Category: Network Engineering
-
Held the Line, Owned the Miss
An SE evaluating me for a role told me something about my own resume I’d never noticed. It carries more “held a technical position against management pressure, then was proven right” stories than any resume he’d reviewed, he said, and he called it an unclaimed sales instinct. I wrote about that on LinkedIn. This post…
-
Are These Actually the Same Rules? A CheckPoint-to-Palo-Alto Migration Audit
Two firewalls that both call something “the address at 10.4.x.x” are not saying the same thing, if one of them stores that address as an object called dns-primary and the other stores it as a signed 32-bit integer with no name attached at all. Before anyone can ask whether a migration preserved the rulebase, both…
-
A Hit Counter Doesn’t Know When It Started Counting
A rule that has matched nothing in nine minutes and a rule that has matched nothing in eighty days look exactly the same in the output. I wrote about that moment on LinkedIn; this post goes deeper into the toolchain around that observation: three small Perl tools written to consolidate a set of independently managed…
-
How Retiring One System Retired Another
The Wireless Gateway’s End Also Killed CheckPoint’s Cleartext Login One component retired. It killed an entire system on its way out. I only built one of them. Before wifi, Baylor’s residential network ran authentication through CheckPoint using a cleartext, telnet-emulated login. I’d already shipped client software for both Windows and Mac System 7 that talked…
-
The Server That Never Talked: ARP TTL, FDB Aging, and a Broadcast Storm
An ARP TTL FDB aging mismatch turned a data center into a light show. Around 2005, every top-of-rack switch in the data center was blinking like a light show at a disco rave. I traced the cause back to a server doing exactly what its owner designed it to do. The failure wasn’t a misconfiguration,…
-
The Firewall Was the Wrong Layer: Automating Threat Response with BGP
The Firewall Was the Wrong Layer: Automating Threat Response with BGP A LinkedIn post I wrote about this covers the story: a daily infosec email, a firewall policy cycle, and the decision to stop doing the same fix by hand. This post goes deeper into the mechanics behind Remote Triggered Black Hole (RTBH) routing. Specifically,…
-
When the Interior Doesn’t Speak PIM: SPBM Multicast Root Cause
SPBM Multicast and a Replacement Plan That Assumed the Wrong Protocol A hospital system spanning several states runs its live IPTV distribution out of a single metro region’s headend: DirecTV and BlonderTongue encoder headends feeding 60+ active multicast streams. When the core node serving that region was rip-and-replaced, removing legacy Avaya-era SPBM hardware out, standing…
-
When the Spec Is the Only Source of Truth
This post began as a LinkedIn reflection on RFC reading and first-principles thinking. The story went deeper into RFC 2865 RADIUS authentication than a LinkedIn post could hold. RFC 2865 RADIUS Authentication The authentication failures were intermittent. Not every packet. Not every user. Just enough to know something was wrong at the byte level. I…
-
460 Devices, No Documentation, and the Pipeline That Changed That
The engagement had 460 managed devices and no current topology documentation. Network topology automation was the only viable path — manual spreadsheet work would have taken weeks and produced a point-in-time artifact no one could re-run. The Cisco design team needed three structured deliverables before they could move: device inventory, physical topology graph, VLAN/service map.…
-
1500 != 1500: MTU, OSPF ExStart, and a 14-Byte Blind Spot
What OSPF is actually doing when it stalls in EXSTART, why MTU is the non-obvious suspect, and what to check first when you hit it.