US Generate your first rule or learn more in the documentation. Read more ## On Generating EVPN MAC/IP Routes DevFeed: [On Generating EVPN MAC/IP Routes]() Original publisher: [Read original article]() Published: 2026-04-29T05:38:00Z Content type: opinion Language: en Sources: [ipSpace.net blog]() Topics: [evpn](), [BGP](), [networking]() Tags: [arp](), [bgp](), [evpn](), [ip](), [mac]() ### AI overview The article explains that Arista EOS generates separate EVPN MAC-only and MAC+IP routes. MAC table updates trigger MAC-only routes, while ARP table updates trigger MAC+IP routes, which can increase the size of the EVPN BGP table. ### Source excerpt Naveen Kumar Devaraj was reading my Integrated Routing and Bridging (IRB) with EVPN MAC-VRF Instances lab exercise and spotted this detail: Arista EOS originates MAC-IP routes with and without IP addresses, effectively doubling the size of the EVPN BGP table He kindly wrote a LinkedIn comment explaining that behavior: Read more ... ## Virtual machines, virtually everywhere - and with real security gaps DevFeed: [Virtual machines, virtually everywhere - and with real security gaps]() Original publisher: [Read original article]() Author: Tomáš Foltýn Published: 2026-03-25T10:00:00Z Content type: article Language: en Sources: [WeLiveSecurity]() Topics: [Cloud](), [Security](), [cloud-infrastructure](), [Amazon Web Services](), [Azure](), [on-prem](), [Amazon EC2](), [Amazon S3]() Tags: [amazon-web-services-aws](), [apis](), [aws](), [azure](), [breach](), [business-security](), [cloud](), [identity](), [infrastructure](), [ip](), [on-prem](), [operations](), [s3](), [scale](), [security](), [speed](), [storage]() ### AI overview Cloud adoption has created a widespread virtual-machine sprawl problem. Unmanaged or poorly monitored VMs may miss operating-system updates, retain outdated access policies, and evade security operations, creating subtle risks alongside more visible threats such as misconfigured storage buckets and exposed APIs. ### Source excerpt Cloud VMs offer unmatched speed, scale and flexibility - all of which could eventually count for little if they're left to fend for themselves ## IPv4 ECMP Works on Arista cEOS Release 4.35.2F DevFeed: [IPv4 ECMP Works on Arista cEOS Release 4.35.2F]() Original publisher: [Read original article]() Published: 2026-03-12T09:09:00Z Content type: opinion Language: en Sources: [ipSpace.net blog]() Topics: [IP routing](), [networking](), [Linux]() Tags: [ip](), [ip-routing](), [ipv4](), [linux-kernel](), [mpls](), [release](), [switching]() ### AI overview The article reports that IPv4 ECMP works on Arista cEOS release 4.35.02F, with traffic spreading across multiple nodes in the author's lab topology. It also observes that forwarded traffic uses ECMP while locally originated traffic does not, despite different routing-table entries. ### Source excerpt When I wrote about the anycast-ECMP-in-MPLS behavior in 2011, I had to use Cisco IOS to prove that ECMP worked, since Arista cEOS (running the Linux kernel for IP forwarding) didn't install more than one equal-cost path into the Linux forwarding table. Arista cEOS got better in the meantime; IPv4 ECMP works like a charm on cEOS release 4.35.02F. With the same lab topology I'd used in 2021, I was able to see the traffic spread across multiple nodes: Read more ... ## Cómo elegir hardware para tu homelab DevFeed: [Cómo elegir hardware para tu homelab]() Original publisher: [Read original article]() Author: Alois Published: 2026-02-09T00:00:00Z Content type: tutorial Language: es Sources: [tengoping.com]() Topics: [Homelab](), [Hardware](), [DDR4](), [lenovo](), [dell](), [intel](), [Firewall](), [Opnsense]() Tags: [ddr4](), [dell](), [enterprise](), [firewall](), [hardware](), [homelab](), [intel](), [ip](), [kvm](), [lenovo](), [mini-pcs](), [opnsense](), [raspberry-pi](), [router]() ### AI overview This Spanish guide explains how to choose hardware for a homelab. It compares used Lenovo, HP, and Dell mini PCs with used enterprise servers, covering virtualization capability, storage, remote management, approximate prices, noise, and power consumption. ### Source excerpt Consejos prácticos para montar un homelab sin arruinarte: mini PCs, servidores usados, almacenamiento y consumo eléctrico. ## On MPLS Forwarding Performance Myths DevFeed: [On MPLS Forwarding Performance Myths]() Original publisher: [Read original article]() Published: 2026-02-05T07:20:00Z Content type: opinion Language: en Sources: [ipSpace.net blog]() Topics: [networking](), [Ethernet](), [Cisco](), [Hardware]() Tags: [cisco](), [devices](), [hardware](), [ietf](), [ip](), [mpls](), [performance](), [switching]() ### AI overview The article examines claims about the original motivation for MPLS, arguing that aggregate forwarding performance in core devices mattered more than accelerating individual IP table lookups. It describes how mid-1990s service providers combined routers at the network edge with ATM switches in the core because routers lacked sufficient aggregate bandwidth. ### Source excerpt Whenever I claim that the initial use case for MPLS was improved forwarding performance (using the RFC that matches the IETF MPLS BoF slides as supporting evidence), someone inevitably comes up with a source claiming something along these lines: The idea of speeding up the lookup operation on an IP datagram turned out to have little practical impact. That might be true1, although I do remember how hard it was for Cisco to build the first IP forwarding hardware in the AGS+ CBUS controller. Switching labels would be much faster (or at least cheaper), but the time it takes to do a forwarding table lookup was never the main consideration. It was all about the aggregate forwarding performance of core devices. Anyhow, Duty Calls. It's time for another archeology dig. Unfortunately, most of the primary sources irrecoverably went to /dev/null, and personal memories are never reliable; comments are most welcome. Read more ... ## Configurar Fail2Ban para proteger servicios DevFeed: [Configurar Fail2Ban para proteger servicios]() Original publisher: [Read original article]() Author: Antonio Pérez Published: 2026-01-28T00:00:00Z Content type: tutorial Language: es Sources: [tengoping.com]() Topics: [Fail2ban](), [OpenSSH](), [nginx](), [Debian](), [Ubuntu](), [rhel 9]() Tags: [debian](), [error](), [fail2ban](), [internet](), [ip](), [login](), [logs](), [nginx](), [rhel](), [rhel-9](), [ssh](), [ubuntu]() ### AI overview A practical guide to installing and configuring Fail2Ban to protect SSH, Nginx, and other services from brute-force attacks. It covers jail configuration, custom Nginx filters, nftables and iptables actions, status checks, and manually unbanning IP addresses. ### Source excerpt Guía práctica para instalar y configurar Fail2Ban: protege SSH, Nginx y otros servicios contra ataques de fuerza bruta. ## Testing IP Multicast with netlab DevFeed: [Testing IP Multicast with netlab]() Original publisher: [Read original article]() Published: 2025-11-26T06:56:00Z Content type: article Language: en Sources: [ipSpace.net blog]() Topics: [networking](), [Routing (disambiguation)](), [Testing](), [GitHub]() Tags: [github](), [ip](), [multicast](), [netlab](), [permission](), [routing](), [tcp-ip](), [testing](), [volume](), [worth-reading]() ### AI overview The article highlights Aleksandr Albin's nearly 20-router lab topology for practicing inter-AS IP multicast. The topology and additional configuration templates are published on GitHub, with the experience also documented in a LinkedIn post. ### Source excerpt Aleksandr Albin built a large (almost 20-router) lab topology (based on an example from Jeff Doyle's Routing TCP/IP Volume 2) that he uses to practice inter-AS IP multicast. He also published the topology file (and additional configuration templates) on GitHub and documented his experience in a LinkedIn post. Lab topology, copied with permission by Aleksandr Albin It's so nice to see engineers using your tool in real-life scenarios. Thanks a million, Aleksandr, for sharing it. [Next page]()