# packet Published articles for packet. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## PCAP-LM: Helping AI assistants read network traffic DevFeed: [PCAP-LM: Helping AI assistants read network traffic]() Original publisher: [Read original article]() Author: Xavier Marjou Published: 2026-11-06T00:04:21Z Content type: article Language: en Sources: [APNIC Blog]() Topics: [Artificial Intelligence](), [network-intelligence](), [Internet Traffic](), [AI Chat](), [Network Operations]() Tags: [4g](), [5g](), [agentic](), [agentic-workflows](), [ai](), [ai-assistants](), [ai-model](), [ai-services](), [analysis](), [analyst](), [applications](), [artificial-intelligence](), [guest-post](), [measurement](), [network](), [network-operations](), [network-traffic](), [operations](), [packet](), [pcap](), [scale](), [tech-matters](), [traffic]() ### AI overview PCAP-LM makes packet captures small enough for an AI model to read in full by translating each conversation into compact PacketGlyphs that preserve direction, type, size, and timing while dropping payloads and other detail. It folds repeated patterns and combines frequent symbols. In tests on 30 captures from a 5G/4G measurement campaign, the rewritten files averaged about 800 times smaller than detailed Wireshark command-line text, and a model answered ten forensic questions with 99.3% accuracy. Conventional text truncated to the same length yielded 51%, partly because it exposed only the first few dozen packets. The tests covered large encrypted downloads from one server; retransmissions were missed in about a quarter of affected captures. PCAP-LM omits payload contents, sequence numbers, and exact timings, and encrypted content remains opaque. A side-index can point analysts or AI tools to original frames for follow-up. The excerpt proposes local address and hostname substitution before sharing and suggests testing other protocols, which may require new symbols or vocabulary training. ### Source excerpt Guest Post: Packet captures are the ground truth of network operations, but analysing them is slow, requires specialist expertise, and does not scale. PCAP-LM rewrites captures into a form that AI assistants can read, helping address that mismatch. ## CVE-2026-116783 - FreeSWITCH mod\_spandsp: out-of-bounds write parsing UDPTL error-recovery data DevFeed: [CVE-2026-116783 - FreeSWITCH mod\_spandsp: out-of-bounds write parsing UDPTL error-recovery data]() Original publisher: [Read original article]() Author: CVEFEED.io; github.com Published: 2026-11-05T20:17:45Z Content type: news Language: en Sources: [Latest High/Critical Vulnerabilitiy Feed]() Topics: [FreeSWITCH](), [Memory Safety]() Tags: [2026](), [applications](), [arrays](), [call](), [corruption](), [crash](), [cve](), [cve-2026-116783](), [error](), [fixed](), [freeswitch](), [gateway](), [memory](), [out-of-bounds-write](), [packet](), [parsing](), [peer](), [recovery](), [remote-code-execution](), [signalwire](), [write]() ### AI overview Before FreeSWITCH 1.11.2, mod_spandsp's UDPTL parser used a peer-controlled FEC entry count to write error-recovery data into five-entry arrays and retained an oversized count for a later reconstruction pass. A peer able to send UDPTL to an established T.38 fax session can reach the parser, including through fax applications or a T.38 gateway. The memory corruption can crash FreeSWITCH and terminate all active calls; remote code execution has not been demonstrated. The issue is fixed in version 1.11.2. ### Source excerpt CVE ID :CVE-2026-116783 Published : Nov. 5, 2026, 8:17 p.m. | 51 minutes ago Description :FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, udptl_rx_packet() used a peer-controlled FEC entry count directly to fill five-entry FEC arrays in a mod_spandsp T.38 session. A larger count wrote sender-controlled error-recovery data beyond those arrays and persisted the oversized count for a later reconstruction pass. Any peer able to deliver UDPTL to an established T.38 fax session can reach the parser, including deployments using fax applications or a T.38 gateway. The memory corruption can crash FreeSWITCH and end every active call, although remote code execution has not been demonstrated. This issue is fixed in version 1.11.2. Severity: 8.2 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more... ## Bridging the Digital Divide: 25 Years of Empowerment in Panama DevFeed: [Bridging the Digital Divide: 25 Years of Empowerment in Panama]() Original publisher: [Read original article]() Author: Rebeca De La Vega Published: 2026-11-05T15:00:27Z Content type: article Language: en Sources: [Cisco Blogs]() Topics: [Learning](), [cisco networking](), [digital]() Tags: [anniversary](), [ccna](), [certification](), [cisco-networking-academy](), [digital](), [digital-divide](), [digital-skills](), [education](), [engineering](), [equity](), [future](), [graduation](), [hackathons](), [institutions](), [lab](), [learn-with-cisco](), [networks](), [packet](), [partnership](), [requirements](), [standard]() ### AI overview Cisco Networking Academy in Panama grew from its first academy in 2000 into a nationwide technical education program. Packet Tracer gave students simulated lab experience, and a partnership with the Technological University of Panama made CCNA certification a graduation requirement for Systems Engineering students. The academy also expanded through partnerships with INADEH, ITSE, Universidad Latina de Panama, and Universidad Tecnologica Oteima. Community networks in indigenous areas and national hackathons extended digital skills training. The source reports more than 50,000 skilled, certified students, alongside updated curriculum and participation in regional Cyber Games. ### Source excerpt Cisco Networking Academy celebrates its 25-year presence in Panama. From partnering with indigenous communities to setting new educational standards for technical education, we're bridging the country's digital divide one certification at a time. ## Rondo: Controlling Reordering in High-Throughput Packet Spraying DevFeed: [Rondo: Controlling Reordering in High-Throughput Packet Spraying]() Original publisher: [Read original article]() Author: Xizhi Zhang, Zhongjie Chen, Yang Zhang, Fengyuan Ren Published: 2026-11-04T05:00:00Z Content type: article Language: en Sources: [arXiv: Networking]() Topics: [systems](), [performance-engineering](), [queueing theory]() Tags: [abstract](), [aggregate](), [applications](), [arxiv](), [bandwidth](), [based](), [capacity](), [challenges](), [control](), [controller](), [cs-ni](), [datacenter](), [delay](), [demand](), [design](), [either](), [existing](), [experiments](), [exploit](), [packet](), [throughput]() ### AI overview Rondo targets two causes of packet reordering in packet spraying: transient queueing differences between paths and persistent path-delay differences. It combines an ACK-based multipath controller, which estimates per-path capacity and probes to stabilize path loads, with a packet scheduler that reorders transmissions to compensate for persistent delay differences. The abstract reports testbed and large-scale simulation results: up to 97.5% lower maximum out-of-order degree while maintaining high throughput, and up to 8.51x higher goodput with constrained receiver buffers. ### Source excerpt arXiv:2611.04594v1 Announce Type: new Abstract: Modern datacenter applications demand high network bandwidth, motivating packet-level multipath transport to exploit the aggregate capacity of multiple paths. However, packet reordering under packet spraying poses challenges for hardware transports. Excessive packet reordering makes it difficult to infer packet loss, imposes substantial pressure on NIC resources, and ultimately degrades performance. Existing transports either prioritize throughput without controlling packet reordering, or mitigate reordering by restricting transmissions, which leaves available path capacity unused. In this paper, we identify two fundamental sources of packet reordering: transient inter-path queueing differences caused by control dynamics, and persistent path-delay differences due to path heterogeneity. These observations motivate a joint design of a multipath controller and a packet scheduler to address transient and persistent delay differences, respectively. We present Rondo, a packet-level multipath transport that achieves both high throughput and low packet reordering. Its multipath controller uses ACK-based per-path capacity estimation and probing to maintain stable path loads, while its packet scheduler adjusts packet transmission order to compensate for persistent delay differences. Testbed experiments and large-scale simulations show that Rondo reduces the maximum out-of-order degree by up to 97.5% while maintaining high throughput. With constrained receiver buffers, Rondo achieves up to 8.51 times higher goodput. ## CVE-2026-114550 - libwebsockets MQTT Protocol PUBACK Packet Handling Out-Of-Bounds Write Remote Code Execution Vulnerability DevFeed: [CVE-2026-114550 - libwebsockets MQTT Protocol PUBACK Packet Handling Out-Of-Bounds Write Remote Code Execution Vulnerability]() Original publisher: [Read original article]() Author: cvefeed.io Published: 2026-11-04T00:17:22Z Content type: article Language: en Sources: [Latest High/Critical Vulnerabilitiy Feed]() Topics: [Memory Safety](), [MQTT]() Tags: [2026](), [code-execution](), [cve](), [cve-2026-114550](), [mqtt](), [out-of-bounds-write](), [packet](), [protocol](), [remote](), [remote-code-execution]() ### AI overview CVE-2026-114550 is reported as a high-severity (8.1) out-of-bounds write in libwebsockets' handling of MQTT PUBACK packets. The description says remote attackers need no authentication and may exploit insufficient validation of supplied data to execute code in the current process. The excerpt lists no affected products or versions and gives no remediation details. ### Source excerpt CVE ID :CVE-2026-114550 Published : Nov. 4, 2026, 12:17 a.m. | 40 minutes ago Description :libwebsockets MQTT Protocol PUBACK Packet Handling Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of libwebsockets. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of PUBACK packets. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-31039. Severity: 8.1 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more... ## Ordered Chaos: Towards Adaptive Multipath Load Balancing with Precise Fast Loss Detection DevFeed: [Ordered Chaos: Towards Adaptive Multipath Load Balancing with Precise Fast Loss Detection]() Original publisher: [Read original article]() Author: Tommaso Bonato, Ahmad Ghalayini, Nadeen Gebara, Benoit Pit-Claudel, Jiayong Li, Mikhail Khalilov, Luca Piccolboni, Waleed Reda, Pei-Huan Tsai, Tao Ji, Abdul Kabbani, Torsten Hoefler Published: 2026-11-02T05:00:00Z Content type: article Language: en Sources: [arXiv: Networking]() Topics: [Load Balancing]() Tags: [adaptive](), [ai](), [collective](), [cs-ni](), [detection](), [dpu](), [ecmp](), [fast](), [flow](), [hpc](), [load-balancing](), [packet](), [prototype](), [reactive](), [routing](), [semantics](), [simulations](), [structure](), [time](), [timeout](), [training]() ### AI overview Ordered Chaos aims to combine fine-grained multipath load balancing with fast loss detection in best-effort datacenter networks. Its Reactive Subflow Spraying (RSS) divides flows into ordered subflows routed dynamically; Precise Fast Loss Detection (PFLD) uses that ordering plus probes to distinguish reordering from congestion, corruption, tail, and retransmission losses within one RTT. The abstract contrasts this with ECMP's coarse use of path diversity and packet spraying's loss of ordering signals. Across simulations, AI and HPC workloads, and a DPU prototype, RSS+PFLD reportedly improves tail flow completion time by up to 3x, eliminates up to 99% of timeout-based recoveries, and accelerates collective and training communication by up to 35%. ### Source excerpt arXiv:2610.41707v1 Announce Type: new Abstract: Load balancing in best-effort datacenter fabrics faces a tradeoff. Order-preserving schemes such as Equal-Cost Multipath (ECMP) retain loss semantics but use path diversity coarsely, while packet spraying balances load well but removes the ordering signals needed for fast, precise loss detection. We present Ordered Chaos, an end-host design that preserves enough structure for reliable loss detection without giving up fine-grained multipath routing. Reactive Subflow Spraying (RSS) divides each flow into ordered, dynamically routed subflows. Precise Fast Loss Detection (PFLD) combines this ordering with probes to distinguish reordering from congestion, corruption, tail, and retransmission losses within one RTT. Across simulations, AI and HPC workloads, and a DPU prototype, RSS+PFLD improves tail flow completion time by up to $3\times$, eliminates up to 99% of timeout-based recoveries, and accelerates collective and training communication by up to 35%. ## ARK: Avoiding Routing Collisions for KV Cache Transfer in Disaggregated LLM Inference DevFeed: [ARK: Avoiding Routing Collisions for KV Cache Transfer in Disaggregated LLM Inference]() Original publisher: [Read original article]() Author: Hung-Chun Lin, Ting-Wei Hsu, Chung-En Ho, Ahmed Saeed Published: 2026-11-02T05:00:00Z Content type: article Language: en Sources: [arXiv: Artificial Intelligence](), [arXiv: Distributed Computing](), [arXiv: Networking]() Topics: [LLM optimization](), [Internet Traffic]() Tags: [bandwidth](), [cache](), [concurrent](), [cs-ai](), [cs-dc](), [cs-ni](), [decode](), [distributed](), [ecmp](), [flow](), [gpu](), [hash](), [inference](), [kv-cache](), [lightweight](), [link](), [llm](), [llm-inference](), [load](), [mechanism](), [packet](), [persistence](), [routing]() ### AI overview In disaggregated LLM inference, long-lived KV-cache transfers can collide under stateless ECMP, overloading some spine links while leaving others underused. ARK coordinates senders to reserve paths by selecting source ports that hash concurrent flows onto distinct spines. The abstract says this requires no switch changes or receiver-side packet reordering, and that lightweight coordination can be amortized across these long transfers. Packet-level RDMA simulations report reductions under moderate load of up to 27.3% in mean flow completion time (FCT), 34.0% in P95 FCT, and 12.9% in mean time to first token (TTFT). These are reported simulation results, not evidence of deployment performance. ### Source excerpt arXiv:2610.41160v1 Announce Type: cross Abstract: Disaggregated LLM inference separates the prefill and decode phases across GPU pools, generating massive KV-cache transfers. Because these transfers last hundreds of milliseconds to seconds, they behave as mega elephant flows that dominate link bandwidth utilization. In this regime, stateless ECMP can perform poorly: hash collisions may overload one spine link while leaving others idle, stretching transfer times by seconds. Yet this same persistence makes coordination practical. Since these flows are long-lived, even lightweight one-to-all coordination can be amortized over their lifetime. We present ARK, a distributed elephant-flow path reservation mechanism. ARK coordinates senders to choose source ports whose hashes map concurrent flows onto distinct spines, without requiring switch changes or receiver-side packet reordering. Packet-level RDMA simulations show that ARK reduces mean and P95 FCT by up to 27.3% and 34.0% under moderate load, and further reduces mean TTFT by up to 12.9%. ## DeepWeave: Weaving Neural and Symbolic Evidence for ML-Based Network Intrusion Detection System DevFeed: [DeepWeave: Weaving Neural and Symbolic Evidence for ML-Based Network Intrusion Detection System]() Original publisher: [Read original article]() Author: Raoul Saad, Enkeleda Bardhi, Andrea Agiollo, Fernando Kuipers Published: 2026-11-02T05:00:00Z Content type: article Language: en Sources: [arXiv: Cryptography and Security](), [arXiv: Machine Learning](), [arXiv: Networking]() Topics: [Detection engineering](), [Machine learning](), [Neural Network](), [Artificial Intelligence](), [network-intelligence]() Tags: [alerts](), [cs-cr](), [cs-lg](), [cs-ni](), [false-positive-rate](), [flow](), [hybrid](), [inference](), [intrusion-detection](), [logic](), [ml](), [network](), [neural](), [packet](), [probabilistic](), [proofs](), [robustness](), [rules]() ### AI overview DeepWeave combines probabilistic neural predictions with automatically constructed and validated interpretable rules, reconciling their evidence through explicit policies across packet, flow, and hybrid views. Its proofs explain alerts supported by rules. In the reported evaluation across multiple datasets, with 50 labeled packet observations per attack class, it raised macro-F1 from 0.632 to 0.924 and lowered attack false-positive rate from 0.075 to 0.008 versus a matched neural baseline. The abstract also reports more stable proofs than post-hoc neural attributions and practical probabilistic reasoning through batched inference. These are abstract-level claims; details of datasets and evaluation are not provided in the supplied text. ### Source excerpt arXiv:2610.41541v1 Announce Type: new Abstract: Machine learning-based network intrusion detection systems can recognize complex traffic patterns, but often require substantial labelled attack data, degrade under deployment shift, and provide limited evidence for analysts. We present DeepWeave, a probabilistic neuro-symbolic Network Intrusion Detection System (NIDS) that makes logic an integral part of detection. DeepWeave automatically constructs and validates interpretable rules, represents neural predictions as probabilistic predicates, and reconciles both evidence sources through explicit coupling policies over packet-, flow-, and hybrid-views. The resulting proofs provide intrinsic explanations for rule-supported alerts. Across multiple datasets, DeepWeave improves low-data detection, false-positive control, transferability, and robustness. With only 50 labelled packet observations per attack class, it improves macro-F1 from 0.632 to 0.924 and reduces the attack false-positive rate from 0.075 to 0.008 over the matched neural baseline. Its proofs are also more stable than post-hoc neural attributions, while batched inference keeps probabilistic reasoning practical. These results demonstrate label-efficient, adaptable, and inspectable neuro-symbolic intrusion detection. ## NetClaw returns to Packet Pushers DevFeed: [NetClaw returns to Packet Pushers]() Original publisher: [Read original article]() Author: John Capobianco Published: 2026-10-30T12:00:00Z Content type: article Language: en Sources: [Automate Your Network]() Topics: [AI Networking](), [Automation](), [Network Operations](), [Fair Source](), [Sports](), [Frontier AI]() Tags: [2019](), [3](), [about](), [agent](), [agents](), [air](), [air-gapped](), [architecture](), [automate](), [automation](), [banks](), [community](), [contributors](), [john](), [john-capobianco](), [netclaw](), [network](), [network-automation](), [networking](), [packet](), [social]() ### AI overview The author says NetClaw makes network automation easier to try: instead of months of book study and lab work, users can add eight lines of JSON to an agent. The project has three co-maintainers, 16+ contributors, more than 200 documented specs, and integrations being built and tested by named network vendors. Its safety approach includes a "soul file" of operational rules and explicit approval for production actions beyond reads; the author also cites Cisco DefenseClaw and NVIDIA OpenShell as additional protection. NetClaw supports frontier or air-gapped open-weight models, including on Raspberry Pi, and offers a VS Code extension plus mobile and watch access. The author recommends starting read-only in a lab. These are claims from the supplied excerpt. ### Source excerpt John Capobianco - LinkedIn - John reflects on NetClaw's community, its contributors, and making useful network automation easier to try alongside the new Heavy Networking episode. ## SweepSketch: Detecting Carpet-Bombing Attacks Before They End DevFeed: [SweepSketch: Detecting Carpet-Bombing Attacks Before They End]() Original publisher: [Read original article]() Author: Yutong Yan, Sijia Du, Haowei Wang, Bo Yang Published: 2026-10-30T04:00:00Z Content type: article Language: en Sources: [arXiv: Cryptography and Security]() Topics: [network-intelligence](), [Internet Traffic](), [implementation](), [control-plane]() Tags: [c-plus-plus](), [control-plane](), [cs-cr](), [ddos](), [dpu](), [hyperloglog](), [packet](), [security](), [state](), [training]() ### AI overview SweepSketch detects carpet-bombing DDoS attacks while they are still underway by measuring traffic per distinct destination, avoiding unreliable source-side state and training. A tagged self-cleaning windowed HyperLogLog feeds per-packet CUSUM decisions and dual EWMA gates. The reference state uses 512 KB; its bit-exact C++ implementation reaches 13.2 Mpps per core. It alarms before the end of 95.6% of evaluated 0.5-second attacks, and 49.3% of real-capture attacks trigger an alarm within one second; static and mixed-traffic F1 are both 0.991. Hardware implementations differ: Tofino2 runs the per-packet state chain but places final gates on the control plane, while a DPU micro-engine keeps the full decision chain in the fast path. ### Source excerpt arXiv:2609.33308v3 Announce Type: replace Abstract: Carpet-bombing DDoS attacks spread traffic almost uniformly across a destination prefix, keeping each host below alarm thresholds while exhausting prefix-level resources; spoofed sources make source-side evidence unreliable. Existing detectors either decide on windows of seconds, alarming only at window boundaries, or depend on supervised training, so short attacks often end before the first alarm. We present SweepSketch, a destination-anchored, per-packet sketch detector that keeps no source-side state, needs no training, and alarms while the attack is still in progress. Its core is a tagged self-cleaning windowed HyperLogLog (T-HLL) that turns uniformity testing into one event per distinct destination per window; per-packet cumulative-sum (CUSUM) decisions and dual exponentially weighted moving average (EWMA) gates form the decision chain. The reference state occupies 512 KB, and a bit-exact C++ implementation reaches 13.2 Mpps per core. On attacks lasting only 0.5 s, it raises its first alarm before the attack ends in 95.6% of attacks; on real captures, 49.3% alarm within the first second; static and mixed-traffic F1 both reach 0.991. SweepSketch is deployed in two hardware forms: a Tofino2 program carries the complete per-packet state chain and places the final gates on the control plane, while a DPU micro-engine keeps the entire decision chain in the fast path. ## Opportunistic Optical Link Scheduling in the Scalable Matching Model DevFeed: [Opportunistic Optical Link Scheduling in the Scalable Matching Model]() Original publisher: [Read original article]() Author: Marcos T. Henriques, Olga Goussevskaia Published: 2026-10-30T04:00:00Z Content type: article Language: en Sources: [arXiv: Networking]() Topics: [communications](), [scheduling]() Tags: [abstraction](), [circuit](), [communication](), [costs](), [cs-ni](), [data](), [data-center](), [datacenter](), [infrastructure](), [leveraging](), [lightweight](), [link](), [matching](), [model](), [network](), [networks](), [ocs](), [packet](), [patterns](), [performance](), [scheduling]() ### AI overview Opportunistic Optical Link Scheduling (OOLS) uses idle optical circuit switch resources to augment bounded-degree reconfigurable datacenter networks in the Scalable Matching Model. The motivation is that when each switch has far fewer ports than the network has switches, these topologies may leave much of the optical infrastructure unused, especially under skewed, bursty traffic. Simulations with synthetic and real-world data-center workloads report lower communication costs and higher throughput. The abstract gives no quantified gains or details of the scheduling routines. ### Source excerpt arXiv:2610.38004v1 Announce Type: new Abstract: The Scalable Matching Model (SMM) is a useful abstraction for reconfigurable datacenter networks. In SMM, a set of $n$ (Top-of-Rack) electrical packet switches is connected via a set of optical circuit switches (OCS), each realizing a $p \times p$ matching, where $p$ is the number of ports per switch. In the case when $p \ll n$, bounded-degree networks utilize only a small portion of the OCS infrastructure at each point in time, especially when traffic patterns are skewed and bursty. In this work, we propose the Opportunistic Optical Link Scheduling (OOLS), a set of lightweight OCS link scheduling routines, designed to augment bounded-degree reconfigurable network topologies by leveraging idle OCS resources. We evaluate the performance of OOLS in the SMM through simulations, using synthetic and real-world data-center workloads. Our simulation results show that OOLS substantially improves performance, lowering communication costs and boosting throughput. ## A new lightweight, hybrid routing mesh protocol for packet radios DevFeed: [A new lightweight, hybrid routing mesh protocol for packet radios]() Original publisher: [Read original article]() Author: Anne Barela Published: 2026-10-28T15:07:08Z Content type: news Language: en Sources: [Adafruit Industries]() Topics: [mesh networking](), [meshtastic]() Tags: [bluetooth](), [c-plus-plus](), [devices](), [distributed-mesh-network](), [embedded](), [github](), [hybrid](), [internet](), [library](), [lightweight](), [lora](), [mesh](), [meshcore](), [meshtastic](), [messages](), [packet](), [protocol](), [radio](), [range](), [raspberry-pi](), [relay](), [reticulum](), [routing](), [software](), [video]() ### AI overview MeshCore is a lightweight C++ library for multi-hop routing over LoRa and other packet radios: nodes relay messages so devices can communicate beyond a single radio link without internet access. The excerpt positions it between Meshtastic's casual LoRa messaging and Reticulum's deeper networking features, with custom embedded projects and off-grid or emergency use as its focus. Prebuilt binaries are available for supported devices. Setup options described include flashing with tools such as Adafruit ESPTool, reaching the network through a serial console, and companion firmware connections over BLE, USB, or Wi-Fi depending on the build. Repeater and room server firmware can be configured over USB in a web tool or remotely over LoRa from the mobile app. ### Source excerpt Seeed Studio has posted MeshCore on GitHub, a lightweight C++ library that handles multi-hop packet routing for embedded projects using LoRa and other packet radios. Nodes relay messages through each other, so devices can reach far past the range of a single radio link without any internet connection. MeshCore sits between Meshtastic and Reticulum. Meshtastic [...] ## ZDI-26-829: (0Day) (Pwn2Own) Alpine iLX-F511 Bluetooth OBEX Packet Handling Heap-based Buffer Overflow Remote Code Execution Vulnerability DevFeed: [ZDI-26-829: (0Day) (Pwn2Own) Alpine iLX-F511 Bluetooth OBEX Packet Handling Heap-based Buffer Overflow Remote Code Execution Vulnerability]() Original publisher: [Read original article]() Published: 2026-10-28T05:00:00Z Content type: news Language: en Sources: [Zero Day Initiative]() Topics: [heap overflow](), [Bluetooth]() Tags: [alpine](), [bluetooth](), [buffer-overflow](), [code-execution](), [heap](), [packet](), [pwn2own](), [remote-code-execution](), [root](), [vulnerability]() ### AI overview A physically present attacker can exploit improper length validation when Alpine iLX-F511 handles Bluetooth OBEX packets, causing a heap-based buffer overflow and potentially executing code as root. Authentication is not required. ZDI assigns a CVSS rating of 6.8 and identifies CVE-2026-118611. The advisory says the salient mitigation is to restrict interaction with the product. ### Source excerpt This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Alpine iLX-F511 devices. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 6.8. The following CVEs are assigned: CVE-2026-118611. ## Packet Interval Modulation-based NFC for Scalable IoT around Meandered E-textile DevFeed: [Packet Interval Modulation-based NFC for Scalable IoT around Meandered E-textile]() Original publisher: [Read original article]() Author: Shigemi Ishida, Ryo Takahashi, Satoshi Ido Published: 2026-10-28T04:00:00Z Content type: article Language: en Sources: [arXiv: Networking]() Topics: [Internet of things]() Tags: [asynchronous](), [cs-ni](), [e-textile](), [environmental-monitoring](), [iot](), [nfc](), [packet](), [textile](), [throughput]() ### AI overview The paper proposes asynchronous NFC using packet interval modulation to handle a changing number of sensor tags. Tags send minimal ID-only packets as pulses and encode data in the intervals between them, leaving the channel mostly unoccupied and reducing collisions compared with time-slotted ALOHA. In simulations, the method achieves four times the throughput of ALOHA with ten tags and maintains over 160 bps per tag when the number of tags fluctuates by more than 20. These are simulation results; the supplied excerpt does not describe a real-world evaluation. ### Source excerpt arXiv:2610.35870v1 Announce Type: new Abstract: Near-field communication (NFC) sensor tags are promising for low-cost, scalable environmental monitoring due to their battery-free, maintenance-free operation. Recent advances in NFC reader garments, integrated with conductive textile coils, allow users to interact seamlessly with tags scattered across their daily environment. However, dynamically identifying and reading out a fluctuating number of tags remains challenging. If multiple tags speak and collide, they must randomly retry until an empty slot is found. Standard NFC identifies tags using time-slotted ALOHA, which assigns tags to fixed time slots. If multiple tags speak and collide, they must retry with a tag filter to avoid collision until all tags are identified. This rigid setup is fragile in dynamic settings; as tags enter and leave the communication range, the heavy overhead of slot re-negotiation and inevitable collisions restricts data throughput. Here, we propose an asynchronous NFC based on packet interval modulation. By treating minimal ID-only packets as pulses and encoding data in their intervals, we enable communication through silence. This ensures the channel remains mostly unoccupied, drastically reducing collisions even in high-density environments. Our simulations show that for ten tags, our method achieves a 4-fold increase in throughput compared to the ALOHA approach. Furthermore, the system remains robust, maintaining over 160 bps/tag throughput even under extreme fluctuations in the number of tags over 20. ## HqcLethe: Streaming HQC Encapsulation for Tiny Stateless Servers DevFeed: [HqcLethe: Streaming HQC Encapsulation for Tiny Stateless Servers]() Original publisher: [Read original article]() Author: Wind Wong, Klaus v. Gleissenthall Published: 2026-10-28T04:00:00Z Content type: article Language: en Sources: [arXiv: Cryptography and Security]() Topics: [Post-quantum cryptography](), [Cryptography](), [stateless]() Tags: [authentication](), [client](), [cpu](), [cs-cr](), [fixed](), [handshake](), [hedge](), [independent](), [lattice](), [masks](), [memory](), [nist](), [packet](), [packets](), [pi](), [post-quantum](), [puzzles](), [raspberry-pi](), [servers](), [stateless](), [streaming]() ### AI overview HqcLethe streams an HQC encapsulation in packet-sized pieces, enabling a stateless post-quantum key exchange without buffering multi-packet handshakes. It uses the Chinese remainder theorem to split cyclic polynomial multiplication into per-packet remainders and masks them so they reveal no more than an ordinary HQC ciphertext; the authors report proving this in Rocq with SSProve and verifying session secrecy, server authentication, and forward secrecy in ProVerif. Client puzzles bound CPU exhaustion, while each worker used a fixed 1.2-1.6 MiB on a Raspberry Pi 3B+. At category 5, the abstract reports 27 times fewer bytes and 9 times less server CPU than McTiny. ### Source excerpt arXiv:2610.36808v1 Announce Type: new Abstract: Stateless post-quantum authenticated key exchanges such as post-quantum WireGuard hedge against unexpected cryptanalytic advances by combining a lattice KEM with code-based Classic McEliece. However, recent attacks have led Germany's BSI to advise against McEliece, which leaves these protocols with lattices alone. HQC, the code-based KEM that NIST selected, could restore diversity, but its keys do not fit in a single packet, so a server would have to buffer multi-packet handshakes. This would leave an attack surface for memory exhaustion, which is what WireGuard's stateless handshake was designed to avoid in the first place. McTiny demonstrated that stateless key encapsulation for Classic McEliece is possible by streaming key blocks one-at-a-time. However, HQC's encapsulation does not split as easily into individual packets, as cyclic polynomial multiplication, unlike matrix-vector multiplication, is inherently non-local. We present HqcLethe, a stateless key exchange that streams an HQC encapsulation in packet-sized pieces. It uses the Chinese remainder theorem to split the polynomial multiplication into independent remainders, one per packet, and masks them so that they reveal no more than an ordinary HQC ciphertext, which we prove in Rocq with SSProve; we also verify session secrecy, server authentication and forward secrecy in ProVerif. Client puzzles bound CPU exhaustion, and HqcLethe removes memory exhaustion: on a Raspberry Pi 3B+, each worker runs in a fixed 1.2-1.6 MiB. At category 5 it sends 27x fewer bytes and uses 9.0x less server CPU than McTiny, the earlier stateless code-based design. ## Wavelet Phase Diffusion for Structurally and Semantically Consistent Sim-to-Real Translation DevFeed: [Wavelet Phase Diffusion for Structurally and Semantically Consistent Sim-to-Real Translation]() Original publisher: [Read original article]() Author: Kaiwen Wang, Frank Bieder, Yinzhe Shen, Carlos Fernandez, Jan-Hendrik Pauls, Omer Sahin Tas Published: 2026-10-28T04:00:00Z Content type: article Language: en Sources: [arXiv: Artificial Intelligence]() Topics: [Image processing](), [fourier analysis](), [fourier transform](), [Image](), [stable-diffusion]() Tags: [adaptive](), [consistency](), [cs-ai](), [decoupling](), [diffusion](), [eess-iv](), [image](), [inference](), [lfr](), [locality](), [model](), [open](), [overhead](), [packet](), [packets](), [planner](), [quality](), [real-world](), [reality](), [semantic](), [sim-to-real](), [translation]() ### AI overview Wavelet Phase Diffusion (ψ-PD) uses localized Dual-Tree Complex Wavelet Packet Transform packets for spatially adaptive phase injection, reducing the ringing and boundary leakage associated with global Fourier coupling. Low-Frequency Randomization replaces the low-frequency packet to reduce dependence on synthetic illumination. The two components train on unpaired open-domain data with negligible inference overhead, and the method supports translating individual objects or regions while leaving the surrounding scene unchanged. On vKITTI-to-KITTI image translation, ψ-PD reportedly improves realism and semantic consistency over prior methods while maintaining competitive structural alignment. On CARLA video translation, it approaches paired-data realism and reduces VLM planner ADE and FDE by 5.4% and 5.1%, respectively. ### Source excerpt arXiv:2607.21628v3 Announce Type: replace Abstract: Simulation-to-reality translation must bridge the appearance gap between synthetic and real domains while preserving structural and semantic consistency. Conditioning-based methods achieve spatial alignment but introduce computationally expensive control modules. Paired-data methods achieve realism but rely on complex synthesis pipelines, often altering scene geometry and semantics. Training-free editing methods avoid both constraints but lack a learned appearance prior, limiting their perceptual quality. Recently proposed phase-preserving diffusion presents a promising alternative, but Fourier-domain formulations are constrained by global spectral coupling. This coupling induces spatial artifacts such as ringing and boundary leakage, thereby degrading structural and semantic consistency. We introduce Wavelet Phase Diffusion, which addresses this through two components. First, we operate in the Dual-Tree Complex Wavelet Packet Transform domain, whose localized wavelet packets enable spatially adaptive phase injection without global spectral interference. Second, Low-Frequency Randomization (LFR) replaces the low-frequency packet, decoupling the model from the synthetic illumination prior and enabling in-distribution real-world appearance. Both components train on unpaired open-domain data, and introduce negligible inference overhead. The spatial locality further enables instance-level translation, where individual objects or regions are translated to photorealistic appearance independently while the surrounding scene remains untranslated. On vKITTI $\to$ KITTI image translation, $\psi$-PD outperforms prior methods in realism and semantic consistency while maintaining competitive structural alignment. For CARLA video translation, $\psi$-PD approaches the realism of paired-data methods while reducing VLM planner ADE and FDE by $5.4\%$ and $5.1\%$, respectively. ## ZDI-26-792: libwebsockets MQTT Protocol PUBACK Packet Handling Out-Of-Bounds Write Remote Code Execution Vulnerability DevFeed: [ZDI-26-792: libwebsockets MQTT Protocol PUBACK Packet Handling Out-Of-Bounds Write Remote Code Execution Vulnerability]() Original publisher: [Read original article]() Published: 2026-10-26T05:00:00Z Content type: news Language: en Sources: [Zero Day Initiative]() Topics: [MQTT](), [Memory Safety](), [Exploit]() Tags: [code-execution](), [mqtt](), [out-of-bounds-write](), [packet](), [protocol](), [remote](), [remote-code-execution](), [remote-code-execution-vulnerability](), [vulnerability]() ### AI overview An input-validation flaw in libwebsockets' handling of MQTT PUBACK packets can write past an allocated buffer, allowing unauthenticated remote attackers to execute code in the current process. The advisory says libwebsockets has issued an update to correct the vulnerability (CVE-2026-114550; CVSS 8.1). ### Source excerpt This vulnerability allows remote attackers to execute arbitrary code on affected installations of libwebsockets. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.1. The following CVEs are assigned: CVE-2026-114550. ## Peregrine: A Language-Agnostic Packet Processing Intermediate Representation with Formal Guarantees DevFeed: [Peregrine: A Language-Agnostic Packet Processing Intermediate Representation with Formal Guarantees]() Original publisher: [Read original article]() Author: Sean Rhee, Xiangyu Gao, Srinivas Narayana, Nate Foster, Joseph Tassarotti, Anirudh Sivaraman Published: 2026-10-26T04:00:00Z Content type: article Language: en Sources: [arXiv: Networking]() Topics: [Programming Languages / Compilers](), [Compiler](), [domain-specific language](), [Coq](), [Automated reasoning]() Tags: [algorithms](), [applications](), [classification](), [compilation](), [compiler](), [cs-ni](), [developers](), [devices](), [domain-specific-languages](), [dsl](), [dsls](), [ecosystem](), [experimental](), [formal](), [guarantees](), [infrastructure](), [intermediate](), [language](), [languages](), [packet](), [processing]() ### AI overview Peregrine is a proposed shared, language-agnostic intermediate representation for packet-processing compilers, intended to address fragmented infrastructure and unreliable compilation across programmable network DSLs. It includes formal semantics and an equivalence checker implemented and proven correct in Rocq. The abstract reports that Peregrine can express applications from several state-of-the-art network languages, and that its checker can validate untrusted compiler passes and certify packet-classification algorithms within a reasonable amount of time. The supplied evidence does not detail the experiments or performance limits. ### Source excerpt arXiv:2610.32639v1 Announce Type: new Abstract: Many different programmable network devices and domain-specific languages (DSLs) for programming them have been developed in recent years. However, the affiliated compiler infrastructure for each DSL has not kept up, leading to unreliable compilation results and ultimately a poor experience for developers. In response to this fragmented ecosystem, we propose an intermediate representation, Peregrine, to consolidate the common compiler functionalities within this domain into a shared, open-source infrastructure. We designed Peregrine to provide formal guarantees from the beginning, rather than adding them in a later step. The language comes with a formal semantics, along with an equivalence checker written and proven correct in Rocq. Experimental results show that Peregrine is general enough to express multiple applications written in various state-of-the-art network programming languages. The equivalence checker designed in Peregrine can be used for validating the correctness of a range of untrusted compiler passes, as well as for other surprising use cases such as certifying the correctness of packet classification algorithms within a reasonable amount of time. ## CVE-2026-79982 - Out-of-bounds write in the USB Bluetooth HCI transport class when a controller-to-host HCI packet exceeds the bulk endpoint maximum packet size DevFeed: [CVE-2026-79982 - Out-of-bounds write in the USB Bluetooth HCI transport class when a controller-to-host HCI packet exceeds the bulk endpoint maximum packet size]() Original publisher: [Read original article]() Author: cvefeed.io Published: 2026-10-23T20:17:28Z Content type: article Language: en Sources: [Latest High/Critical Vulnerabilitiy Feed]() Topics: [Memory Safety](), [Bluetooth](), [Bluetooth LE]() Tags: [2026](), [bluetooth](), [cve-2026-79982](), [hci](), [net](), [packet](), [size](), [transport](), [usb](), [write](), [zephyr](), [zephyrproject]() ### AI overview In the USB Bluetooth HCI transport, bt_hci_tx_sync_in() copies controller-to-host packets into fixed-size transfer slots without checking packet length. On full-speed-only builds, a slot is 64 bytes, while HCI event or ACL buffers can be larger, so the copy can overwrite adjacent memory. The excerpt says a mandatory 70-byte Read Supported Commands event triggers a six-byte overflow at each host initialization; Bluetooth traffic can also reach the vulnerable path through ACL fragments or extended advertising reports. With assertions disabled, the overwrite can corrupt memory and may enable code execution on targets lacking subsystem memory protection; with assertions enabled, it instead triggers a panic and denial of service. The described fix uses a separate transmit pool sized for the larger configured HCI buffers, while retaining the endpoint-sized pool for host-to-device traffic. ### Source excerpt CVE ID :CVE-2026-79982 Published : Oct. 23, 2026, 8:17 p.m. | 1 hour, 29 minutes ago Description :The Bluetooth HCI USB transport class of the new USB device stack, subsys/usb/device_next/class/bt_hci.c, copies every controller-to-host HCI packet into a USB transfer buffer before enqueuing it on an endpoint. bt_hci_tx_sync_in() allocated that buffer from bt_hci_ep_pool, a fixed pool whose slots are only USBD_MAX_BULK_MPS bytes (64 on full-speed-only builds), and then performed net_buf_add_mem(buf, bt_buf->data, bt_buf->len) with no length check. HCI event and ACL buffers are sized by CONFIG_BT_BUF_EVT_RX_SIZE and CONFIG_BT_BUF_ACL_RX_SIZE and can be far larger, so the copy runs past the end of the 64-byte slot into the adjacent slots and into whatever follows the statically allocated pool. The device runs the local Bluetooth controller in raw HCI mode (CONFIG_BT_HCI_RAW), so the oversized packets originate over the air. With the HCI buffer sizes recommended for full-featured controllers, an unauthenticated attacker within Bluetooth range can supply the overflowing bytes: a connected peer that negotiates Data Length Extension can send ACL fragments up to CONFIG_BT_CTLR_DATA_LENGTH_MAX bytes, and an attacker that merely broadcasts extended advertising data reaches the same path through LE Extended Advertising Report events, which the controller fragments only to CONFIG_BT_BUF_EVT_RX_SIZE. In the stock configuration the overflow is already reached without any radio traffic: the mandatory Read Supported Commands command-complete event is 70 bytes and overruns the 64-byte slot by six bytes on every host initialization. Because net_buf_add_mem() validates tailroom only through an assertion unless CONFIG_NET_BUF_HARDENING is enabled, builds with CONFIG_ASSERT=n -- the usual production setting -- silently corrupt memory adjacent to the USB buffer pool with attacker-chosen contents, which on a target without memory protection between subsystems can lead to arbitrary code execu ## SpraySense: Sensing Gray Failures through Packet Spraying Discrepancies DevFeed: [SpraySense: Sensing Gray Failures through Packet Spraying Discrepancies]() Original publisher: [Read original article]() Author: Jakob Krebs, Daniel Amir, Shir Landau Feibish, Mark Silberstein Published: 2026-10-23T04:00:00Z Content type: article Language: en Sources: [arXiv: Networking]() Topics: [AI Networking](), [distributed-training](), [Load Balancing](), [Monitoring]() Tags: [1-5](), [3](), [abstract](), [adaptive](), [also](), [application](), [arxiv](), [balancing](), [can](), [clusters](), [cs-ni](), [data](), [data-center](), [data-center-networks](), [debug](), [detection](), [distributed](), [effect](), [either](), [packet](), [sensing]() ### AI overview SpraySense passively detects and localizes gray network failures by combining statistical patterns in adaptive routing and load balancing with flow-level information. It observes traffic spraying without adding network load, aiming to identify failures early enough for preemptive rerouting. In a 64-spine topology running Llama-3 70B training, the authors report detecting and localizing a single-link packet drop rate of 1.5% within one iteration, and rates as low as 0.5% within five iterations. ### Source excerpt arXiv:2605.03702v2 Announce Type: replace Abstract: Distributed machine learning (ML) training has become a dominant workload in modern data center networks, operating at massive scale with clusters comprising tens to hundreds of thousands of GPUs. The scale of these networks makes failures, and particularly gray failures, inevitable. Gray failures can significantly degrade both network and application performance, yet they are notoriously difficult to detect, localize, and debug. To meet the performance demands of ML workloads, adaptive routing is widely deployed to maximize network utilization by dynamically spreading traffic across many paths. While adaptive routing increases network utilization, it also greatly intensifies the effect of gray failures. Prior work has either dismissed gray failures as negligible or proposed detection mechanisms that fail to scale, rendering these approaches increasingly impractical for large-scale clusters. We present SpraySense, a passive gray failure detection system that leverages the statistical properties of adaptive routing and network load balancing. By combining these properties with flow-level information, SpraySense can identify failures before they significantly impact application performance, enabling preemptive rerouting and improving overall performance. Importantly, this is achieved through passive observation of traffic spraying, without introducing additional load on the network. We evaluate SpraySense and show that it can detect and localize a single-link packet-drop-rate $1.5\%$ within a single iteration and as little as $0.5\%$ within 5 training iterations of Llama-3 70B in a 64 spine topology. ## Do Flow-Generation Tools Matter? Unsupervised Characterization of MQTT Traffic Across Public Datasets DevFeed: [Do Flow-Generation Tools Matter? Unsupervised Characterization of MQTT Traffic Across Public Datasets]() Original publisher: [Read original article]() Author: Mohammed Rashed, Carlos Garc\\'ia-Rubio, Celeste Campo Published: 2026-10-22T04:00:00Z Content type: article Language: en Sources: [arXiv: Cryptography and Security](), [arXiv: Networking]() Topics: [MQTT](), [clustering](), [Internet Traffic]() Tags: [characterization](), [clustering](), [cs-cr](), [cs-ni](), [datasets](), [evaluation](), [feature](), [flow](), [generation](), [mqtt](), [packet](), [performance](), [public](), [reduction](), [security](), [tools](), [traffic](), [zeek]() ### AI overview Flow-generation tools materially affect how MQTT traffic appears in flow-level clustering, so tool choice is an experimental factor alongside dataset and analysis settings. The study generated over 380,000 flows from packet captures in four public datasets using Zeek-flowmeter, Argus, and NTLFlowLyzer, then compared K-means, DBSCAN, and HDBSCAN with and without PCA. It evaluated clustering with Silhouette score and Adjusted Rand Index. Zeek-flowmeter performed best in several settings, especially K-means with PCA reduced to 10 components, but no tool consistently led across datasets, algorithms, and metrics. ### Source excerpt arXiv:2610.29774v1 Announce Type: cross Abstract: Message Queue Telemetry Transport (MQTT) is widely used in IoT environments due to its lightweight publish-subscribe design and suitability for resource-constrained networks. While current MQTT security studies mainly focus on detecting attacks and optimizing classification performance, this work takes a different perspective by presenting a cross-dataset, tool-aware characterization of MQTT traffic at the flow level. This perspective is motivated by the fact that flow-generation is tool-dependent: flows are not directly observed in packet captures, but are constructed through tool-specific decisions about packet grouping, flow termination, and feature export. Using packet captures from 4 public MQTT datasets, we generated over 380K flows with 3 open-access flow-generation tools: Zeek-flowmeter, Argus, and NTLFlowLyzer. We analyzed the tool-specific flows using K-means, DBSCAN, and HDBSCAN, with and without PCA-based dimensionality reduction. We measured clustering quality using 2 metrics: (1) Silhouette score to assess label-independent cluster compactness and separation, and (2) Adjusted Rand Index to measure agreement with available labels. Our results show that the choice of flow-generation tool affects the resulting flow population, feature-space structure, and clustering behavior. Zeek-flowmeter achieves the best performance in several settings, particularly with K-means and PCA reduction to 10 components. Yet, no single tool consistently dominates across all datasets, algorithms, and evaluation metrics. These findings show that flow-level MQTT analysis should treat the dataset, flow-generation tool, preprocessing choices, clustering algorithm, and evaluation metric as interconnected experimental factors. ## Dual-Mode Wireless Devices for Adaptive Pull and Push-Based Communication DevFeed: [Dual-Mode Wireless Devices for Adaptive Pull and Push-Based Communication]() Original publisher: [Read original article]() Author: Sara Cavallero, Fabio Saggese, Junya Shiraishi, Israel Leyva-Mayorga, Shashi Raj Pandey, Chiara Buratti, Petar Popovski Published: 2026-10-21T04:00:00Z Content type: article Language: en Sources: [arXiv: Networking]() Topics: [Network](), [Protocol (disambiguation)]() Tags: [adaptive](), [analysis](), [communication](), [cs-ni](), [data](), [devices](), [efficiency](), [energy](), [energy-efficiency](), [event-driven](), [framework](), [mac](), [mechanism](), [network](), [packet](), [performance](), [performance-metrics](), [protocol](), [query](), [radio](), [wireless]() ### AI overview The proposed framework combines query-driven pull responses with event-driven push reports in a shared time-frame structure. If a device detects an anomaly, it can preempt its regular query response; it can also proactively push critical data without waiting for a request. A wake-up radio and tailored MAC protocol support the traffic classes. The system-level analysis evaluates push-report success, pull-response success, and total energy, finding a trade-off between push and pull success as communication resources are allocated. The authors report up to 42% less energy per served packet than traditional approaches while supporting both modes; the excerpt does not specify the baseline or operating conditions for that maximum reduction. ### Source excerpt arXiv:2507.23421v3 Announce Type: replace Abstract: This paper introduces a dual-mode communication framework for wireless devices that integrates query-driven (pull) and event-driven (push) transmissions within a unified time-frame structure. Devices typically respond to information requests in pull mode, but if an anomaly is detected, they preempt the regular response to report the critical condition. Additionally, push-based communication is used to proactively send critical data without waiting for a request. This adaptive approach ensures timely, context-aware, and efficient data delivery across different network conditions. To achieve high energy efficiency, we incorporate a wake-up radio mechanism and we design a tailored medium access control (MAC) protocol that supports data traffic belonging to the different communication classes. A comprehensive system-level analysis is conducted, accounting for the wake-up control operation and evaluating three key performance metrics: the success probability of anomaly reports (push traffic), the success probability of query responses (pull traffic) and the total energy consumption. Numerical results characterize the system's behavior and highlight the inherent trade-off between push and pull success probabilities as a function of allocated communication resources. Our analysis demonstrates that the proposed approach achieves up to a 42% reduction in energy consumption per served packet compared to traditional approaches, while maintaining reliable support for both communication paradigms. ## KPI-Aware Multimodal Anomaly Detection for 5G and Open RAN Telemetry DevFeed: [KPI-Aware Multimodal Anomaly Detection for 5G and Open RAN Telemetry]() Original publisher: [Read original article]() Author: Chiman Salavati, Liang Wu, Kelly Wan, Mayank Darbari, Liangjie Hong Published: 2026-10-21T04:00:00Z Content type: article Language: en Sources: [arXiv: Machine Learning]() Topics: [observability](), [Monitoring](), [Detection engineering]() Tags: [5g](), [6g](), [anomaly-detection](), [cs-lg](), [gke](), [multimodal](), [nokia](), [observability](), [packet](), [performance](), [telecom](), [telemetry](), [temporal](), [text](), [time-series]() ### AI overview KAC aligns KPI-level residuals with compact operator-style text summaries to learn feedback over full-KPI time-series evidence, aiming to combine broad numerical coverage with sparse KPI-specific reasoning. The abstract reports strong threshold-based detection and competitive ranking results across public telecom, enterprise Open RAN, and Nokia telemetry benchmarks. On TelecomTS, KAC had the highest recall among evaluated residual-based methods at a fixed 2.5% false-positive rate, with comparable precision; it also remained robust under substantial class imbalance. It runs in pre-production shadow mode in Nokia's GKE-based KPI pipeline alongside an internal packet-level detector for operational evaluation. ### Source excerpt arXiv:2610.25510v1 Announce Type: new Abstract: Reliable anomaly detection is a deployment bottleneck for 5G/Open RAN observability and emerging self-optimizing 6G systems, where hundreds of heterogeneous KPIs, severe class imbalance, and strict alert budgets make purely numerical scores brittle. We present KAC, a deployment-oriented KPI-aware multimodal anomaly-detection framework that uses KPI-level residual-text alignment to turn compact operator-style summaries into a learnable feedback signal over full-KPI temporal evidence. This gives the detector broad numerical coverage like modern time-series models, while retaining the sparse KPI-specific reasoning that makes operator feedback sustainable in a future operator-facing workflow. Across public telecom telemetry, enterprise-scale Open RAN observability data, and a Nokia benchmark built from real 5G RAN production packet traces with realism-hardened injected anomalies, KAC achieves strong threshold-based detection performance while remaining competitive on threshold-free ranking metrics. On TelecomTS, at a fixed 2.5 percent false-positive-rate operating point, KAC achieves the highest recall among the evaluated residual-based methods while maintaining comparable precision; across the evaluated benchmarks, it remains robust under substantial class imbalance. KAC is integrated in pre-production shadow mode with Nokia's GKE-based KPI construction pipeline, where it continuously scores telemetry windows alongside an internal packet-level anomaly detector for operational evaluation. ## Tenant Connectivity on VCF 9.1: Choosing a Design and Running It in Production (Part 6) DevFeed: [Tenant Connectivity on VCF 9.1: Choosing a Design and Running It in Production (Part 6)]() Original publisher: [Read original article]() Author: mohammad saad Published: 2026-10-20T17:25:07Z Content type: tutorial Language: en Sources: [VMware]() Topics: [vcf networking](), [VMware Cloud Foundation](), [NAT and SNAT](), [CIDR and subnets](), [Network architectures]() Tags: [2](), [3](), [allowed](), [article](), [cloud](), [cloud-infrastructure](), [connectivity](), [design](), [enterprise](), [external](), [first](), [foundation](), [multi-tenancy](), [network](), [network-design](), [nsx](), [packet](), [production](), [providers](), [running](), [series](), [vcf](), [vcf-9-1](), [vcf-networking](), [vcf-networking-nsx](), [vmware-cloud-service-providers](), [vpc]() ### AI overview A VCF 9.1 multi-connection Transit Gateway can combine three outbound source-address behaviors by exit: Default Outbound NAT for the Internet, Provider SNAT to present provider-owned addresses, or Private-TGW advertisement to expose workload addresses to an enterprise. Provider SNAT and advertisement are mutually exclusive on each connection; advertisement works only for Private-TGW subnets and requires both provider authorization and a tenant advertise rule. The profile has one Auto SNAT block, which should match the default-route connection, while other exits need their own SNAT or advertisement policy. The article gives live-change sequences and checks for gateway status, authorized blocks, routes, NAT rules and end-to-end translations. It warns that changing the Auto SNAT block requires briefly disabling Default Outbound NAT, disrupting some paths, and that moving from SNAT to advertisement leaves enterprise traffic unreachable until the tenant rule is installed. ### Source excerpt This article is part of a six-part series on tenant external connectivity for cloud providers running VMware Cloud Foundation 9.1: Part 1: A Standard Network Design for Cloud Providers Part 2: What Decides a Packet's Source Address Part 3: When Only Provider Addresses Are Allowed Part 4: When the Enterprise Must See Real Workload Addresses ... Continued The post Tenant Connectivity on VCF 9.1: Choosing a Design and Running It in Production (Part 6) appeared first on VMware Blogs. [Next page]()