Topic
Networking & DNS
DNS, TLS, packet capture, routing, sockets, SSH, and network debugging from the console.
TCP MD5 for BGP authentication is thirty years old. TCP-AO is the replacement. Nobody has migrated.
RFC 5925 (TCP Authentication Option) has been in the Linux kernel since 6.7 and is supported by FRR, BIRD, and OpenBGPD. The RFC 2385 TCP MD5 Signature hack has been authenticating BGP sessions since 1996. Two years after the kernel got a working alternative, most operators are still on the old thing.
The listen queue had been five since 2014
Nine years of incrementing connection drops, masked by retry logic added in 2017 and promptly forgotten. The counter was in netstat -s. The backlog was in ss -tlnp. Both said the same thing for nine years.
The ephemeral port range had eight hundred slots left
The inventory service was throwing EADDRNOTAVAIL on database connections. CPU fine. Memory fine. The connection pool was configured exactly as intended. That was the problem.
Landlock: per-process filesystem restriction without root
Linux had seccomp for syscalls and nothing for filesystem access for years. Landlock landed in 5.13 and fixed that. Here is how to use it without the silent no-op that catches everyone the first time.
DNSSEC validates about 38% of the internet. Here's why the other 62% hasn't moved.
DNSSEC has been production-ready since 2005 and the root zone has been signed since 2010. Two-thirds of DNS queries still aren't validated. The protocol is not the problem.
pledge(2) and unveil(2): what OpenBSD figured out that Linux is still catching up to
OpenBSD shipped two syscalls in 2016 and 2018 that let any unprivileged daemon sandbox itself down to exactly the filesystem paths and syscall categories it needs. Linux got there eventually, with seccomp-bpf in 2012, Landlock in 2021, and namespaces throughout. Compare and decide which one you'd rather write.
FreeBSD 14.5 ships: forty-three advisories patched, inotify in base
FreeBSD 14.5-RELEASE landed September 8. The security backlog is real and addressed. SA-26:08 is the advisory that should drive upgrades, not the inotify headline.
Eighteen years of wrong arithmetic in fragment reassembly: CVE-2026-80590
An undersized socket buffer in __ip6_append_data() since Linux 2.6.27 lets an unprivileged container process corrupt the host kernel and get root. Public PoC is out. Eight stable kernels have the fix.
The load was forty and the box was idle
Load average alert fired at 47.8 on an eight-core box. SSH'd in, ran top, saw 95% idle. Every metric looked healthy except the number that triggered the page. Thirty-two processes in D state, waiting on an NFS mount that had stopped answering three hours earlier.
FreeBSD 14.5 is out, EuroBSDCon starts tomorrow
FreeBSD 14.5-RELEASE dropped September 8 with a tty use-after-free fix via TIOCSCTTY ioctl, LLVM 21.1.8, OpenSSL 3.0.21, and XZ 5.8.3 in a year when people are still paying attention to XZ version numbers. EuroBSDCon opens in Brussels tomorrow.
SplitSSHell: a comma in a cert principal has been root in OpenSSH since 2011
CVE-2026-35414 put a 15-year-old logic bug in OpenSSH's certificate principal matching code back on the advisory circuit. If you run cert auth with authorized_keys cert-authority entries, you needed 10.3 in April. You probably didn't get it.
The machine that forgot what year it was
A dead CMOS battery on a physical box meant the hardware clock reset to January 1, 2000 on every reboot. NTP would correct it in about ninety seconds. Everything that happened during those ninety seconds was wrong in ways that took hours to untangle.
SO_REUSEPORT: each worker gets its own accept queue, and then the migration problem hits
Linux 3.9 added SO_REUSEPORT. Bind N sockets to the same address:port, the kernel hashes connections across them. Linux 4.5 added eBPF dispatch so you control the routing. The part nobody explains is what happens when one of those sockets disappears while connections are in flight.
FreeBSD 14.5-RC1 has a sound ioctl UAF and a hardware counter that ignored your credentials
FreeBSD 14.5-RC1 dropped August 29 with three security fixes. The use-after-free in SNDCTL_DSP_SYNCSTART is local privilege escalation. The HWPMC credential-transition bug is subtler and more interesting. Here is what they fixed and why the HWPMC one matters more than it sounds.
The conntrack table was full
Connections to services behind our firewall started failing intermittently. The iptables rules were correct, the NICs were clean, the routing was fine. The problem was a kernel table we had never configured, silently dropping packets when it ran out of room.
SCM_RIGHTS: send an open file descriptor to another process over a Unix socket
You can pass a live, open file descriptor to another process via Unix domain socket ancillary data. Not a path, not a number — the actual kernel file description, with whatever offset and flags it already has. The mechanism is POSIX, predates Linux, and almost nobody uses it directly.
splice and tee: zero-copy data movement, 2.6.17 edition
splice(2) and tee(2) have been in Linux since 2006. They move data through the kernel page cache without a userspace copy. How to use them for log fanout, network sends, and pipeline work that does not belong in the era of read/write loops.
ML-KEM has been the default SSH key exchange for two years. Enterprise IT just noticed.
OpenSSH 9.9 switched to post-quantum hybrid key exchange by default in October 2024. It is August 2026. Corporate jump boxes are timing out on handshakes and helpdesk queues are filling up. Here is what broke, why it broke, and the three commands that fix it.
The TCP window that ate a gigabit
The cross-datacenter link was provisioned for 1Gbps. iperf3 consistently showed 180Mbps. The hardware was clean, the routing was clean, the fiber was clean. The problem was a 208KB number that nobody had changed in years, and the unforgiving math of physics.
landlock: sandbox your process without root
Since Linux 5.13, landlock lets an unprivileged process restrict its own filesystem and network access using three new syscalls. No SELinux policy, no AppArmor profile, no root. Chrome uses it for renderer isolation. Here is how to wire it up.
Your curl switched to HTTP/3 without asking. The packet trace shows encrypted UDP.
Most major distributions now ship curl compiled with HTTP/3 support. Alt-Svc negotiation upgrades HTTPS sessions to QUIC silently. The TCP debugging workflow you have is unchanged. The transport under it is not.
memfd_create and file sealing: an anonymous file nobody can modify (including you)
memfd_create() gives you a file descriptor backed by anonymous memory, with no filesystem, no path, no name. Add F_SEAL_WRITE and the kernel refuses all future write access. Pass it across process boundaries via SCM_RIGHTS or pidfd_getfd. It's the right way to share immutable data between processes.
OpenSSL 3.0 EOL is two weeks out. If you pinned it, that's your problem now.
OpenSSL 3.0 LTS hits end-of-life on September 7, 2026. Five years of LTS support ends, security patches end, and every system still pinned to 3.0 starts the clock on unpatched CVEs. The upgrade path exists. Use it.
The pool was full of dead connections
An intermittent burst of broken-pipe database errors had been logged as "flaky" for two months before anyone looked closely enough to notice they were always the first query on a connection. The connection pool was handing out corpses.
`getrandom()` skips the kernel now. Took long enough.
Linux 6.11 shipped vDSO support for getrandom(). Every TLS handshake, UUID, and ephemeral key in your system is now getting random bytes from userspace without a syscall trap. The syscall was added in 2014. The optimization arrived a decade later. The implementation is correct. Both things are true.
ss -i shows you what netstat never could: TCP internals live
Everyone knows ss -tulnp. Almost nobody uses ss -i, which surfaces congestion window size, RTT, retransmit counts, and send/receive buffer fill, directly from the kernel, no tool required.
OpenSSH 10.0 drops DSA, CBC, and SHA-1 HMAC. About damn time.
OpenSSH 10.0 removes DSA keys, CBC cipher modes, and SHA-1 HMAC completely. Not deprecated with a warning. Removed. If your network gear or embedded systems are still negotiating any of these, your next maintenance window just got scheduled for you.
ip netns is what container networking actually is. No daemon required.
Network namespaces give a process its own routing table, its own interfaces, and its own firewall rules, in milliseconds. Docker creates them. Kubernetes creates them. You can too, from ip, without touching a container runtime.
The post-quantum key exchange already happened. You didn't notice. Good.
NIST finalized ML-KEM two years ago. OpenSSH shipped the hybrid key exchange into default KEX negotiation and most connections quietly upgraded. The certificate half of the post-quantum transition is not going to be that clean.
Your browser encrypted your DNS queries. It also decided who gets to read them.
DNS-over-HTTPS is a correct answer to a real problem, cleartext DNS has been leaking every hostname you visit since 1983. The way browsers deployed it, pointing users to Cloudflare and Google by default without explanation, is a different story. The encryption is real. The 'privacy' framing is doing a lot of work.
Your container is six clone(2) flags. nsenter gets you back in.
Containers are six kernel namespaces and nothing else. nsenter gets you inside from the host without docker exec, without touching the image, and without whatever tooling the vendor decided to ship.
Rust in the Linux kernel is not failing. I need to update my priors.
When Linus merged Rust support in 6.1, I gave it eighteen months before the borrow-checker arguments turned into flame wars and the whole experiment got ripped out. Real drivers are shipping. I was wrong about the trajectory.
socat is the Swiss Army knife you keep reaching past
netcat forwards a port. socat forwards a port, wraps it in TLS, splices it to a Unix socket, proxies serial-over-TCP, and lets you inject raw bytes mid-stream. You already have it installed. Here is how to actually use it.
dig +trace, and how to tell whose DNS is actually lying to you
"It's a DNS problem" is where debugging stops. +trace walks the delegation from the root yourself, +norecurse asks a resolver what it has cached without letting it go fetch, and together they tell you whether the bad answer is the zone, the resolver, or the client.
Two uplinks, one box, and the reply going out the wrong interface
The routing table picks a route by destination. When you have two upstreams, replies to traffic that arrived on the second one leave via the first, get dropped by the upstream's anti-spoofing, and vanish. ip rule and a second routing table fix it properly.
Stop waiting beside tcpdump like it owes you an incident
Intermittent network failures do not happen while you are watching. Use tcpdump's rotating capture files, size limits, and post-trigger preservation to keep the packets that existed before the pager fired.
"Cannot assign requested address" is not a DNS problem. You're out of ports.
A client making thousands of short-lived outbound connections exhausts the ephemeral range, and every tuple sits in TIME_WAIT for a minute afterwards. Here's how to confirm it in one command and the three fixes, ranked by how much you'll regret them.
OpenSSH is finally done pretending your 2009 SSH config was acceptable
The OpenSSH project continues ripping out legacy cryptography: DSA keys gone, SHA-1 gone, post-quantum key exchange on by default. RodHat runs through what breaks and what you should have burned years ago anyway.
Debug a TLS handshake by hand with openssl s_client
"Certificate verify failed" is four different bugs wearing one error message. s_client shows you the chain the server actually sent, in order, with the verify result per link, which is how you find the missing intermediate in about twenty seconds.
The migration was flawless. The TTL was 86400.
Six weeks of planning, a rehearsed cutover, and a maintenance window we finished forty minutes early. Then a fifth of our traffic kept arriving at a datacentre we'd already started decommissioning, for a full day, and there was nothing whatsoever we could do about it.
Process supervision is a 40-line problem. It has been solved since 1997.
You don't need a service manager with a DNS resolver in it to restart a daemon that died. daemontools, runit and s6 do supervision trees, log rotation and clean shutdown in a handful of files, and the design idea underneath them is worth stealing even if you never install one.
Certificate lifetimes are collapsing to 47 days and your renewal process is a person
The CA/Browser Forum voted to phase TLS certificate validity down to under seven weeks by 2029. If your renewal runbook has a human in it, the schedule just became your problem, and that's the actual point of the change.
Your ssh is reconnecting every single time. It doesn't have to.
ControlMaster reuses one TCP connection and one authentication for every subsequent session to the same host. Combine it with ProxyJump and a Match block and the difference between a 900ms hop and a 20ms one is four lines of config you write once.
The xz backdoor was a social engineering attack and we responded with more scanners
Two years on, the thing that nearly shipped a compromised sshd into every distro on earth wasn't a code flaw. It was a burned-out maintainer, a patient stranger, and a pressure campaign. Almost every mitigation since has been aimed at the wrong layer.
The Friday deploy that ate my weekend, and whose fault it actually was (mine)
A sysadmin war story about a Friday-afternoon deploy, a silent DNS TTL assumption, and the two-day outage it caused. RodHat owns every part of it.
Stop guessing what's listening on that port
netstat -an tells you a socket is open. It does not tell you which process opened it, which user owns it, or whether the accept queue is already overflowing. ss and sockstat do, and they take the same three seconds.