Scriptable GeoDNS: leaving AWS for Bunny

To optimize the performance metrics of this blog, I relied on Amazon CloudFront to serve the assets,1 and Route 53 for the geo-aware DNS2 to direct readers to the closest host serving the content. But Route 53 is expensive: US$0.50 per zone per month, US$0.70 per million geolocation queries, and US$0.75 per healthcheck per month, plus US$1 per month for the KMS key needed to sign zones with DNSSEC. When I discovered that Bunny DNS is almost free for up to 500 domains and features scriptable answers, I made the jump! Plus, it's a European company based in Slovenia.

Bunny CDN

Bunny.net started as BunnyCDN in 2015. They added IPv6 support in 2017. Switching was uneventful. I don't bring a custom domain: I serve the content from the b-cdn.net domain. As I depend on content negotiation to serve AVIF and WebP images, I configure the CDN to cache each image format separately.

I disable logging to avoid collecting personal information. While the bunny.net GDPR page promises they anonymize data, it is unclear what CloudFront keeps Continue reading

The Control Plane: BGP EVPN/VXLAN for AI Fabrics

This post discusses the application of BGP EVPN/VXLAN in AI data center networking, particularly focusing on back-end GPU fabrics. It emphasizes that single-tenant setups may not require VXLAN overlays, while multi-tenant environments benefit from logical segmentation. Key insights include the preference for Symmetric IRB over Asymmetric and the relevance of Type 5 routes for subnet aggregation.

The post The Control Plane: BGP EVPN/VXLAN for AI Fabrics appeared first on /overlaid.

See the agents, set the terms: new visibility and control for personal agents

Personal agents are the intermediary between humans and the Internet, turning a person’s instructions into requests and actions on websites. A customer might ask a personal agent to compare products across your site, find support articles, or complete a purchase. To a site owner, all three interactions show up as automated traffic — and without a clear view of which agents are visiting and what they are doing, it can be difficult to know whether that traffic is helping your business or creating risk. Blocking agents altogether can feel like the safest choice, but it can mean losing customers. Better visibility into agent activity allows you to decide what access makes sense for your site.

Today, we’re launching new analytics to help you understand how personal agents access your site on behalf of humans, along with more granular access policies to put those decisions into practice. Together, they let you welcome agents on your own terms, and in ways that support your business.

See how agents access your site

Knowing which agent is behind a request turns unexplained automated traffic into traffic you can act on with confidence. Cloudflare maintains the largest verified bot directory in the world, and we are Continue reading

Candidate and Active Configuration on IOS XR

Traditional network devices used a single (active or running) configuration, with a snapshot of it stored in permanent memory (startup configuration). The active configuration was modified with every configuration command, making it a perfect recipe for disaster in the days of in-band configuration1.

The situation improved drastically when Juniper introduced the candidate configuration. You could make changes to a copy of the configuration, and then commit them as a single all-or-nothing transaction. While you could still cut yourself off from the device, at least it was harder to do with a single misordered command.

Read more …

Detecting incast congestion of RDMA flows

The recently released open source GitHub project, ai-monitor, is a proof of concept demonstrating that real-time sFlow telemetry can detect and characterize incast RoCEv2 RDMA flow collisions between GPUs during AI training. 
docker run -p 6343:6343/udp -p 8008:8008 sflow/ai-monitor
The pre-built sflow/ai-monitor image is the quickest way to try out the software. The diagram at the top of this page shows test RDMA flows crossing a 4 leaf / 2 spine test network to generate an incast collision. The flows are displayed using the trace-flow application that is included in the image.

The ai-monitor application uses packet samples to detect when GPU port is oversubscribed:

  1. Detect when an leaf switch egress port utilization exceeds 80%
  2. Count the number of sources sending traffic to the port - single flows are ignored
  3. Trace each of the flows back across the topology to its source GPU

The instant the threshold is crossed, the following incast_congestion event is generated by querying information maintained within the sFlow-RT analytics engine. Real-time elephant flow monitoring in AI / ML fabrics describes how standard sFlow from data center switches streams real-time telemetry that can be used to detect elephant flows with a few milliseconds.

{
 "event":  Continue reading

Introducing Zero Wire, a hub for investigating critical Internet vulnerabilities

You run security at your organization. It’s 7:00 am, and you’re having breakfast. You receive a ping: a new critical vulnerability has been disclosed. Your team scrambles to compare vendor advisories, read technical research, check which systems run the affected software, and answer familiar questions from the business: are we affected, and what are we doing about it? Another disclosure arrives before that work is finished.

AI is changing both the volume and speed of critical vulnerability discovery. It can analyze large codebases at scale and surface deeply nested flaws that may have existed for years without being found through human review. That discovery momentum will put more pressure on security teams to understand the impact of each disclosure on their infrastructure.

To help security teams prepare, today we’re introducing Zero Wire: a public vulnerability intelligence feed on Cloudflare Radar, bringing the clarity of a news wire service to critical security developments. It helps security leaders and practitioners understand significant vulnerabilities and decide what to do next.

How it works

Zero Wire lives inside Cloudflare Radar under the security section.

Each briefing brings together a plain-language explanation of the vulnerability, who should investigate it, recommended actions, and links to Continue reading

Help Me Make the BGP Labs Even Better

I decided to add “Further Reading” sections to BGP lab exercises, containing links to vendor documentation and useful related blog posts. I naively expected to offload the job to Claude, commit the results, and move on. The “related blog posts” were a piece of cake; precise links to relevant vendor documentation turned out to be more of a challenge.

TL&DR: I would love to get your suggestions for further reading as PRs in the BGP Labs repo.

Apart from FRRouting, the vendor documentation is mostly generated from whatever internal system and uses auto-generated anchors that can change at any moment – somewhat “suboptimal” for what I wanted to do.

Read more …

What a ‘Kill Switch’ Actually Means for Your Agent Fleet

In short, in the five weeks to 27th October 2026, Okta, Satya Nadella, the Cloud Security Alliance and Salesforce each put the words “kill switch” or “emergency brake” next to AI agents, and the AI Kill Switch Act, introduced in the US House on 23rd July, would require the largest model providers to be able to throttle, suspend or shut their systems down on order. Every one of those switches stops something, and none of them stops the same thing. Pull the switch on an agent in your cluster and read what is still true a minute later: the Deployment has replaced the pod, the callers are retrying, the open sessions are still open, and the key in the agent’s environment still works. A kill switch for a fleet is a set of cuts at points the agent does not control, and the only way to know which ones you hold is to pull them. This post reads the bill and the UK NCSC’s advice for what a stop has to do, runs a drill through the five switches teams reach for, then says what a governance layer like Tigera Lynx can and cannot do about it. It is written Continue reading

How we halved DNS build delay and cut memory use by 85%

When I last wrote about our DNS propagation pipeline in 2022, the Zone Builder received about 250 DNS record changes per second. Today it receives about 700, nearly three times as many, plus about 100 other events, such as zone setting changes. However, the number of events was never the real problem. The problem was the kind of work some of those events needed, and how that work grows with the size of a zone. Some zones now hold more than 20 million records, and we expect them to keep growing toward hundreds of millions.

Each event starts a clock that measures how long it takes us to turn that change into data our authoritative DNS servers can use. We call that work a build. A build reads the current database state, converts it into the format used at the edge, and writes any changes to Quicksilver.

In 2022, per-record builds were 150 times faster than full builds on average. On a test zone with one million records, per-record builds were 4,250 times faster. We ended that post with the obvious next step: do the same thing for zone settings.

Why doesn't the Zone Builder just rebuild the setting Continue reading

Space Engineers: Panduan Merancang Kendaraan Antariksa dan Stasiun

Dalam industri permainan simulasi dan rekayasa modern, Space Engineers menjadi salah satu game yang paling diminati hingga saat ini. Dengan fokus pada kreativitas, teknik, dan eksplorasi luar angkasa, Space Engineers memungkinkan para pemain untuk tidak hanya merancang kendaraan antariksa yang kompleks tetapi juga membangun stasiun ruang angkasa secara mandiri. Artikel ini akan membahas secara komprehensif cara merancang kendaraan antariksa dan membangun stasiun sendiri di Space Engineers dengan panduan yang mudah diikuti dan relevan dengan perkembangan terbaru dalam game tersebut.

Pendahuluan: Mengapa Space Engineers Penting untuk Para Pecinta Antariksa?

Space Engineers adalah game sandbox yang memadukan simulasi rekayasa dan eksplorasi luar angkasa dengan tingkat kebebasan yang sangat tinggi. Hingga saat ini, game ini telah berkembang dengan banyak tambahan fitur dan optimasi, mendukung pengalaman pengguna yang semakin realistis dan menantang. Para pemain dapat menciptakan berbagai jenis kendaraan antariksa mulai dari roket, pesawat luar angkasa, hingga kendaraan darat yang bisa menjelajahi planet. Selain itu, konsep membangun stasiun luar angkasa yang kompleks menjadi daya tarik utama yang memungkinkan pemain mengasah keterampilan teknik dan kreativitas mereka.

Merancang Kendaraan Antariksa di Space Engineers

1. Memahami Dasar-dasar Desain Kendaraan Antariksa

Sebelum mulai merancang kendaraan antariksa, penting memahami elemen dasar yang harus diperhatikan, seperti:

Astroneer: Panduan Menjelajahi Planet dan Membuat Koloni Efisien

Pendahuluan

Astroneer tetap menjadi salah satu permainan eksplorasi dan simulasi luar angkasa favorit bagi para penggemar di periode terbaru. Dengan mekanisme gameplay yang menuntut kreativitas dan manajemen sumber daya yang efisien, Astroneer memberikan pengalaman unik dalam menjelajahi berbagai planet asing dan membangun koloni dari nol. Artikel ini akan membahas secara lengkap cara menjelajahi planet dan membangun koloni dengan sumber daya terbatas dalam Astroneer, yang tentu sangat relevan bagi para pemain saat ini yang ingin memaksimalkan pengalaman mereka di game ini.

Memahami Konsep Eksplorasi dan Sumber Daya di Astroneer

Salah satu kunci dalam Astroneer adalah pengelolaan sumber daya yang efisien. Saat ini, para pemain dihadapkan pada tantangan untuk menjelajahi berbagai planet dengan kondisi yang berbeda-beda, menggunakan alat dan kendaraan yang terbatas. Pengetahuan tentang sumber daya utama seperti Resin, Compound, Laterite, dan Organic sangat penting karena bahan-bahan inilah yang akan digunakan untuk membuat berbagai alat dan infrastruktur dasar.

Resin biasanya digunakan sebagai bahan bangunan dasar untuk membuat lander, platform, dan berbagai komponen mesin. Sementara Compound diperlukan untuk membuat paket-paket energi dan alat dasar. Oleh karena itu, prioritas pertama saat mulai bermain adalah mencari dua sumber ini dan mulai membangun basis yang kokoh.

Strategi Menjelajahi Planet dengan Sumber Daya Terbatas

Menjelajahi planet dalam Continue reading

Getting Structured Output from Network Devices with Ansible

Getting Structured Output from Network Devices with Ansible

This post is part of an ongoing series on Ansible, and you can find all the other posts in the series here.

In the previous parts of this series, we built an OSPF network with Ansible, and then wrote a few checks to make sure it's healthy. One of those checks counted the OSPF neighbors on each router, by running show ip ospf neighbor and counting the lines that contain the word FULL. It works, but it's a bit broken. We're treating the output as plain text and searching through it, so we're relying on the router always formatting the output in exactly the same way.

The output of a show command is designed for humans to read, not for machines. What we really want is structured data, such as a list of neighbors, where each neighbor has its own neighbor ID, state, and interface that we can work with directly, just like the facts and variables we've been using throughout the series.

In this part, we'll look at how to parse command output into structured data using the cli_parse module and a library of ready-made templates called ntc-templates. We'll parse show ip ospf neighbor, compare the plain Continue reading

1 2 3 … 3,919