Almost every security control on a network protects traffic at Layer 3 and above. IPsec encrypts IP payloads, TLS encrypts sessions, and VPNs tunnel across untrusted networks. But all of them assume the Layer 2 link underneath is just a
The access list you learned for the CCNA (permit this host, deny that subnet) still works, but it does not scale and it does not express intent. When you have forty admin hosts, a policy that only applies during business
RA Guard and DHCPv6 Guard stop the loud attacks: rogue routers and rogue DHCP servers. But there is a quieter layer of IPv6 abuse that operates below them, at the level of individual addresses. A host that spoofs its neighbor&
In IPv4, a rogue DHCP server is a nuisance you can contain with DHCP snooping. In IPv6, the equivalent threat is worse and easier to trigger, because IPv6 hosts configure themselves from Router Advertisements, and any device on the segment
Source IP addresses are trivially forged. Nothing in the IP header proves the source is who it claims to be, and a packet with a lie in the source field is the raw material for reflection attacks, spoofed floods, and
Every router has a CPU, and that CPU is a shared, finite resource that both keeps the network running (OSPF hellos, BGP updates, your SSH session) and can be trivially overwhelmed by traffic aimed at it. A flood of pings
The moment more than one person can log into your routers, you have an access-control problem. Who is allowed in? What are they allowed to do once they are in? And can you prove, after the fact, who typed
There is a particular kind of fear that stops engineers from using the most powerful troubleshooting tool on a Cisco router. You type debug ip packet, the console erupts, the CPU pins at 100 percent, the box stops forwarding, and
Most networks need to agree on what time it is to within a second or so, and NTP has done that job well for forty years. Then there are the networks where a second is an eternity: a trading floor
IPv6 host addressing is where a lot of otherwise competent engineers quietly lose confidence, because there are three mechanisms that can all be running at once, they interact through two obscure flag bits in a router advertisement, and a host
Eventually every network problem reaches the point where you have to see the actual packets. Counters lie by omission, logs tell you what the device thought, and NetFlow tells you a conversation happened without telling you what was in it.
A static route has one fatal flaw: it believes in itself. As long as the outgoing interface is up, the route stays in the table, even if the next hop died, the far end of the circuit is a black