Networking notes

Networking notes for September 2026

2026-09-01T00:00:00+00:00

Speedtest is a well known app to measure throughput. A recent study shows that it also collects information from the temperature sensor on Android smartphones. What are the other information that Speedtest collects once it has been installed on your smartphone?

An interesting article in IEEE Spectrum explains how a community in Fort Albany built its own fiber optic network to provide high speed Internet access to the entire city in a remote area North of Canada.

In August, a solar eclipse was visible in Europe with peaks in Iceland, Spain and Portugal. Cloudflare’s blog shows that Internet usage reduced during the eclipse in many countries in Europe.

As part of their annual Urban Resilience Exercises, different regions of Taiwan suffered from major slow downs in order to evaluate the resilience of the Taiwanese society in tough times between August 7th and August 13th. This shows the growing importance of the Internet in our society.

The IETF has published RFC10001 which provides interesting guidelines on authoritative DNS servers.

On the APNIC blog, George Michaelson explains the origin of the Unix sockets.

Internet Service Providers use BGP policies to control the flow of packets on their interdomain links. The most common policies are shared-cost and customer-provider. In 2022, the IETF published in RFC9234 a set of BGP extensions that allow to automate the configuration of these policies to prevent misconfiguration errors. A recent blog post analyses the deployment of this BGP extension.

Tom Mattke provides interesting guidelines on how network engineers can tune their prompts to obtain better answers from an LLM.

Vincent Bernat wrote a nice tutorial on the Spanning Tree protocol which uses a nice web-based simulator that uses the Linux implementation of this protocol to exchange real packets. A nice starting point for a lab with this important protocol.

Artem Berezin uses the information stored in the DNS, e.g. MX records, to identify which servers provide email services for the top 1M domain names. His results show that only 22.4% of the domains manage their own mail servers. Ten years ago, 44.6% of these domains managed their own mail servers. Together, Google and Microsoft receive 38% of the emails sent to these top domain names. Mail is unfortunately getting more and more centralised…

Fifty years ago, the first packets were exchanged over the ARPANET using packet radio.

A BGP hijack affected Virtualizor. An attacker announced a prefix owned by virtualizor that contained the address of its software update server. During the hijack, the attacker exposed a valid TLS certificate and clients updated the software without any cryptographic validation.An attacker announced a prefix owned by virtualizor that contained the address of its software update server. During the hijack, the attacker exposed a valid TLS certificate and clients updated the software without any cryptographic validation.

This blog aims at encouraging students who read the open Computer Networking: Principles, Protocols and Practice ebook to explore new networking topics. You can follow this blog by subscribing to its RSS feed or by following @cnp3_ebook on mastodon. Feel free to share the posts that you find interesting on your preferred social network.

Networking notes for August 2026

2026-08-02T00:00:00+00:00

Vint Cerf considered by many Internet researchers as the father of the Internet has decided to retire from his Chief Internet Evangelist position at Google at the age of 83.

Ellon Musk claims that future datacenter should be placed in orbit. An article in IEEE Spectrum shows that would be a very difficult challenge from a heat and an energy viewpoint.

Falvio Luciani argues on RIPE Labs that coping with flash crowds and various events where a large population wants to access the same information will remain a problem for the Internet.

Several web browsers and TLS applications can export the negotiated key material to a SSLKEYLOGFILE which can be used by tools such as wireshark. RFC9850 provides the following specification of this file format.

An Internet Society blog post provides a graphical representation of the growth of datacenters throughout the world during the last years based on PeeringDB data.

The Switzerland-Columbia math during the FIFA World Cup caused an all-time traffic peak at the Swiss Internet Exchange with more than 1Tbsp.

In July 2024, Bangladeshi disappeared from the Internet for some time. This blog post analyses this event from routing data.

Martin Hellman shares in a recent article in Communications of the ACM the early days of public key cryptography and the creation of the Diffie-Hellman key exchange scheme.

Networking notes for July 2026

2026-07-10T00:00:00+00:00

Researchers at Foundation Bruno Kessler in Italy have collected 50 million TLS sessions established by computers in their institution to analyze the different versions of TLS that are currently used. Their technical report provides interesting insights on the deployed TLS implementations.

Interesting analysis of the public peerings deployed at IXPs. Akamai leads with 79 Tbps of capacity, three times more than Google.

Nice animation showing the deployment of Starlink terminals in Europe during the last five years.

A very detailed discussion on how to setup your own email server. Over the years, with the growth of spam and other email related problems, running an email server has been more and more difficult. As the Internet is a decentralized system, this is a very good exercise for students willing to learn or to operate real production servers.

The Unicode consortium regularly discusses proposals for new characters. This includes various emojis. Charlotte Eiffel Lilith Buff maintains a list of all rejected emojis.

RFC10008 describes the new QUERY method for the HTTP protocol. This method should in the coming years replace the existing usage of GET or POST to send a request with queried values to a specific server. This is also the first published RFC whose number is above 10000!

RFC9958 provides a clear description of post quantum cryptography for network and protocol engineers.

Interesting discussion in IEEE Spectrum with various examples showing how our smartphones, connected cars and other devices collect data that is often requested by police officers.

In the USA, 5G Fixed Wireless Access (FWA) already serves more than 14 million customers. This becomes a widespread Internet access technology, next to xDSL, cable, fiber and satellite.

A problem with the time service caused a huge outage in the Telstra network in Australia when it went back in time to November 2006.

Doug Madory provides a closer look at the impact of World Cup football matches on Internet traffic.

Networking notes for June 2026

2026-06-01T00:00:00+00:00

Packet trimming is a technique that allows switches to trim packets when they are congested and only send their headers. This allows receivers to detect congestion faster and request retransmissions faster than with regular packet losses. Costin Raiciu explains that Broadcom’s switches do offer native trimming support, and Thor Ultra implements MRC in hardware. A more detailed description appeared in a technical report.

Safari and Firefox adjust the way they interpret the HTML, CSS and JavaScript of some popular web sites like TikTok or Netflix.

The GEANT network migrated.

The RFC-Editor website which publishes the Request For Comments has been updated. It’s now easier to access the RFC documents.

Metanorma has released a set of software tools that make it easier to write contributions to various standardisation bodies.

While fat-tree topologies are very popular in datacenters, Amazon announced that it has started to use random networks in its recent datacenters.

Cryptool is an online platform that provides many resources of interest to self-educate and to teach about cryptology.

Networking notes for May 2026

2026-05-04T00:00:00+00:00

The RIPE Atlas is an open measurement platform that collects measurement data (ping, traceroute, …) about Internet performance throughout the world. Yevheniya Nosyk describes in a blog post what happens on a typical day on this platform.

The Calypso project leverages traceroute data to provide detailed maps of the submarine cables.

Julia Evans has contributed new examples to the tcpdump manpage.

Flavio Luciani shares traffic graphs from an Indonesian IXP showing how Internet traffic changes during Ramadan.

In a series of posts on Mastodon, Kenneth Finnegan describes in detail what’s inside a 100 Gbps LR4 optic. Interesting read if you’d like to understand what’s inside these « connectors ».

Geoff Huston provides a nice explanation on how time is managed on the Internet.

A nice visualisation based on DNS MX records shows where email of 2,100 Swiss municipalities are hosted.

In a short article published in IEEE Spectrum, Malik Tatipamula and Vint Cerf describe the last 40 Years of Wireless Evolution in cellular networks and the evolution from 1G to the forthcoming 6G.

The IPv6 over nothing IETF draft proposes to use IPv6 without an underlying datalink layer.

TLS Encrypted Client Hello is now officially published as RFC9849. Samuel Henrique explains in a short blog post how to use ECH with curl on Debian.

In a short blog post, Mark Nottingham explains how he used Notebook LLM to analyze the progress of IETF working groups.

Another demonstration of the importance of network connectivity. In Nordic countries, a large fractions of the payments in shops are done online. To cope with the risks of massive network disruptions, a new law enables offline payments in case of major network disruptions.

A set of Claude skills to explore the 3GPP specifications, from 2G to 6G.

An interesting blog post showing how a cheap NTP server evolved over time to obtain 26 nanosecond clock accuracy.

Linus Torvalds has started to remove old networking code from the Linux kernel. This removal affects protocols such as AX.25 (amateur radio), ATM, and old Ethernet drivers.

Reflections on the implementation of the Carrier Pigeon Internet Protocol, RFC1149, 25 years later

Networking notes for March 2026

2026-03-02T00:00:00+00:00

Mike Dano provides an interesting analysis of the deployment and performance of satellite based Internet access networks (mainly Starlink) based on Speedtest measurements.

Bruce Davie discusses the potential impact of improved shortest path computation algorithms on link state routing protocols such as OSPF and IS-IS.

Ivan Pepeljnak provides interesting information about the performance of routers thirty years ago and how they shaped some of the design of MPLS.

Since the early days of the Internet, telnet has been a very popular method to access remote servers. It has been slowly replaced by ssh since the late 1990s. Recently, a severe flaw has been identified in one of the most popular implementations of telnet that is deployed on a wide range of embedded devices. A recent study shows that multiple ISPs have started to block TCP on port 23 to prevent exploitation of this vulnerability.

An interesting NANOG presentation describes the BGP architecture of the Netflix network.

The BGP clock is an interesting experiment that allows detection of BGP zombies on the Internet. A BGP zombie is an IP prefix that has been withdrawn but whose route is still present in some routers.

Geoff Huston provides his annual review of the evolution of the global BGP routing tables.

A free IP geolocation database is available from https://ip66.dev/.

Arelion, aka AS1299, one of the international Tier-1 ISPs, provides an interesting graph on the evolution of the traffic that it carries.

Mike Nottingham wrote an interesting opinion explaining why the Internet is and should remain an open system.

Internet exchange Points (IXP) are a key component of the Internet as they allow ISPs to peer at different locations. Tommaso Caiazzi shows how to build a digital twin to reproduce such an IXP using Kathara.

The BBR congestion control algorithm is replacing the CUBIC algorithm in some TCP implementations. A recent survey (36 pages!) summarizes the literature on this congestion control scheme and provides some measurement results.

Mingwei Zhang and Bryton Herdes provide a nice description of the Autonomous System Provide Authorization (ASPA) that extends the RPKI to secure interdomain routing.

Some git repositories are being overloaded by companies that create thousands of git pulls per day due to misconfiguration or bad practices.

Networking notes for February 2026

2026-02-01T00:00:00+00:00

Two interesting blog posts on RIPE Labs explore the Internet Routing Registries. These databases contain information about the prefixes originated by various Autonomous Systems. The first post explained the operation of these registries. The second post analyzes the quality of the data store in these registries.

Ookla reveals interesting data about the uplink capacity in 5G networks.

Job Snijder published his yearly summary of the evolution of the RPKI on the NANOG mailing list.

Nice video showing how passkeys work to authenticate users on web sites.

Luc de Brandere posted on LinkedIn a really nice drawing by Alix Garin to celebrate the 25th birthday of Wikipedia which continues to operate outside today’s surveillance economy.

A blog post explains why putting datacenters in space is a really bad idea in case you thought about it. Another blog post also explains why AI datacenters in space are a bad idea. On a related topic, Margo Anderson discusses in IEEE Spectrum the increased saturation of the low orbits that are used by constellations like Starlink.

There are more and more airplanes that provide Internet connectivity. Thomas Dreibholz provides detailed measurements of the performance of his connection on a transatlantic flight.

The Internet Engineering Task Force (IETF) held its first meeting forty years ago in San Diego. There were 21 participants. Today more than 8000 people participate to the IETF.

Networking notes for January 2026

2026-01-19T00:00:00+00:00

Mallik Tatipamula and and Vint Cerf discuss the past and the future of the 7 phases of the Internet

Simon Leinen discusses Packet trimming, a technique that emerged from research and now appears in datacenter.

Cloudlfare provides more information about the TCP connections that they observe in their network in a blog post

Philipp Tiesel has developed a new interactive website that allows companies to verify that their websites fully work for IPv6-only clients. Try it out at https://webres6.dev.sap

The IPv6 specification is now 30 years old, much older than the students who follow the networking courses.

Andra Lute describes briefly how roaming works among cellular network operators

Ookla provides interesting information about the performance of mobile networks in UK

John Kristoff and Max Resing discuss attacks on DNS root servers

Linux kernel developers rely on email to exchange patches to build the next version of the kernel. However, this email-based workflow is getting more and more fragile according to a recent update by Konstantin Ryabitsev.

Zi-Li Meng and his colleagues show that a student equipped with AI glasses can achieve excellent grades at a networking exam without any prior knowledge. They help students to answer exam questions. See https://xg.glass/posts/network-exam-test/

A detailed description of Kimwolf, an emerging Android TV botnet that has already infected more than 1.8 million devices and can be used to launch DDoS attacks, is available.

Cloudflare published its state of the Internet report for 2025.It provides many graphs showing the evolution of the web as seen from Cloudflare with metrics such as the adoption of the different versions of HTTP, IPv4 versus IPv6, the most popular browsers, but also the growth of AI bot traffic.

Netflix’s video streaming service generates a large amount of Internet traffic. This blog post provides more details on the new video codecs used by Netflix.

What are the most popular Internet services ? Joao Tomé analyzes the DNS requests sent to the 1.1.1.1 DNS resolver to reveal the most popular domain names in various categories.

Let’s Encrypt provides a large fraction of the TLS certificates used on the Internet. This democratization of TLS certificates was possible thanks to the adoption of the ACME protocol. Christophe Brocas explains the evolution of this protocol in an interesting blog post

RFC9460 defined the HTTPS and SVBC DNS resource records in November 2023. More than two years later, Jan Schaumann discusses the support for these records by different browsers.

A new edition of the book The Data Center as a Computer - Designing Warehouse-Scale Machines by Luiz André Barroso , Urs Hölzle, and Parthasarathy Ranganathan has been published as an open book. This is a recommended reading if you wish to understand the design principles of Google’s datacenters.

Andrew Cooks explains how to use tshark to detect various types of problems when streaming video over TCP.

The Ultra Ethernet specification describes how Ethernet can be enhanced to support datacenters that need to support large AI or HPC workloads. A recent arXiv report describes the main principles of this new technology. The authors also presented a two-hour tutorial on this topic.

Antonio Prato has released a website, https://ping6.it/ which allows one to compare the latency over IPv6 and IPv4 from multiple vantage points to reach a given destination.

2026 could be the year when wireless mesh networks from different vendors become interoperable thanks to the Thread 1.4 specification that unifies wireless mesh approaches.

ttl is a modern replacement for traceroute that collects multiple metrics.

Networking notes for November 2025

2025-11-09T00:00:00+00:00

Doug Madory publishes an interesting blog post describing the evolution of the top Tier-1 ASes during the last twenty years. Interesting to see that these top ASes regularly change.

XKCD published a nice comic illustrating ping with ICMP Echo request and Echo response.

Larry Peterson discusses his views on how the next generation of networking students should be educated in an interesting blog post

The RFC Editor has published RFC9868 which introduces a format for UDP options. This is an exercise in extending a very simple and old protocol like UDP. Despite the fact that the document is standards track, it is unlikely that it will be widely deployed.

Brian Krebs published an interesting article on his blog discussing the new Aisuru botnet and its DDoS capabilities.

Amazon Web Services had an outage on October 19th and 20th, 2025. Many web services became unusable during this period. AWS hosts a large number of services used y web sites and provides DNS services. A 2024 study predicted that 25% of the top 10,000 web sites would be affected by a failure of AWS. Dan Goodin provides some details about the failure in an article published by arts.technica. Luke Kehoe discusses the impact of the failure based on data from downdetector notably. AWS has published some technical details about the outage.

Generative AI applications have attracted millions of users world wide. A recent technical report analyzes 60 hours of packet traces collected on smartphones using ChatGPT, CoPilot and Gemini. They reveal different communication patterns and different protocols. All applications use TLS, but Gemini is the only one to use QUIC.

The HTTP protocol provides numerical status codes in response to each request. The https://http.pizza/ web site provides an image with a pizza which can be used as a way to provide additional information about the status codes. It also provides additional information about the status code leveraging https://http.dev/. A nice way to illustrate HTTP status codes.

ARCEP, the French telecommunication regular, published a very interesting study carried out by Plum that analyzes the deployment of optical fiber in France, taking into account the technical and the economical aspects. The report clearly explains the problems faced when deploying fiber and provides interesting statistics.

The US government could ban TP-Link from selling access routers in the US. In the US, most home users buy their own access router. By providing cheap prices, TP-Link, a Chinese company, has captured more than one third of the US market. Although the US government seems to be worrying that these routers could be used by state-sponsored hackers, the main problem with access routers is that they need to be correctly configured, maintained by upgraded when vulnerabilities are discovered. There is an interesting tussle to be discussed. In some countries, access routers are provided by the ISPs that manage and upgrade them. These ISPs have the expertise to manage the access routers of their customers and can react when problems occur. Unfortunately, this can limit innovation as ISPs will typically only deploy a few types of access routers that they manage and rent to their customers. On the other hand, the US model where each home user selects his/her access router could in theory encourage innovation since many brands can provide access routers. Unfortunately, home users often tend to keep their old access routers for (too) many years and have difficulties in managing them correctly. Which is the best approach ? User-controlled access routers which can be old and insecure ? ISP-controlled access-routers which will be more secure but might not evolve as expected by some users…

Networking notes for October 2025

2025-10-01T00:00:00+00:00

Cloudflare operates the 1.1.1.1 open DNS resolver. This resolver also supports DNS over HTTPS to protect name resolution from interception. When these protocols are used, the DNS client uses a TLS certificate for the 1.1.1.1 address to verify that it interacts with the right 1.1.1.1 server. Since the 1.1.1.1 address belongs to Cloudflare, this certificate should have been assigned to Cloudflare. However, in a blog post, Cloudflare reveals that they have detected that the Fine ÇA certification authority has issued multiple certificates for 1.1.1.1 during the last year. Even if these certificates were apparently mainly used for testing, this questions the validation process used by some certification authorities…

The BurningMan festival attracts more than 70,000 attendees during 9 days in the Nevada desert. A growing number of these attendees bring Internet connectivity with them. An Ookla study reveals that this year the festival attendees had a significant impact on the performance of Starlink in the region.

Several cuts affected optical fibres in the Red Sea recently. Doug Madory analyzes in a blog post the impact of the failures on latencies in several cloud services and also on BGP routing.

Distributed denial of service attacks continue to grow, unfortunately. In early September, an attack reaching 1.5 billion packets per second coming from IoT devices and CPE in 11,000 different networks was detected. Later, Cloudflare announced a new record for DDoS. They suffered an attack that peaked at 22.2 Tbps and 10.6 billion packets per second but lasted only 40 seconds.

Linux powers most Internet servers, Android smartphones, and many IoT devices. Jonathan Corbet, who leads LWN.net, provides a nice overview of the evolution of Linux and its ecosystem during the last three decades in a one-hour-long video containing lots of interesting details.

In an interesting article published by IEEE Spectrum, William Webb questions the quest for more and more bandwidth in access networks. The new generation of cellular technologies has brought higher bandwidth with each generation. Will we need even more bandwidth for 6G?

Today, cellular networks allocate one IP address to each smartphone. This will probably change in the coming months/years as Lorenzo Colitti and Patrick Rohr have announced that Android 11+ will include support for DHCPv6 prefix delegation. This will enable network providers to delegate a /64 IPv6 prefix to each smartphone, which will be able to act as a real router and serve other devices connected using Wi-Fi or other wireless technologies such as 802.15.4.

At the end of September 2025, America Online (AOL) has stopped its dial-up service. AOL was a giant during the Internet bubble in the late 1990s and was later replaced by ISPs and telecommunication providers offering various Internet access solutions. An IEEE Spectrum article summarises the last years of this service and reminds the young students of the era of dial-up modems.