-
A rule that has matched nothing in nine minutes and a rule that has matched nothing in eighty days look exactly the same in the output. I wrote about that moment on LinkedIn; this post goes deeper into the toolchain…
-
How Retiring One System Retired Another
The Wireless Gateway’s End Also Killed CheckPoint’s Cleartext Login One component retired. It killed an entire system on its way out. I only built one of them. Before wifi, Baylor’s residential network ran authentication through CheckPoint using a cleartext, telnet-emulated…
-
The Server That Never Talked: ARP TTL, FDB Aging, and a Broadcast Storm
An ARP TTL FDB aging mismatch turned a data center into a light show. Around 2005, every top-of-rack switch in the data center was blinking like a light show at a disco rave. I traced the cause back to a…
-
The Firewall Was the Wrong Layer: Automating Threat Response with BGP
The Firewall Was the Wrong Layer: Automating Threat Response with BGP A LinkedIn post I wrote about this covers the story: a daily infosec email, a firewall policy cycle, and the decision to stop doing the same fix by hand.…
-
When the Interior Doesn’t Speak PIM: SPBM Multicast Root Cause
SPBM Multicast and a Replacement Plan That Assumed the Wrong Protocol A hospital system spanning several states runs its live IPTV distribution out of a single metro region’s headend: DirecTV and BlonderTongue encoder headends feeding 60+ active multicast streams. When…
-
When the Spec Is the Only Source of Truth
This post began as a LinkedIn reflection on RFC reading and first-principles thinking. The story went deeper into RFC 2865 RADIUS authentication than a LinkedIn post could hold. RFC 2865 RADIUS Authentication The authentication failures were intermittent. Not every packet.…
-
460 Devices, No Documentation, and the Pipeline That Changed That
The engagement had 460 managed devices and no current topology documentation. Network topology automation was the only viable path — manual spreadsheet work would have taken weeks and produced a point-in-time artifact no one could re-run. The Cisco design team…
-
1500 != 1500: MTU, OSPF ExStart, and a 14-Byte Blind Spot
What OSPF is actually doing when it stalls in EXSTART, why MTU is the non-obvious suspect, and what to check first when you hit it.
-
When the Fix Becomes the Failure: ECMP, Zone Protection, and a 64KB Ceiling
Three ECMP firewall cutovers went cleanly. The fourth did not — and the cause turned out to be Palo Alto MSS clamping, hidden inside a zone protection profile that had passed through three clean rollouts undetected. It was the highest…
-
BGP Prefix Leak, RPKI, and the Cold Email That Confirmed It
A BGP route leak at an Internet2 customer site propagated more-specific prefixes into the global table, causing every major CDN to black-hole return traffic to an entire campus network. Diagnosing it required a cold email to a Google network engineer…