Overlay and mesh networks, VPNs, NAT traversal, routing, and the protocols that move packets — with packet-level detail and reproducible setups.
80 posts
Everyone assumes a bigger network buffer is safer. Run this simulation and watch a large buffer turn a fast link into a link that feels slow — while the throughput number stays exactly the same.
I reimplemented a real mesh VPN's wire protocol in C on an ESP32, then compiled the encoder on my laptop to see the actual bytes. The first thing that bit me was a header field that lies about the packet — and that lie is load-bearing.
I traced one real request to this site and timed every phase. The surprising part is not the total — it is how little of it the server is responsible for, and which single phase would be worth fixing first.
A hands-on tour of Modbus — the tiny protocol that runs factories. Real request/response bytes over TCP and a pty-simulated RS485 link, with CRC16 verification and exception handling.
Set up a CAN bus on Linux with SocketCAN and a virtual vcan0 interface: real frames, real arbitration rules, candump, cansend, cansniffer, CAN-FD, and the path to real hardware.
Policy routing with iproute2 lets `ip rule` pick a routing table by source address, fwmark, or interface — not just the destination. Real `ip route get` output for two uplinks, source-based routing, split tunnels, and IPv6.
A hands-on IPv6 firewall lab: one nftables inet table for both address families, the ICMPv6 rules IPv6 cannot live without, link-local and multicast allowances, default-deny input, real allowed/blocked test output, and the ip6tables comparison.
How certificate revocation works: CRLs, OCSP queries and their privacy cost, ssl_stapling in nginx verified with s_client -status against a real Docker lab, Must-Staple, and why Let's Encrypt killing OCSP in 2025 changed everything.
A hands-on comparison of systemd-networkd and NetworkManager with real output: .network files vs nmcli connection profiles, the same static IP configured both ways, how each feeds systemd-resolved, and why running both is a bad idea.
Why a 500 Mbit/s link delivers 14 Mbit/s: the receive window, TCP window scaling, the bandwidth-delay product, and how socket buffers and autotuning set your real ceiling — measured with real iperf3, tcpdump, netem, and ss -ti output.
brotli vs gzip, measured on real files: full gzip 1-9 and brotli 1-11 byte tables, compression-level CPU costs, nginx gzip and brotli setup, precompressed static assets, BREACH, and what not to compress.
MQTT 5 adds shared subscriptions, request-response MQTT patterns, user properties, message expiry and real reason codes. Here is what each one actually changes, with real mosquitto 2.1.2 output.
I ran a throwaway single-node NATS JetStream server and pasted real output: stream creation, durable consumers, explicit consumer acks, and an at-least-once redelivery demo where an unacked message comes back with tries: 2 and num_redelivered: 1. Retention policies, limits, and the KV layer included.
Conditional requests let a client ask 'has this changed?' before downloading a body. Real curl output against a throwaway nginx: ETag + If-None-Match returning 304 Not Modified with zero body bytes, If-Modified-Since vs ETag, If-Match returning 412, and Range returning 206.
How Certificate Transparency works in practice: real SCTs decoded from a live certificate with openssl, which CT logs signed them, how Chrome enforces SCTs, and how to query public CT logs to catch mis-issued certificates for your own domains.
How a host gets an IPv6 address without DHCP — RS/RA exchange, prefix information, A/M/O flags, EUI-64 vs stable-privacy, and real radvd output.
systemd-resolved is the local caching stub resolver on 127.0.0.53 that most systems already run — and quietly bypass. A hands-on tour of resolvectl, the cache, split DNS, DNS over TLS and mDNS, with real output from an Arch box.
What a full TLS handshake really costs in round trips and bytes, how session IDs and session tickets (TLS 1.2) and PSK tickets (TLS 1.3) let a reconnecting client skip most of the work, how to see it with openssl s_client -sess_out/-sess_in, nginx ssl_session_cache tuning, and the TLS 1.3 0-RTT replay tradeoff.
A hands-on DNSSEC walkthrough: sign a real zone with BIND inline signing, inspect DNSKEY/RRSIG/DS/NSEC records, see the ad flag from a validating resolver, watch SERVFAIL when the chain breaks, and learn why key rollovers make DNSSEC operationally painful.
A practical WireGuard troubleshooting ladder built from real wg show, tcpdump and conntrack output: wrong public keys, missing AllowedIPs, PersistentKeepalive behind NAT, and MTU stalls. All reproduced in throwaway containers.
Real Consul, no Kubernetes: I ran a throwaway dev agent on 127.0.0.1, registered a service with an HTTP health check, watched it flip to critical, queried it through the DNS interface and HTTP API, and stored config in Consul KV — with real output.
A half-open connection can linger for hours. Learn how TCP keepalive (SO_KEEPALIVE, TCP_KEEPIDLE) and application-level heartbeats detect dead peers, with real experiments and timings.
A DNS zone transfer (AXFR) hands a stranger every hostname in your zone in one query. Real dig AXFR output against a lab BIND on 127.0.0.1, the real REFUSED after allow-transfer { none; }, TSIG-restricted secondary DNS, and NSEC3.
A hands-on HTTP/2 vs HTTP/1.1 comparison: real curl and nghttp2 output from a throwaway nginx showing HTTP/2 multiplexing, HPACK header compression, the nginx http2 config, why TCP head-of-line blocking still needs QUIC, and honest localhost vs high-latency measurements.
How to use nginx stream module as a TCP/UDP proxy. L4 vs L7 explained with real configs, ssl_preread SNI routing, UDP proxying, load balancing, and proxy_protocol.
Hands-on packet manipulation in Python: craft packets with Scapy — a crafted ICMP echo, an Ethernet/IP/TCP frame, a real DNS query — send them on your own loopback, and sniff the replies. Real show(), hexdump() and resolver output, plus the honest limits.
Use tc netem and tbf to emulate WAN latency, packet loss, and rate limits on Linux. Real measurements from a throwaway Docker container: ping RTT, throughput before/after, and tc -s counters.
Build a real bidirectional TCP proxy in Go with io.Copy, graceful shutdown, timeouts, and connection counting — and learn the whole proxy model in 80 lines.
What Accept-Ranges, Range, Content-Range, 206 Partial Content and 416 are for, why download managers and video players live on them, how If-Range makes a resumable download safe, why generated responses often can't do ranges, and how to enable it (and what breaks it) in nginx.
I ran a throwaway gRPC service next to a REST equivalent and measured the wire: grpcurl output, HTTP/2 frames, protobuf vs JSON bytes, streaming, and deadlines — then wrote down where each one actually wins.
Behind a CDN, LB, or reverse proxy, $remote_addr is the proxy, not your user. How X-Forwarded-For, X-Real-IP, and Forwarded work, how nginx real_ip rewrites the client IP with set_real_ip_from and real_ip_recursive, why proxy_protocol is harder to spoof, and the trap of trusting a header you did not write.
WebSocket or Server-Sent Events? I put a throwaway echo server and an events endpoint behind nginx, captured the real 101 handshake, the text/event-stream frames, reconnection with Last-Event-ID, and the buffering trap — then turned it into a decision list.
Kafka is not a queue — it is an append-only, partitioned log with consumer offsets, and that one difference unlocks replay and independent consumers. I ran a throwaway single-broker KRaft cluster and pasted the real topic, consumer-group, and log-compaction output.
Consensus, learned by running it: a throwaway 3-node etcd cluster with real etcdctl output, a watch and a lease, a transaction, quorum proven by killing the leader, and why Raft wants odd numbers.
Build a tiny PKI with openssl, make nginx demand a client certificate with ssl_verify_client, verify it from curl and openssl s_client, then avoid the EKU, SAN, chain, and revocation footguns that break real mutual TLS deployments.
A hands-on Caddy vs nginx comparison for reverse proxy work: the same job written in both, real curl -I output, HTTP/3 and compression, TLS certificate handling (automatic HTTPS vs certbot), config-size and ergonomics, and a decision list.
Message queues answer every scaling question and usually are the wrong one. I ran throwaway NATS, RabbitMQ, and Postgres to show what a queue buys: pub/sub fan-out, a work queue with competing consumers, at-least-once redelivery into a dead letter queue, and a SQL table with FOR UPDATE SKIP LOCKED.
Stand up a container DNS server in minutes: a minimal CoreDNS Corefile serving a custom authoritative zone from a zone file, forwarding unknown names upstream, and every answer poked with dig @127.0.0.1 -p 15353 — including real NXDOMAIN, SERVFAIL, CNAME-chain and TTL output.
A hands-on Docker networking walk-through from inside the container: how docker0 hands out IPs and NATs to the internet, why veth pairs glue eth0 to the bridge, what a user-defined bridge network adds (embedded DNS), what -p really does, host/none/macvlan/overlay, and how to debug it.
The curl flags I use daily, explained with real output: -v/-i/-D to read requests, curl -w timing, -L and --max-redirs, --fail and exit codes, -d/--json/-F bodies, headers and auth, HTTP/2 and HTTP/3, --resolve for testing, and why -v beats guessing.
A practical guide to BGP in a homelab: what the protocol actually does, when multi-homing, ISP failover, or your own IPv6 PI space justify it, the BIRD and FRR options, the concepts (AS, prefix, local-pref, route filtering) you must understand, a minimal config, and an honest recommendation.
Why cloud-default smart homes are a liability, how a local smart home with Home Assistant, Zigbee, Z-Wave and local MQTT works, how to pick devices that survive if the vendor dies, and the honest hard parts nobody mentions.
A concrete walk through QUIC and HTTP/3: the TCP head-of-line blocking and handshake problems they fix, UDP transport with built-in TLS 1.3, streams and connection migration, the 0-RTT and 1-RTT handshake, QPACK, UDP 443 in nginx and Caddy, and how to test it.
TCP congestion control is how the kernel picks its own send rate with almost no knowledge of the path. Slow start, congestion avoidance and fast recovery; why CUBIC is Linux's default; how BBR models the bandwidth-delay product; reading `ss -ti`; switching to BBR with sysctl; and bufferbloat.
WireGuard in a container looks easy until the kernel module, /dev/net/tun, and NET_ADMIN get in the way. A practical WireGuard Docker guide: host vs container namespaces, NET_ADMIN, wireguard-go, kill switch and routing traps, and secrets kept out of the image.
A practical walk through HTTP caching: browser, CDN and reverse-proxy layers and who obeys whom, the Cache-Control directives that matter, ETag/Last-Modified validators, the 304 round trip, the classic no-cache misreading, cache busting vs revalidation, Vary and cookies, and a working nginx config.
A practical nftables guide: the tables/chains/rules model, a complete default-deny nftables ruleset for a server, sets and named intervals for IP lists, masquerade and port-forwarding NAT, persistence, and how to read the ruleset without locking yourself out.
A practical look at encrypted DNS: what plain DNS leaks and to whom, how DNS over TLS and DNS over HTTPS differ, what DoQ adds, what encryption protects (query content) and what it never hides (SNI, destination IPs, your resolver), the operator tradeoffs, and concrete Unbound and systemd-resolved setups.
A practical guide to an IPv6 home network: check that your ISP really does prefix delegation, get the router advertising a /64 over SLAAC, lock the IPv6 firewall to default-deny inbound, publish the right AAAA record, and debug the stall a broken IPv6 path causes.
authorized_keys sprawl breaks the moment you hire someone or rotate a key. SSH certificates fix it: one SSH CA signs user certs with principals and expiry, host certificates kill the TOFU prompt, and short-lived credentials remove the need for revocation. Copyable ssh-keygen -s and sshd config.
Local, remote and dynamic SSH port forwarding made concrete, plus ProxyJump for bastions, autossh and a systemd unit for persistence, and the honest point where an ssh tunnel stops being enough and you should run WireGuard or a mesh overlay instead.
A concise tour of how WireGuard works under the hood: the design philosophy of no negotiation, the primitives Curve25519, ChaCha20-Poly1305, BLAKE2s and HKDF, the Noise_IK handshake, forward secrecy, the time-based rekey, roaming, and why AllowedIPs is cryptographic routing.
One counter per IP is not rate limiting. A practical guide to what you are actually protecting, why fixed and sliding windows fail, how a token bucket handles bursts, where to enforce, how to rate limit without Redis, and how to return an honest 429 with Retry-After.
A practical guide to the security headers a static site needs: HSTS and its includeSubDomains footgun, a strict Content-Security-Policy, X-Content-Type-Options, Referrer-Policy, frame-ancestors, Permissions-Policy, and CORS — plus the nginx add_header trap and how to test it.
Why Go network tools keep winning: static single-file binaries, one-command cross compile, a net package that ships a TCP proxy and DNS client, goroutines for concurrent connections, and the concurrency pitfalls — unbounded goroutines, leaked connections, missing timeouts — that bite first.
The ssh config file is the best productivity upgrade I ever made on the command line. Then come ssh tunnels: local, remote and dynamic port forwarding, ProxyJump for bastion hosts, ed25519 keys and ssh-agent. Concrete configs and commands, plus hardening that also improves daily UX.
A crisp end-to-end walk of what happens when you type a URL: browser cache, DNS resolution through stub, recursive and authoritative servers, the TCP handshake and slow start, the TLS 1.3 handshake, the reverse-proxy hop, cache headers, rendering, and HTTP/2 vs HTTP/3.
A stdlib-only Python pcap parser you can read in one sitting: the global header and packet records, byte order and snaplen, when scapy or dpkt wins and when hand-parsing does, Ethernet → IPv4 → TCP 5-tuples, a pcapng primer, and streaming performance notes.
Reading your first packet capture without the overwhelm: when a capture beats logs, how to capture correctly with tcpdump (-i, BPF filters, -w, snaplen), what the TCP handshake, retransmissions, RST and TLS bytes look like in Wireshark, and a worked 'why is this slow?' example.
A message-by-message walk through the TLS 1.3 handshake: what it must achieve, the ClientHello key_share, CertificateVerify and Finished, how it differs from TLS 1.2, the 0-RTT replay tradeoff, and how to read it in openssl s_client and Wireshark.
A field guide to the TLS certificate errors you actually hit: incomplete certificate chain, missing SNI, expired certificate, hostname mismatch, self-signed cert, clock skew, cipher mismatch, Let's Encrypt rate limits, and HSTS — with the openssl s_client command that proves each, and the fix.
A practical guide to home network segmentation: the real risks from IoT gear and lateral movement, the options ranked from a free guest network to a VLAN home network with a managed switch, a concrete topology, firewall rules, and an honest take on how far to go.
A field guide to debugging ESP32 TCP: how lwIP socket buffers, Wi-Fi retries and Nagle/delayed-ACK interactions produce stalls, resets and half-open connections, which stats and Wireshark views actually reveal a TCP retransmission, and an ESP-IDF snippet plus a checklist.
A practical guide to ESP32 power management on the ESP32-C3: why the Wi-Fi radio dominates the budget, what active, modem sleep, light sleep and deep sleep each cost in connectivity, how DTIM and listen interval trade latency for battery life, and how to measure real current cheaply.
MQTT fits a microcontroller's budget better than most IoT messaging stacks — a two-byte minimum header, publish/subscribe decoupling, and QoS you can dial down. Here is what an MQTT ESP32 system actually costs once TLS, certificates and reconnects enter the picture.
Classic traceroute is a flattering cartoon: ICMP rate limits, per-flow load balancing, hidden MPLS labels, asymmetric return paths and NAT all bend it. Learn to read paths honestly with tcptraceroute, mtr and fixed-flow probes, tell queuing from distance, and diagnose a real path problem.
Forwarders vs a true recursive DNS resolver, why self-hosted DNS is worth it for privacy and filtering, practical options (Unbound, Knot Resolver, dnsdist), a hardened Unbound config with qname minimisation and DNSSEC, and the open resolver failure modes to avoid.
A packet-level walkthrough of DNS resolution: the stub resolver, the recursive resolver, root and TLD servers, the authoritative answer, caching and TTLs, the record types that matter, CNAME rules, glue and apex ALIAS/ANAME, authoritative vs recursive roles, and debugging with dig +trace, kdig, DoH and DoT.
Why the 1500-byte MTU breaks under VPNs, overlays, and tunnels: fragmentation and the DF bit, MSS clamping with a working nftables rule, path MTU discovery and how filtered ICMP kills it, the classic TLS-hang symptom, and a diagnosis walkthrough with ping -M do, tracepath, and tcpdump.
A fair WireGuard vs OpenVPN comparison for 2026: design and code size, crypto (Noise vs TLS), kernel vs userspace performance, roaming, NAT traversal, config complexity, UDP 443 fallback, and enterprise auth — with a decision table and clear recommendations.
A practical IPv6 tutorial for people who avoided it: why the address math is simpler (prefixes, /64, SLAAC, no NAT), what changes operationally (nftables, ip -6, AAAA, listening on [::]), why dual stack is pragmatic, the gotchas, and how to test it on one box.
Build a tiny multi-host network inside one Linux box with ip netns, veth pairs, a bridge and NAT. A hands-on walkthrough for testing routing, overlays and firewall rules without extra hardware, verified with ping, ip route and tcpdump.
A repeatable methodology for HTTP API reverse engineering: observe before you act, map the auth flow, capture traffic with devtools and mitmproxy, replay with curl, detect request signing, and write it up as a state machine.
A hands-on WireGuard tutorial: generate keys, write a wg-quick config, add peers, read AllowedIPs as cryptographic routing, build a two-host tunnel and a site-to-site route, diagnose with wg, and see exactly what WireGuard leaves to you.
A mechanism-level explainer of NAT traversal: why NAT breaks P2P, the NAT taxonomy and why symmetric NAT is hard, how STUN finds your reflexive address, UDP hole punching step by step, TURN as relay fallback, ICE as the framework uniting them, and what CGNAT, port randomisation, QUIC, and WireGuard overlays change.
A mesh VPN comparison for 2026 — Tailscale vs ZeroTier, plus NetBird, Nebula and EasyTier — judged on control plane, data plane, L2 vs L3, NAT traversal, self-hosting and lock-in. No stale pricing tables, just the tradeoffs that decide a self-hosted VPN.
A packet-level walkthrough of how captive portals actually work: DHCP and DNS interception, the RFC 8910 captive portal API, the Wi-Fi login redirect, CNA detection on Android and iOS, walled gardens, MAB and RADIUS, and how to automate a headless login.
I replaced a hub-and-spoke WireGuard setup with an EasyTier mesh VPN: one overlay network name and secret, peers that punch through NAT for direct P2P paths, and a relay only when they can't. A concrete homelab walk-through — install, form the private mesh, verify routes, and expose a service.
ESPTier reimplements the EasyTier v2.6.4 wire protocol in plain C on an ESP32-C3 — TCP framing, SipHash-1-3 identity, AES-128-GCM, route sync and forwarding — so a constrained MCU becomes a real, pingable member of an overlay network.
How I reverse-engineered a Ruijie ePortal captive portal and its CAS single sign-on flow to build a headless Python auto-login daemon that reconnects a campus uplink in about 16 seconds.