Morteza
Bahmani

Older Posts

• SSH Certificates vs. Key Files: Why Production Ops Teams Are Finally Moving Sep 14, 2026

  Key files don't scale. SSH certificates solve revocation, audit trails, and onboarding at production scale—here's why adoption is accelerating.

• BGP Flowspec False Positives: When DDoS Filters Block Legitimate Traffic Sep 13, 2026

  Flowspec rules are coarse-grained. They catch attack traffic and legitimate traffic alike. How to monitor, whitelist, and protect your critical services from collateral damage.

• Kernel Socket Tuning for High-Concurrency Load Balancers: TCP_NODELAY, TCP_FASTOPEN, and Listen Backlog Sep 13, 2026

  Disable Nagle, enable TCP Fast Open, tune listen backlog. Three socket parameters cut tail latencies 40–60% on modern load balancers.

• Why Transport Layer Fingerprinting Will Replace IP Reputation Sep 7, 2026

  Perimeter security models that rely on IP reputation fail against residential proxy pools. Edge defense is shifting to transport-layer fingerprinting, inspecting TCP SYN signatures, TLS Client Hello e…

• Why Dropping All ICMP Breaks Path MTU Discovery Sep 7, 2026

  Blocking all ICMP traffic does not hide your servers from network scanners. Instead, it breaks Path MTU Discovery, causing silent connection freezes during TLS handshakes and large file transfers.

• How to Tunnel Datagrams with MASQUE CONNECT-UDP Over HTTP/3 Sep 6, 2026

  Configure RFC 9298 MASQUE CONNECT-UDP over HTTP/3 to tunnel datagrams without head-of-line blocking.