Tony

Tony

@tonhe.bsky.social

Dad, husband, geek

314 followers88 following45 posts

Tony
@tonhe.bsky.social

Tailworm is 11 unpatched findings in Tailscale and headscale. The SSH ones turn one compromised device into root on its peers. What I'd lock down this week, no patch required. routerjockey.com/tailworm-tai...

routerjockey.comTailworm: What to Lock Down in Tailscale Before the Patch LandsA researcher published 11 unpatched Tailscale and headscale findings, led by an SSH forwarding bug that turns one compromised device into root on its peers. Here's what you can change today.
Tony
@tonhe.bsky.social

Log into a dual-homed Linux server, cat /proc/net/bonding/bond0, and it shows one partner System ID. Two switches keep that lie straight. Part 2 of my link aggregation deep dive covers vPC, MLAG, and the IEEE standard nearly everyone ignored. routerjockey.com/multi-chassi...

routerjockey.comLink Aggregation Deep Dive, Part 2: The Multi-Chassis LieHow vPC, MLAG, MC-LAG, VLT, VSX, and CLAG all spoof one LACP System ID across two switches, how each pair keeps the lie consistent and fails, and why the industry ignored the IEEE standard that …
Tony
@tonhe.bsky.social

Your YubiKey fires a 44-character OTP into whatever has focus every time your palm brushes it. Slot 1 ships that way from the factory. One command moves it behind a deliberate 3 second hold, and nobody ever mentions it. routerjockey.com/yubikey-otp-...

routerjockey.comNobody told me about ykman otp swapYour YubiKey fires a Yubico OTP on any short touch because slot 1 ships that way from the factory. Two commands fix it, and one of them has a catch worth knowing about first.
Tony
@tonhe.bsky.social

Nine lines of YAML turned into three FRR routers running OSPF, every address assigned and every adjacency full, before I'd have finished wiring the first link by hand. Part 1 of Labs as Code covers the netlab install and that first lab. routerjockey.com/labs-as-code...

routerjockey.comLabs as Code, Part 1: Install netlab, Build a Lab in Five Minutesnetlab turns nine lines of YAML into a running, converged lab. Install it, build your first FRR topology, and stop hand wiring labs.
Tony
@tonhe.bsky.social

Four 10-gig ports in an LACP bundle, and the backup still runs at 10 gig flat. Nothing's misconfigured. The standard refuses to say which link a flow lands on and hands the whole job to the vendor. Which is where the good failures come from... routerjockey.com/link-aggrega...

routerjockey.comEtherChannel, Bond, Team, LAG: How Link Aggregation Actually WorksWhat IEEE 802.1AX mandates, what it deliberately leaves to the vendor, and why a single flow on a 4x10G bundle still tops out at 10G.
Tony
@tonhe.bsky.social

An AI agent built an SRv6 L3VPN lab live on stage at CHI-NOG 13, BGP came up with zero prefixes, and the agent debugged its own configs while the presenter kept his hands off the keyboard. My writeup of Taran Deshpande's demo... routerjockey.com/deshpande-ai...

routerjockey.comThe Demo Broke and the Agent Fixed It: Taran Deshpande at CHI-NOG 13Taran Deshpande's CHI-NOG 13 live demo. An AI agent designs an SRv6 L3VPN lab, BGP comes up with zero prefixes, and the agent loops back and debugs its own configs. Why the failure loop beats one shot...
Tony
@tonhe.bsky.social

Docker Compose for Your Home Lab, Part 2. Pi-hole for the whole house in one compose.yaml... ad blocking DNS you can commit, back up, and rebuild on any box. Plus the Pi-hole vs Technitium call and the port 53 fight with systemd-resolved. routerjockey.com/docker-compo...

routerjockey.comDocker Compose for Your Home Lab, Part 2: Your First Useful StackYour first useful Docker Compose stack, with Pi-hole. Volumes, environment variables, healthchecks, and how to keep your home lab from being a single point of forgetting.
Tony
@tonhe.bsky.social

Git for Network Engineers, Part 4. Shared runbook repo, and last week somebody pushed broken YAML to main. The fix isn't "be more careful." It's branch protection, CI on every push, and a hook that refuses the bad commit. routerjockey.com/git-for-netw...

routerjockey.comGit for Network Engineers, Part 4: Going ProGit workflows that scale to teams. Pull request etiquette, branch protection, signed commits, and how to make CI work for your network configs the way it works for code.
Tony
@tonhe.bsky.social

In 2015 Matt Griswold argued a commercial, privately owned IX was the right way to build one. At CHI-NOG 13 he came back to say he'd be wrong to argue it now... and he's already racking the nonprofit version at 350 E Cermak. routerjockey.com/griswold-com...

routerjockey.comMatt Griswold Is Building the IX He Argued Against (CHI-NOG 13)The founder of United IX came back to CHI-NOG to say his 2015 commercial IX argument no longer holds. Open Pipes, one nonprofit umbrella for many exchanges, and a new community fabric already racked …
Tony
@tonhe.bsky.social

Your Pi-hole died on a reboot, the blog post you built it from is gone, and there's a ~/pihole-data directory you're afraid to delete. Docker Compose for Your Home Lab starts today with the article I should've written seven years ago: routerjockey.com/docker-compo...

routerjockey.comDocker Compose for Your Home Lab, Part 1: A Container Is Not a Tiny VMFrom zero to your first running container. Why Docker beats running things directly on the host, the difference between images and containers, and the one-line Compose file that gets you started.
Tony
@tonhe.bsky.social

Somebody asks in standup: why did we change the ACL on edge-fw-02 last quarter? The answer is already in your repo. Git for Network Engineers part 3 is live: log, blame, bisect, and the rebase cleanup that makes your PRs reviewable: routerjockey.com/git-for-netw...

routerjockey.comGit for Network Engineers, Part 3: Reading the Crime SceneReading and reshaping git history. Rebase, cherry-pick, bisect, and the interactive workflows that turn git from a backup tool into a thinking tool.
Tony
@tonhe.bsky.social

Nobody's born fluent in binary. Four free trainers just landed on the routerjockey tool rack: IPv4 and IPv6 subnetting with practice drills, plus binary and hex. No backend, no accounts, and the drills make share links built for taunting coworkers: routerjockey.com/training-too...

routerjockey.comNobody's Born Fluent in BinaryFour free client-side training tools join the /tools page: IPv4 and IPv6 subnet trainers with drills and shareable streak challenges, plus binary and hex trainers. No backend, no accounts.
Tony
@tonhe.bsky.social

Claude Fable wrote a ~700 test suite for viaduct. Zero bugs found while writing it... overkill, right? Week one: fuzzing caught a config parser crash, macOS CI caught a concurrency race. Both fixed in v0.2.1. github.com/tonhe/viaduc...

github.comRelease v0.2.1 · tonhe/viaductvia v0.2.1 Two fixes for issues surfaced by the automated test suite added in v0.2.0 — one caught by weekly fuzzing, one by the cross-platform CI race detector. Fixed Config no longer crashes on ...
Tony
@tonhe.bsky.social

Nick Buraglio opened his CHI-NOG 13 talk with “one of my jobs is taking IPv4 out of the network.” ESnet has run IPv6-only in production since 2018. My writeup of the talk that finally made the v6 pitch land: routerjockey.com/buraglio-ipv...

routerjockey.comIPv6: Why You Should Care (Nick Buraglio at CHI-NOG 13)Nick Buraglio on why IPv6 stopped being optional. ESnet's IPv6-only management network since 2018, the dual-stack-forever trap, hyperscaler RFC 1918 exhaustion, and what AI infrastructure changes.
Tony
@tonhe.bsky.social

I went into NFD40 expecting AI networking to be marketing in new vocabulary. It's a different design problem. Two enormous GPU flows can hash onto one uplink and stall the whole collective while every link reads healthy. Wrote up the recalibration. routerjockey.com/nfd40-lesson...

routerjockey.comWhat NFD40 Taught Me About AI NetworkingWhat NFD40 taught me about AI networking. Why collective communication breaks ECMP assumptions, the port math at 100K GPUs, Arista's case for XPO over CPO, and why scale-up, scale-out, and …
Tony
@tonhe.bsky.social

The IETF sometimes invents something new and sometimes just writes down what everyone already does. RFC 10005 (weighted ECMP) is the second kind, a 17-year draft finally blessed right as AI became the case it handles worst. Wrote up why. routerjockey.com/bgp-link-ban...

routerjockey.comSometimes the Internet Standardizes Reality Instead of Inventing ItRFC 10005 made the BGP Link Bandwidth Extended Community a Proposed Standard after seventeen years as a draft, a feature vendors shipped and operators ran long before the IETF blessed it. Why weighted...
Tony
@tonhe.bsky.social

Part 2 of Git for Network Engineers is the oh-shit toolkit: undo a commit, rescue a deleted branch, fix a committed credential, recover from a bad force-push. Trust reflog and git stops being scary. routerjockey.com/git-for-netw...

routerjockey.comGit for Network Engineers, Part 2: The Oh-Shit ToolkitRecovering from disasters in git. Undoing commits, restoring deleted branches, fixing committed credentials, and why reflog is the time machine that has saved more careers than any tool I know.
Tony
@tonhe.bsky.social

That "60% of prefixes have valid ROAs" stat everyone cites? Coverage isn't enforcement. Bryton Herdes (Cloudflare) at CHI-NOG 13 tested 15 tier-1s with a long-prefix bypass. 2 accepted a /32 hijack that ROV should've killed on sight. One of them ate quad1. routerjockey.com/herdes-long-...

routerjockey.comFalse Immunity: Long Prefixes That Bypass ROV (CHI-NOG 13)ROV is the foundation of modern routing security. It has a hole. Bryton Herdes at CHI-NOG 13 on AS3356, AS6461, and how long-prefix TE customers are inadvertently breaking ROV protection.
Tony
@tonhe.bsky.social

Jeff Doyle keynoted CHI-NOG 13 on the Network Automation Framework. Wrote up the parts worth keeping: the six-layer framework as a BS-detector for vendor demos, the return of "single source of truth," and why engineers lose the budget argument to execs. r0ute.net/doyle-naf

r0ute.netJeff Doyle on the Network Automation Framework: CHI-NOG 13Jeff Doyle's CHI-NOG 13 keynote on the Network Automation Framework. The six layers worth knowing, the cultural-resistance trap that kills most automation projects, and the engineer-to-executive …
Tony
@tonhe.bsky.social

The most honest moment at CHI-NOG 13: I asked Brad Gorman (ARIN) what stops someone spoofing a sub-AS as the real origin, and he said “Nothing.” BGPSec died, RPKI won, ASPA is finally shipping. Where routing security actually stands in 2026 (spoiler: not “solved”): routerjockey.com/arin-chinog13

routerjockey.comARIN at CHI-NOG 13: The State of Routing SecurityBGPSec didn't ship. RPKI did. A walkthrough of where RPKI and ROV stand in 2026, the gaps Brad Gorman's ARIN workshop exposed, and what's coming next with ASPA.
Tony
@tonhe.bsky.social

Upscale AI at NFD40: no products yet, but the best AI networking tutorial of the year. Why ECMP fails with 10 flows vs 10K. Why one packet stalls the collective. SkyHammer (scale-up), Spectrum-X (scale-out). Good pitch. Now ship. routerjockey.com/upscale-nfd4...

routerjockey.comUpscale AI at NFD40: The Pitch Before the ProductAbout thirty seconds into Aravind Srikumar’s NFD40 talk, he said the thing that made me stop fidgeting and start paying attention: “We haven’t announced any products yet.” That’s an unusual opener for...

You are up to date.