nftables: The Modern Linux Firewall
Your iptables rules already run on nftables. Handles, named sets, inet tables and atomic ruleset loads, all proven with real output from a live lab.
Network Security
Hardening the network you already run. Articles tagged Network Security cover control-plane protection, access control, segmentation, and the attacks each countermeasure is actually stopping.
Latest posts
iptables Fundamentals: Tables, Chains, Real Rules
Tables, chains and rule order, demonstrated with real captures from a Debian host in a live lab: DROP against REJECT timing, conntrack, logging and NAT.
netcat: Port Checks, File Transfers, Listeners
Open, refused, timed out and no route to host are four different tickets. Plus banner grabs, file transfer with no server, and why UDP tests lie.
The Layer 2 Attack Surface: A Hardening Checklist That Actually Holds
The default Layer 2 posture is wide open. This checklist ties every switch-hardening control to the specific attack it stops, with live CML proof where possible: 8 spoofed ARPs dropped, an intra-VLAN ping killed, and more.
Private VLANs: Isolating Hosts That Share a Subnet
Private VLANs isolate hosts that share a subnet, at Layer 2, without a subnet per host. Primary, isolated, and community secondary VLANs on Cisco IOS XE, with the classic DMZ use case and real show output.
VLAN ACLs (VACLs): Filtering Traffic Inside a VLAN
A router ACL only sees routed traffic, so it can never filter two hosts in the same VLAN. A VACL can. Real CML before/after: intra-VLAN ping goes 0% to 100% loss while the gateway ping still works.
Static ARP ACLs: Inspecting ARP Without DHCP Snooping
DAI needs DHCP snooping bindings to validate ARP. On a static-IP segment there are none, so you supply the legitimate IP-to-MAC pairs with a static ARP ACL. Proven in CML: 8 spoofed ARPs dropped.
Router Service Hardening: Turning Off What You Never Needed
Harden a Cisco router by disabling unused services, proven with a real before-and-after Nmap scan taking Telnet from open to closed, plus syslog design.
NTP Authentication: Trusting the Clock Your Logs Depend On
Configure authenticated NTP on Cisco IOS XE, why IOS flags MD5 as weak, and how ntp authenticate and trusted-key stop a rogue server moving your clock.
Anti-Spoofing on the Edge: ACLs, uRPF, and RFC 2827 in Practice
Build RFC 2827 (BCP 38) anti-spoofing with an ingress ACL and uRPF strict mode, tested with real spoofed packets and live Cisco ACL log evidence.
CoPP vs CPPr: Which Control-Plane Defense to Deploy
CoPP is one aggregate policer; CPPr subdivides the control plane and adds port-filtering. A decision guide backed by a real CoPP police capture.
Control Plane Protection (CPPr): Beyond CoPP with Port-Filtering
CPPr subdivides the control plane into host, transit and cef-exception subinterfaces and adds port-filtering, next to real CoPP police captures from CML.