Michael Zamot

A Linux host as a PE router: layer 2 over an SRv6 VPN

Sat, 25 Apr 2026 00:00:00 +0000

A provider edge (PE) router is where a network attaches to a provider’s VPN service. It is normally a dedicated router or switch, and the machines that need the service plug into it. But when the machines are Linux hosts that run virtual machines, containers or cluster workloads, there is another option: let the host attach to the VPN itself. The host then needs to do what a PE does, which is keep its routing in a VRF, speak BGP, encapsulate traffic into the provider’s tunnels, and, if the workloads need it, stretch a layer 2 segment to other hosts.

L3VPN over SRv6: separate customer networks on one backbone

Sat, 18 Apr 2026 00:00:00 +0000

A service provider runs one backbone and sells private networks over it. Each customer expects their sites to be connected as if they had their own network, with their own addressing, invisible to everyone else. Two customers will happily pick the same subnet, and the backbone has to carry both without mixing them up. This is the layer 3 VPN (L3VPN) service, and it is one of the most widely deployed services in provider networks.

SRv6: segment routing over IPv6

Sat, 11 Apr 2026 00:00:00 +0000

An IP network normally forwards each packet by its destination address alone, and the path is whatever the routing protocols compute. That is usually what you want, until you need traffic to take a specific path, pass through a particular node, or arrive at a particular place with an instruction attached, such as “deliver this inside customer A’s VPN”. Networks have traditionally done that with extra machinery: MPLS label stacks, and the protocols that distribute the labels.

Network namespaces and VRFs: separate routing on one Linux host

Sat, 04 Apr 2026 00:00:00 +0000

A router often serves more than one customer, and customers don’t coordinate their address plans. Two of them can both use 10.0.0.0/24, and the router has to keep their traffic and their routes completely apart. Service providers solve this with VRFs, and the same need appears on any Linux host that runs containers, virtual machines or several services that must not see each other’s networks.

Linux has two mechanisms for it. A VRF gives you separate routing tables on one shared network stack. A network namespace gives you a separate network stack altogether. They solve related problems at different depths, and they are often combined. This post explains both, shows what each one isolates, and connects them with veth pairs.

EVPN: a BGP control plane for VXLAN

Sat, 28 Mar 2026 00:00:00 +0000

VXLAN stretches a layer 2 segment across a routed network. A VXLAN tunnel endpoint (VTEP) wraps each Ethernet frame in a UDP packet and sends it to another VTEP, and a 24-bit segment ID, the VNI, says which segment the frame belongs to. What VXLAN does not define is how a VTEP finds out two things: which other VTEPs belong to a segment, and which VTEP a given MAC address lives behind.

VXLAN: stretching a layer 2 network across a routed one

Sat, 21 Mar 2026 00:00:00 +0000

Some workloads need to be on the same layer 2 segment, in the same broadcast domain and subnet, even when they sit in different racks: virtual machines that move between hosts, clustered applications that rely on broadcast or on a shared subnet, or legacy systems that were never designed for routing. The traditional answer is to stretch a VLAN across the switches between them. That makes the whole path one big layer 2 network, with the scaling and stability problems that come with it, and a VLAN ID is only 12 bits, so there are at most 4,094 of them.

BGP: how networks tell each other what they can reach

Sat, 14 Mar 2026 00:00:00 +0000

An interior routing protocol (an IGP) answers the question “how do routers inside one network reach each other?” by discovering the topology automatically. BGP answers a different question: “how do independently operated networks tell each other what they can reach?” It is the protocol that connects the networks of the internet, and it is also widely used inside data centers and provider networks.

BGP has no neighbor discovery of its own. You tell each router exactly who its neighbors are, and each router tells them which prefixes it can reach and how. That’s why so much of BGP is configuration.

IS-IS: how routers share a map of the network

Sat, 07 Mar 2026 00:00:00 +0000

Static routes work until the network changes. Add a router and every neighbor needs a new route. Lose a link and traffic keeps heading for a dead next hop until someone notices. A routing protocol replaces that bookkeeping: routers tell each other what they can reach, work out the best paths on their own, and recompute them when something fails.

IS-IS is one of the interior gateway protocols (IGPs) that do this, alongside OSPF. It is a link-state protocol, and it is widely used inside service provider and large data center networks. Every router describes its own links and the prefixes it owns, floods that description to the others, and ends up with the same map of the network as everyone else. Each router then computes shortest paths from that map.

Containerlab: a network lab on your own machine

Sat, 28 Feb 2026 00:00:00 +0000

Learning a routing protocol, reproducing a bug, or rehearsing a configuration change all need the same thing: a network you can break without consequences. The usual options are borrowed hardware, which is scarce and slow to rewire, or a hand-built lab of virtual machines, which takes an afternoon to set up and that nobody else can easily recreate.

Containerlab takes a different approach: the lab is a text file. It lists the nodes and the links between them, and containerlab turns that into a running network in seconds, using container images of real routing software. Because a lab is just files, you can keep it in git, hand it to a colleague, rebuild it identically next month, and delete it without leaving anything behind. The same labs can run in a CI pipeline as network tests.

IPv6 primer: addresses, address types and autoconfiguration

Tue, 15 Oct 2024 00:00:00 +0000

IPv6 was designed to solve IPv4 address exhaustion, and it does: there are about 3.4 × 10³⁸ addresses, enough that every device can have a globally unique one. But it is not just IPv4 with longer addresses. A few mechanisms work differently, and if you come to IPv6 from IPv4 those differences cause most of the confusion: addresses have types with different scopes, a device normally has several addresses at once, there is no broadcast and no ARP, and a host can configure itself without DHCP.

Finding rogue devices in your network using Nmap

Tue, 01 Dec 2020 00:00:00 +0000

Back to all posts

Nmap is a popular open-source network discovery tool used to discover and audit devices on a computer network. It can rapidly scan single hosts up to large computer networks, providing useful information about each host and its software.

Intruders in the network… Wait, what?

Every day, IoT products like smartwatches, fitness trackers, printers, smart cameras, and more are becoming part of our daily lives. Many of these devices are synchronized with our personal or work smartphones. Willfully or not, these devices may be connecting to your corporate network. At least half of the organizations have experienced this just in the last year, according to Infoblox.

An introduction to Cockpit, a browser-based administration tool for Linux

Tue, 14 Apr 2020 00:00:00 +0000

Back to all posts

Cockpit is a server administration tool sponsored by Red Hat, focused on providing a modern-looking and user-friendly interface to manage and administer servers. Fedora 21 included Cockpit by default, and since then, it has continued to grow and mature. Red Hat Enterprise Linux 7 included Cockpit in the optional and extras repositories, and it’s included in Red Hat Enterprise Linux 8 by default.

Cockpit is not the first of its class (many old-time system administrators may remember Webmin), but the alternatives are usually clunky, bloated, and their underlying APIs may be a security risk. That’s where Cockpit is different and shines. With Cockpit, unnecessary services or APIs don’t get in the way of doing things.

My Linux story: I grew up on PC Magazine not candy

Mon, 14 Oct 2019 00:00:00 +0000

In 1998, the movie Titanic was released, mobile phones were just a luxury, and pagers were still in use. This was also the year I got my first computer. I can remember the details as if it were yesterday: Pentium 133MHz and just 16MB of memory. Back in that time (while running nothing less than Windows 95), this was a good machine. I can still hear in my mind the old spinning hard drive noise when I powered that computer on, and see the Windows 95 flag. It never crossed my mind, though (especially as an 8-year-old kid), that I would dedicate every minute of my life to Linux and open source.

How to set up a homelab from hardware to firewall

Tue, 19 Mar 2019 00:00:00 +0000

Do you want to create a homelab? Maybe you want to experiment with different technologies, create development environments, or have your own private cloud. There are many reasons to have a homelab, and this guide aims to make it easier to get started.

There are three categories to consider when planning a home lab: hardware, software, and maintenance. We’ll look at the first two categories here and save maintaining your computer lab for a future article.

Getting started with Prometheus

Thu, 20 Dec 2018 00:00:00 +0000

Prometheus is an open source monitoring and alerting system that directly scrapes metrics from agents running on the target hosts and stores the collected samples centrally on its server. Metrics can also be pushed using plugins like collectd_exporter—although this is not Promethius’ default behavior, it may be useful in some environments where hosts are behind a firewall or prohibited from opening ports by security policy.

Prometheus, a project of the Cloud Native Computing Foundation, scales up using a federation model, which enables one Prometheus server to scrape another Prometheus server. This allows creation of a hierarchical topology, where a central system or higher-level Prometheus server can scrape aggregated data already collected from subordinate instances.

Control your data with Syncthing: An open source synchronization tool

Fri, 21 Sep 2018 00:00:00 +0000

These days, some of our most important possessions—from pictures and videos of family and friends to financial and medical documents—are data. And even as cloud storage services are booming, so there are concerns about privacy and lack of control over our personal data. From the PRISM surveillance program to Google letting app developers scan your personal emails, the news is full of reports that should give us all pause regarding the security of our personal information.

Getting started with Sensu monitoring

Thu, 23 Aug 2018 00:00:00 +0000

Sensu is an open source infrastructure and application monitoring solution that monitors servers, services, and application health, and sends alerts and notifications with third-party integration. Written in Ruby, Sensu can use either RabbitMQ or Redis to handle messages. It uses Redis to store data.

If you want to monitor your cloud infrastructure in a simple and efficient manner, Sensu is a good option. It can be integrated with many of the modern DevOps stacks your organization may already be using, such as Slack, HipChat, or IRC, and it can even send mobile/pager alerts with PagerDuty.

How to create an open source stack using EFK

Mon, 26 Mar 2018 00:00:00 +0000

Managing an infrastructure of servers is a non-trivial task. When one cluster is misbehaving, logging in to multiple servers, checking each log, and using multiple filters until you find the culprit is not an efficient use of resources.

The first step to improve the methods that handle your infrastructure or applications is to implement a centralized logging system. This will enable you to gather logs from any application or system into a centralized location and filter, aggregate, compare, and analyze them. If there are servers or applications, there should be a unified logging layer.

Where does OpenStack fit in a public cloud world?

Thu, 22 Mar 2018 00:00:00 +0000

Public clouds are taking over the world. Every day, more and more companies are moving their infrastructure to services like AWS or Microsoft Azure to save capital and operational costs. This begs the question: Where does this leave OpenStack?

In this post, we’ll explore how OpenStack is competing in a market dominated by public cloud providers, and how it is positioned to grow in the future, especially in the hybrid cloud business.