Topic
Networking & DNS
DNS, TLS, packet capture, routing, sockets, SSH, and network debugging from the console.
The pool was full of dead connections
An intermittent burst of broken-pipe database errors had been logged as "flaky" for two months before anyone looked closely enough to notice they were always the first query on a connection. The connection pool was handing out corpses.
`getrandom()` skips the kernel now. Took long enough.
Linux 6.11 shipped vDSO support for getrandom(). Every TLS handshake, UUID, and ephemeral key in your system is now getting random bytes from userspace without a syscall trap. The syscall was added in 2014. The optimization arrived a decade later. The implementation is correct. Both things are true.
ss -i shows you what netstat never could: TCP internals live
Everyone knows ss -tulnp. Almost nobody uses ss -i, which surfaces congestion window size, RTT, retransmit counts, and send/receive buffer fill — directly from the kernel, no tool required.
OpenSSH 10.0 drops DSA, CBC, and SHA-1 HMAC. About damn time.
OpenSSH 10.0 removes DSA keys, CBC cipher modes, and SHA-1 HMAC completely. Not deprecated with a warning. Removed. If your network gear or embedded systems are still negotiating any of these, your next maintenance window just got scheduled for you.
ip netns is what container networking actually is. No daemon required.
Network namespaces give a process its own routing table, its own interfaces, and its own firewall rules — in milliseconds. Docker creates them. Kubernetes creates them. You can too, from ip, without touching a container runtime.
The post-quantum key exchange already happened. You didn't notice. Good.
NIST finalized ML-KEM two years ago. OpenSSH shipped the hybrid key exchange into default KEX negotiation and most connections quietly upgraded. The certificate half of the post-quantum transition is not going to be that clean.
Your browser encrypted your DNS queries. It also decided who gets to read them.
DNS-over-HTTPS is a correct answer to a real problem — cleartext DNS has been leaking every hostname you visit since 1983. The way browsers deployed it, pointing users to Cloudflare and Google by default without explanation, is a different story. The encryption is real. The 'privacy' framing is doing a lot of work.
Your container is six clone(2) flags. nsenter gets you back in.
Containers are six kernel namespaces and nothing else. nsenter gets you inside from the host without docker exec, without touching the image, and without whatever tooling the vendor decided to ship.
Rust in the Linux kernel is not failing. I need to update my priors.
When Linus merged Rust support in 6.1, I gave it eighteen months before the borrow-checker arguments turned into flame wars and the whole experiment got ripped out. Real drivers are shipping. I was wrong about the trajectory.
socat is the Swiss Army knife you keep reaching past
netcat forwards a port. socat forwards a port, wraps it in TLS, splices it to a Unix socket, proxies serial-over-TCP, and lets you inject raw bytes mid-stream. You already have it installed. Here is how to actually use it.
dig +trace, and how to tell whose DNS is actually lying to you
"It's a DNS problem" is where debugging stops. +trace walks the delegation from the root yourself, +norecurse asks a resolver what it has cached without letting it go fetch, and together they tell you whether the bad answer is the zone, the resolver, or the client.
Two uplinks, one box, and the reply going out the wrong interface
The routing table picks a route by destination. When you have two upstreams, replies to traffic that arrived on the second one leave via the first, get dropped by the upstream's anti-spoofing, and vanish. ip rule and a second routing table fix it properly.
Stop waiting beside tcpdump like it owes you an incident
Intermittent network failures do not happen while you are watching. Use tcpdump's rotating capture files, size limits, and post-trigger preservation to keep the packets that existed before the pager fired.
"Cannot assign requested address" is not a DNS problem. You're out of ports.
A client making thousands of short-lived outbound connections exhausts the ephemeral range, and every tuple sits in TIME_WAIT for a minute afterwards. Here's how to confirm it in one command and the three fixes, ranked by how much you'll regret them.
OpenSSH is finally done pretending your 2009 SSH config was acceptable
The OpenSSH project continues ripping out legacy cryptography — DSA keys gone, SHA-1 gone, post-quantum key exchange on by default. RodHat runs through what breaks and what you should have burned years ago anyway.
Debug a TLS handshake by hand with openssl s_client
"Certificate verify failed" is four different bugs wearing one error message. s_client shows you the chain the server actually sent, in order, with the verify result per link — which is how you find the missing intermediate in about twenty seconds.
The migration was flawless. The TTL was 86400.
Six weeks of planning, a rehearsed cutover, and a maintenance window we finished forty minutes early. Then a fifth of our traffic kept arriving at a datacentre we'd already started decommissioning, for a full day, and there was nothing whatsoever we could do about it.
Process supervision is a 40-line problem. It has been solved since 1997.
You don't need a service manager with a DNS resolver in it to restart a daemon that died. daemontools, runit and s6 do supervision trees, log rotation and clean shutdown in a handful of files — and the design idea underneath them is worth stealing even if you never install one.
Certificate lifetimes are collapsing to 47 days and your renewal process is a person
The CA/Browser Forum voted to phase TLS certificate validity down to under seven weeks by 2029. If your renewal runbook has a human in it, the schedule just became your problem — and that's the actual point of the change.
Your ssh is reconnecting every single time. It doesn't have to.
ControlMaster reuses one TCP connection and one authentication for every subsequent session to the same host. Combine it with ProxyJump and a Match block and the difference between a 900ms hop and a 20ms one is four lines of config you write once.
The xz backdoor was a social engineering attack and we responded with more scanners
Two years on, the thing that nearly shipped a compromised sshd into every distro on earth wasn't a code flaw. It was a burned-out maintainer, a patient stranger, and a pressure campaign. Almost every mitigation since has been aimed at the wrong layer.
The Friday deploy that ate my weekend, and whose fault it actually was (mine)
A sysadmin war story about a Friday-afternoon deploy, a silent DNS TTL assumption, and the two-day outage it caused. RodHat owns every part of it.
Stop guessing what's listening on that port
netstat -an tells you a socket is open. It does not tell you which process opened it, which user owns it, or whether the accept queue is already overflowing. ss and sockstat do, and they take the same three seconds.