Article series
Subjects told in order: an opener that maps the ground, then the parts, each an article of its own. Parts still to be written are named, so every series shows its whole shape from the start.
70 series across 8 subjects and 7 vendors; 560 articles in reading order.
By subject
The ground every platform stands on: protocols, cryptography, the web, identity, formats and the operator's tools.
Networking 7 series
DNS, read from the answer
One DNS answer read from the top with dig and nslookup: who replied and with what authority, the header and its flags, the records, the errors, and the options, traces and signatures that ask precisely.
15 of 15 parts written
Start hereReading a DNS answer: the line you skipped is the diagnosis
The parts
- 1 Reading dig Output From Top to Bottom
- 2 Reading nslookup Output
- 3 Authoritative vs Non-Authoritative Answers
- 4 The DNS Header: Opcode, Status, and Flags
- 5 EDNS and the OPT Pseudo-Section
- 6 Reading the Records in a dig Answer
- 7 How nslookup Prints Each Record Type
- 8 nslookup Errors and What They Mean
- 9 Anatomy of a dig command line: how dig reads what you type
- 10 dig Query Options and Output Control
- 11 nslookup Interactive Mode
- 12 Following Delegation with dig +trace
- 13 Reverse DNS Lookups with nslookup
- 14 DNSSEC Records in dig Output
- 15 nslookup vs dig: Which to Use
DNS as infrastructure
How a file maintained during business hours became the internet's naming system, and the ways that system is poisoned, depended on, chosen and used as a control.
4 of 4 parts written
IPv4 addressing and subnetting
The 32 bits behind a dotted quad, the prefix that defines a block, subnetting from the basics to a worked VLSM plan, summarisation and aggregation, the special ranges, and the NAT that stretched the space.
12 of 12 parts written
Start hereHow IPv4 addresses work
The parts
- 1 CIDR notation explained
- 2 Subnetting basics
- 3 VLSM: splitting a block into unequal subnets
- 4 A VLSM allocation, worked end to end
- 5 Subnet overlaps and gaps
- 6 Route summarization
- 7 Supernetting and route aggregation
- 8 Private IPv4 address space and RFC 1918
- 9 Private, Reserved, and Public IP Ranges
- 10 NAT Explained: Source, Destination, and Why the Internet Still Works
- 11 CGNAT: what breaks when a thousand subscribers share one address
- 12 Port blocks and port sets: the arithmetic of sharing one IPv4 address
IPv6
The 128-bit address and how to write it, why a subnet is almost always a /64, how hosts configure themselves, the multicast that replaced ARP, and how IPv6 and IPv4 run side by side.
5 of 5 parts written
Routing
How a packet picks its next hop, the interior protocols that draw the map, the exterior one that runs the internet and trusts every announcement, labels in the core, fast failure detection, the redundant gateway, and multicast.
11 of 11 parts written
Start hereRouting Tables and the Default Gateway: How a Packet Picks Its Next Hop
The parts
- 1 Reading ip route, netstat and route print, field by field
- 2 OSPF: the map, the math, and area 0
- 3 IS-IS: the routing protocol hiding under the internet
- 4 BGP: how the internet decides where traffic goes
- 5 BGP: the trust fall the whole internet is standing on
- 6 Route origin validation, worked by hand: Valid, Invalid, NotFound
- 7 MPLS: labels, stacks, and the BGP-free core
- 8 BFD: when a link is up and dead at the same time
- 9 Sizing BFD timers: the arithmetic of detection
- 10 First-hop redundancy: VRRP, HSRP, and the gateway that is a fiction
- 11 Multicast: what it costs to not flood
Tunnels and VPNs
What a tunnel protects and what it does not, the plain envelope, the negotiated encrypted one, the small one, the byte arithmetic every tunnel owes, and the remote-access VPN being retired.
6 of 6 parts written
Start hereVPN Fundamentals: What Tunnels Protect, and What They Don't
The parts
- 1 GRE Tunnels: The Simplest Envelope in Networking
- 2 IPsec and IKE: How Encrypted Tunnels Negotiate Themselves
- 3 WireGuard: the argument that a tunnel should be small enough to read
- 4 Tunnel Overhead, MTU, and MSS: The Byte Math Every Tunnel Owes
- 5 Jumbo frames: when 1500 bytes stops being enough
- 6 Why the SSL-VPN is being dismantled, and what is actually replacing it
Load balancing and persistence
The four questions every load balancer answers, the virtual server and the layer 4 proxy that carry them, persistence and its failure modes, global load balancing in two tiers, and how the market began.
8 of 8 parts written
Start hereLoad balancing: what actually decides where a request goes
The parts
- 1 How a BIG-IP Virtual Server Works
- 2 The TCP Proxy: What a Layer 4 Middlebox Does and Does Not See
- 3 Choosing a Persistence Method (and Its Failure Modes)
- 4 Source-Address Persistence and the Mega-Proxy Problem
- 5 Fallback Persistence and the Match-Across Settings
- 6 Persistence Mirroring Across an HA Pair
- 7 GSLB in Two Tiers: The Wide IP Picks a Pool, the Pool Picks a Server
- 8 Load Balancers and ADCs: Built Against the Market Sizing
Cryptography and certificates 7 series
Hashes and HMAC
What a cryptographic hash guarantees and why it cannot be reversed, the properties that measure it, which functions are still safe, and how a key turns a hash into proof of who sent a message.
8 of 8 parts written
Start hereHashing, encryption, and encoding: three different things
The parts
- 1 Cryptographic hashing: SHA-256 and the SHA-2 family
- 2 Why Cryptographic Hashes Are One-Way
- 3 Collisions, preimage resistance, and the birthday bound
- 4 Choosing a hash: MD5, SHA-1, SHA-2, SHA-3, and BLAKE
- 5 HMAC: keyed hashing for message authentication
- 6 Why HMAC, and not hash(key + message)
- 7 Verifying an HMAC safely: constant-time and replay
- 8 Authenticating API requests with HMAC
Storing passwords
Why a fast hash is the wrong tool for passwords: the two ways an attacker reverses a hash, the salt and the arithmetic that answer each, the slow functions built for the job, and the choice to make.
5 of 5 parts written
Certificates: the object and its trust
What a certificate holds and the files it travels in, how it is requested and issued, how a client validates it and builds its chain, how it is revoked, and the trust model that has failed in public.
10 of 10 parts written
Start hereAnatomy of an X.509 Certificate
The parts
- 1 PEM, DER, and the certificate file formats
- 2 Certificate signing requests and how certificates are issued
- 3 How certificate validation actually works
- 4 Certificate chains: the order, the anchor, and what breaks them
- 5 Authority Information Access: The OCSP and CA Issuers URLs
- 6 Certificate revocation: CRL, OCSP, and short-lived certificates
- 7 OCSP Must-Staple: Closing the Soft-Fail Gap
- 8 Certificate authorities: the padlock is a list of people you have never met
- 9 2011: the year the trust anchors broke
- 10 PKI: An Undergraduate Thesis, and a Trust Model Nobody Would Design Today
Certificate lifetimes and renewal
The schedule that takes public TLS certificates from 398 days to 47, the two timestamps that define validity, renewal lead time and ARI, the shrinking reuse of validation, and the automation that makes it bearable.
6 of 6 parts written
Start hereThe 47-day era: how TLS certificate lifetimes are shrinking
The parts
- 1 Certificate validity windows: notBefore, notAfter, and renewal lead time
- 2 Renewing before expiry: lead time, ACME, and ARI
- 3 DCV and SII reuse: the validation cadence behind the renewal cadence
- 4 Public vs private PKI: which certificates SC-081v3 governs
- 5 ACME: how certificates issue and renew themselves
- 6 Let's Encrypt: the free CA and its rate limits
TLS and the cipher suites
One handshake family in four shapes, the key exchange that gives forward secrecy, how to read a cipher suite and which to run, the attacks that pruned the protocol, and where a proxy terminates it.
13 of 13 parts written
Start hereTLS 1.2 vs TLS 1.3 vs DTLS vs QUIC: One Handshake Family, Four Shapes
The parts
- 1 Why Do We Say SSL When We Mean TLS?
- 2 Diffie-Hellman explained without the mathematics
- 3 Forward Secrecy and the Key Exchange
- 4 Anatomy of a TLS Cipher Suite
- 5 Reading Cipher Suite Names: IANA, OpenSSL, and GnuTLS
- 6 Cipher Families: The Working Map
- 7 AEAD vs CBC: Why the Mode Matters
- 8 TLS 1.3 Cipher Suites: What Changed
- 9 Which TLS Cipher Keywords Are Safe, and Which Are Not
- 10 Which Cipher Suites to Use: The Verdict Ledger
- 11 The named TLS attacks, 2011-2023: what each one broke, and what the protocol removed because of it
- 12 Inbound TLS: Offload, Bridging, and Passthrough at the Reverse Proxy
- 13 SSL Forward Proxy: How Outbound TLS Interception Works and What Breaks It
Post-quantum cryptography
What a quantum computer would break and what it would not, the three standards NIST finalised in 2024, and the hybrid key exchange the web already runs.
2 of 2 parts written
Start hereWhat a Quantum Computer Would Break, and What It Would Not
Fingerprinting what a client emits
What a connection announces before any data flows (the TCP SYN, the User-Agent, the order of the headers, the TLS ClientHello) and how JA3 and JA4 turn the handshake into an identity.
3 of 3 parts written
Start herePassive Fingerprinting: What You Emit Without Being Asked
The web and HTTP 5 series
The browser's security headers
The response headers that tell a browser how to protect a page: HTTPS enforcement, cookie flags, the CORS door in the same-origin wall, Content Security Policy, and frame control.
6 of 6 parts written
Server-side request forgery
Making a server fetch a destination of the attacker's choosing: the schemes beyond HTTP, the cloud metadata service that is the prize, and the allow-list defence that survives obfuscation.
3 of 3 parts written
curl, flag by flag
Reading a curl command the way the shell and curl read it: the method it implies, the body and its Content-Type, headers, authentication and cookies, the flags that weaken security, the translation to fetch(), and the 27 protocols beyond HTTP.
6 of 6 parts written
NGINX, from configuration to troubleshooting
The configuration tree and who owns the worker, how a location is chosen, what proxy_pass sends, what the cache stores and serves, how limits really count, how a reload works, and the server NGINX was written against.
6 of 6 parts written
Start hereThe NGINX configuration tree: what includes, in what order, and who owns the worker
The parts
- 1 NGINX location matching: why the block you expected is not the one that ran
- 2 The NGINX proxy_pass trailing slash: one character that decides what your backend receives
- 3 NGINX caching: what gets stored, what gets served, and the gap where user data leaks
- 4 Limiting requests, connections and bandwidth in NGINX: leaky buckets and the burst that surprises people
- 5 Reloading NGINX without dropping traffic, and the first four things to check when it breaks
- 6 Apache httpd: the server that ran the web, and the problem that produced NGINX
HTTP, from the request line to QUERY
One HTTP exchange read from the top: the raw request, the methods, the status codes, the header fields, cookies, where a message ends, the proxies in the path, the five versions, the newest method, and what people hide in the overhead.
10 of 10 parts written
Start hereHTTP, from the request line: what a message means, and how it travels
The parts
- 1 Reading a raw HTTP request, and turning it back into something you can run
- 2 HTTP Methods: The Verbs of the Web
- 3 HTTP Status Codes: The Five Families
- 4 HTTP Headers: The Anatomy of the Metadata
- 5 HTTP Cookies: State Over a Stateless Protocol
- 6 Where an HTTP/1.1 message ends: Content-Length, chunked, and the eight rules
- 7 HTTP Proxies: Forward vs Reverse, Explicit vs Transparent
- 8 HTTP/0.9 vs 1.0 vs 1.1 vs 2 vs 3: Five Versions of the Web's Protocol
- 9 HTTP QUERY: the read that finally carries a body
- 10 Hidden messages in HTTP headers: tributes, jokes and job offers in the overhead
Identity and authentication 4 series
SAML
Browser single sign-on with SAML 2.0: the identity and service providers, the bindings and who starts the flow, what an assertion holds and what is checked, how it is signed, and the proxy that inserts identity into a session.
4 of 4 parts written
OAuth and OpenID Connect
Authorisation and authentication told apart: the OAuth code flow, client types and PKCE, the three tokens, the grant to choose, then the identity layer OpenID Connect adds, its ID token, its claims and its discovery document.
9 of 9 parts written
Start hereOIDC vs OAuth 2.0: Authentication vs Authorization
The parts
- 1 The OAuth 2.0 authorization code flow
- 2 Public vs confidential clients, and where PKCE fits
- 3 PKCE: securing the OAuth authorization code flow
- 4 Access tokens, refresh tokens, and ID tokens
- 5 OAuth flows: choosing the grant in 2026
- 6 OpenID Connect: An Identity Layer on OAuth 2.0
- 7 The OIDC Authorization Code Flow
- 8 The ID Token Claims, and What a Relying Party Checks
- 9 OIDC Discovery: The openid-configuration Document
JWT and JWKS
The three segments of a token and why decoding is not verifying, the signing algorithms, the keys that sign them and how providers publish and rotate them, the verification sequence, and the mistakes that turn a verifier into a forgery machine.
7 of 7 parts written
Start hereAnatomy of a JSON Web Token
The parts
- 1 JWT signing algorithms: HMAC, RSA, and ECDSA
- 2 JWK Key Types: RSA, EC, OKP, and oct
- 3 JWK Parameters and Thumbprints
- 4 JWKS and Key Rotation: How Providers Publish Their Keys
- 5 Verifying a JWT with a JWKS: From kid to Signature
- 6 JWT security pitfalls: alg:none, key confusion, and missing checks
- 7 JWT Algorithm Confusion Attacks
One-time codes and passkeys
How a shared secret becomes a short code, how an authenticator is provisioned, what a server must tolerate and refuse when it checks one, and why passkeys resist the phishing that defeats codes.
3 of 3 parts written
Security 3 series
Traffic diversion and the man in the middle
Every way traffic is steered through somewhere it was not meant to go, from ARP poisoning on a LAN to a BGP hijack across the internet, each with the defence that answers it.
4 of 11 parts written
Start hereTraffic diversion and the man in the middle: the family, and the one move they share
The parts
- 1 ARP poisoning on a switched LAN · in preparation
- 2 MAC flooding and STP root takeover · in preparation
- 3 VLAN hopping: switch spoofing and double tagging · in preparation
- 4 Rogue DHCP and rogue IPv6 Router Advertisements · in preparation
- 5 ICMP redirects and LLMNR, NBT-NS and mDNS spoofing · in preparation
- 6 The Kaminsky flaw: the summer eighty vendors patched the same bug on the same day
- 7 The evil twin and the wireless path · in preparation
- 8 SSL stripping and HSTS · in preparation
- 9 NTLM explained: three messages, three versions, and why it is still on your network
- 10 BGP: the trust fall the whole internet is standing on
- 11 Fiddler, Burp, Cain and the rest: the tools that read a conversation they were not part of
Zero trust, SSE and the proxy
What zero trust, ZTNA and SASE mean without the marketing, what single-pass means mechanically, how five vendors answer the same question, and the engines inside: the PAC file, user identity on the proxy, browser isolation, sandboxing and DLP.
8 of 8 parts written
Start hereZero trust, ZTNA and SASE: what the terms mean when you remove the marketing
The parts
- 1 What single-pass actually means
- 2 Five SSE Vendors, One Decision, Five Different Answers
- 3 How a PAC File Chooses a Proxy
- 4 How a Proxy Knows Who You Are: User Authentication Methods Inline
- 5 Browser Isolation: When You Cannot Trust the Page, Move the Browser
- 6 Sandbox Detonation: Judging a File by What It Does
- 7 Data Loss Prevention: How Machines Recognize Secrets
- 8 DLP tuning: the argument is almost always about a checksum
CVSS
How a short vector string becomes a severity from 0 to 10: reading the vector, the eight base metrics, the temporal and environmental adjustments, the bands and what the score does not say, and what changed in v4.0.
5 of 5 parts written
Formats, text and encodings 12 series
The formats in between
JSON, YAML, XML, text encodings, Base64, URLs, timestamps, identifiers and diffs, read as one skill: putting meaning into characters so that the other end takes out the same meaning.
9 of 9 parts written
Start hereThe formats in between: why every interchange bug is the same bug
The parts
- 1 The JSON Grammar: Six Types and a Few Strict Rules
- 2 JSON and YAML in Practice: APIs, Declarations, and Orchestration
- 3 Reading XML Structure
- 4 Bytes, code points, and UTF-8
- 5 Base16, Base32, Base64, and percent-encoding compared
- 6 The Anatomy of a URL
- 7 What Unix Time Actually Is
- 8 UUIDs: random v4 and time-ordered v7
- 9 How text diff works
JSON, exactly
The format as a strict parser reads it: six types and a few rules, then every place where two parsers can honestly disagree about the same document.
6 of 6 parts written
Start hereThe JSON Grammar: Six Types and a Few Strict Rules
YAML and configuration files
Why pipelines and orchestration are written in YAML, and the three things YAML does that JSON never does: guess types, fold lines and reuse values.
4 of 4 parts written
Start hereJSON and YAML in Practice: APIs, Declarations, and Orchestration
XML and its hazards
Reading a document part by part, the rules a parser enforces first, namespaces and the constructs that are not elements, then the entity features that turn a parser into an attack surface.
6 of 6 parts written
Characters, bytes and Unicode
Why a character is not a byte: ASCII's table, Unicode's code points, the bytes UTF-8 and UTF-16 lay down, and what goes wrong when two ends read them differently.
5 of 5 parts written
The two alphabets
The Greek letters and Roman numerals every engineer reads without being taught: where each symbol came from, and then the two systems themselves.
2 of 2 parts written
Base16, Base32, Base64
Writing arbitrary bytes as text: the alphabets, what each costs in size and readability, and where each one turns up.
5 of 5 parts written
Start hereBase16, Base32, Base64, and percent-encoding compared
URLs, read exactly
The five parts every URL is built from, how characters are escaped inside them, how a relative link resolves, and the disguises a hostile link wears.
8 of 8 parts written
Start hereThe Anatomy of a URL
The parts
- 1 URI, URL, URN: What's Actually the Difference?
- 2 Percent-encoding (URL encoding), explained
- 3 Query Strings: Parameters, Plus Signs, and Repeated Keys
- 4 Relative URLs and How They Resolve
- 5 URL Encoding and Internationalized Hosts
- 6 Public suffixes and the registered domain (eTLD+1)
- 7 Deceptive URLs: Reading Past the Tricks
- 8 IP Address Obfuscation Tricks
Time as computers count it
One integer since 1970, the units it is written in, the leap seconds it ignores, the year it overflows, the text formats it becomes, and the arithmetic that calendars make hard.
5 of 5 parts written
Identifiers: UUIDs and their kin
How a 128-bit identifier stays unique with nobody issuing it, the eight versions, the odds of a collision, what random keys do to a database, and the sortable alternatives.
4 of 4 parts written
Diffs, merges and Git
What a diff actually computes, how to read one, why it sometimes blames the wrong lines, the third input that makes merging possible, and the tools built on all of it.
6 of 6 parts written
Regular expressions
What to match and how many, where a match may sit, what parentheses capture and assert, the flags that change everything, and the patterns that never finish.
4 of 4 parts written
Operations 2 series
Syslog
A syslog message read field by field: the PRI that packs facility and severity, the 24 facilities and 8 severities, the two message formats, the three transports, the defaults network devices choose, and how other systems count log levels.
6 of 6 parts written
The operator's Unix
The Unix underneath every appliance's management interface: terminal, shell and TTY, file modes, cron, Expect, and the story of Linux, its families, what grew out of it, and the two meanings of free.
8 of 8 parts written
Start hereUnix: the operating system inside every box on your network
The parts
- 1 Terminal, shell, TTY, console
- 2 File modes, read the way the kernel reads them: octal, symbolic, and the three bits most people skip
- 3 cron: five fields that run the world's chores
- 4 Expect scripts, read slowly: spawn, expect, send and the mistakes between them
- 5 Linux: the hobby kernel that ate the world
- 6 The Linux distribution families: what actually separates them
- 7 What grew out of Linux: phones, routers, containers and the licence question each one answers
- 8 Open source, and the two meanings of free
History 1 series
The family histories
Twenty-three technologies the network and its security are built from, each told from its first day: the network from the wire up, what runs on it, then security from the mathematics outward.
23 of 23 parts written
Start hereThe family histories: twenty-three technologies, each read from its first day
The parts
- 1 Transceivers: The Ridiculed Paper, and the Part of the Network You Can Hold
- 2 Bridges and Switches: One Idea, Solved Twice
- 3 The Router: From Gateway to Commodity, and the Names Left Out
- 4 Local, Wide and the Words That Stopped Meaning Distance
- 5 Wireless: The Islands Problem, and the Protocol Given Away
- 6 DNS: A File Maintained During Business Hours
- 7 Time: The Dependency Nobody Lists
- 8 Load Balancers and ADCs: Built Against the Market Sizing
- 9 Virtualisation: Solved in 1967, Forgotten, Then Proved Impossible, Then Done Anyway
- 10 Software-Defined Networking: A Protest That Became a Product Category
- 11 Observability: The Temporary Protocol That Outlived Its Replacement
- 12 Test and Measurement: The Family That Checks the Others
- 13 Encryption: The Standard, the Suspicion, and What the Suspicion Got Wrong
- 14 PKI: An Undergraduate Thesis, and a Trust Model Nobody Would Design Today
- 15 The Hardware Security Module: The Man Who Invented Both Halves
- 16 Identity: The L in LDAP Is an Argument
- 17 Email: A Side Project That Became the Identity Layer
- 18 The Firewall: Birth, Generations, and What Comes After the Perimeter
- 19 Intrusion Detection: The Discipline Built on Reading the Logs
- 20 Network Access Control: The Idea That Was Right Too Early, Twice
- 21 The Web Application Firewall: Bought by Auditors, Blamed by Engineers
- 22 Denial of Service: The Keynote Interrupted by Its Own Subject
- 23 SAST and DAST: Two Lineages, One Budget Line
By vendor
One vendor's platform at a time: its own model and its own vocabulary, in reading order.
F5 15 series
F5 Distributed Cloud, one request end to end
F5 Distributed Cloud in the order a request meets it: the site joining the fabric, the listener and the route, the origin and its persistence, TLS, the service policy that allows it, the rate limit, the API inventory, the security event, and the configuration hazards.
16 of 16 parts written
Start hereF5 Distributed Cloud: one request, end to end
The parts
- 1 What Actually Happens When a CE Registers: Token, Two REs by GeoIP, IPsec-with-SSL-Fallback, and the Allowlist That Makes It Work
- 2 How XC Decides Which Load Balancer Wins a Hostname: Listener Logic, Wildcards, and the Apex
- 3 How the XC HTTP Load Balancer Picks a Route: First-Match, Path Types, and the Per-Route WAF
- 4 The Anatomy of an XC Origin Pool: Origin Types, Endpoint Selection, and TLS to Origin
- 5 XC Load-Balancing Algorithms and Persistence, for BIG-IP People
- 6 F5XC TLS Security Levels Decoded: What High/Medium/Low Negotiate, and Why Your Scanner Flags a Load Balancer
- 7 How F5 XC Service Policies Match a Request
- 8 Predicates and Boolean Logic in XC Service Policy Rules
- 9 Actions and Default Deny in XC Service Policies
- 10 XC Rule Combining Algorithms: FIRST_MATCH, ALLOW_OVERRIDES, DENY_OVERRIDES
- 11 Case Sensitivity and Transformers in XC Matchers
- 12 XC Service Policy vs BIG-IP iRules: A Mental Model
- 13 How F5XC Rate Limiting Actually Counts: Leaky Bucket, Burst, Lockout, and Overshoot
- 14 The OpenAPI Spec as XC's API Inventory: Paths, Auth, and the Shadow
- 15 Reading an XC Security Event: Type, Action, and the Reason It Fired
- 16 Common XC Config Hazards a Linter Can Catch
What a BIG-IP says about itself
The five languages a BIG-IP describes itself in: its configuration grammar, two API address schemes, its licence file, the dates that decide whether it may upgrade, and F5's release calendar.
6 of 6 parts written
BIG-IP and F5OS versions and upgrades
From the first BIG-IP controller to today: why the version numbers jump, upgrade against update, the licence reactivation that rescues a failed upgrade, the newest line's operations and access changes, and the F5OS platform underneath.
7 of 7 parts written
Start hereBIG-IP, TMOS, and F5OS: A Version Timeline You Can Slide Through
The parts
- 1 BIG-IP Upgrade vs Update: Why the Distinction Decides Whether the License Date Is Checked
- 2 Recovering a BIG-IP That Won't Load Its Config After an Upgrade
- 3 The BIG-IP 21.x Ops Story: In-Place Upgrades, a 64-Bit Control Plane, and BigD at Scale
- 4 BIG-IP 21.x: what changed, and why there is no version 18, 19, or 20
- 5 Access and Identity in BIG-IP 21.1: DCR, Native SAML, and IPsec Comes Home
- 6 F5OS 2.0 From the Tenant's Seat: Cloud-Init, Per-Port RRDAG, and Q-in-Q
- 7 The three states an F5OS tenant can be in
BIG-IP foundations, from interface to pool member
The BIG-IP a student meets first: the layer 2 and 3 chain, route domains, the two ways in, the system services, then a connection through the virtual server, its profiles, the pool and its method, health, persistence, the return path, reuse, the protocol profiles, and the cores and guests underneath.
16 of 16 parts written
Start hereFrom Interface to Self-IP: BIG-IP Layer 2 and 3 Dependencies
The parts
- 1 Route Domains: Layer 3 Segmentation Inside One BIG-IP
- 2 Management Access on BIG-IP: the Management IP, Port Lockdown, and Access Lists
- 3 The System Services Behind a Healthy BIG-IP: DNS, NTP, SNMP, Syslog
- 4 How a BIG-IP Virtual Server Works
- 5 BIG-IP Virtual Server Types, and What Each One Actually Does
- 6 Profiles on a Virtual Server
- 7 BIG-IP Pools and Load-Balancing Methods
- 8 BIG-IP Load-Balancing Methods, and What Each One Weighs
- 9 Where Do the Requests Go? Simulating BIG-IP LTM Distribution
- 10 How LTM Health Monitors Decide Up or Down
- 11 BIG-IP Persistence Methods, and What Each Keys On
- 12 SNAT and the Return-Traffic Problem
- 13 OneConnect: Reuse Is a Grouping Problem, and SNAT Rewrites the Groups
- 14 Protocol Profiles: Living TCP, Frozen TCP, and the Two Fast Paths
- 15 CMP: The Cores You Paid For, and the iRule Lines That Give Them Back
- 16 vCMP: Hosts, Guests, and How Resources Are Carved
BIG-IP high availability
Device trust, device groups and traffic groups, then config sync, the failover states and how to force them, and the persistence records a standby must receive before it takes over.
3 of 3 parts written
Start hereBIG-IP High Availability: Device Trust, Device Groups, and Traffic Groups
BIG-IP troubleshooting and operations
How a BIG-IP tells you its condition: the status surfaces and statistics, the log files, tcpdump on a box whose interfaces are not NICs, the F5 trailer and what Wireshark makes of it, the support snapshot, hardware diagnostics, backups, alerting and on-box analytics.
12 of 12 parts written
Start hereReading BIG-IP Status: Dashboard, Network Map, TMSH, and netstat
The parts
- 1 Reading BIG-IP statistics
- 2 The BIG-IP Log Files: a Map of /var/log
- 3 BIG-IP tcpdump: How It Differs from Standard tcpdump
- 4 Capturing Safely on a Production BIG-IP
- 5 What the BIG-IP writes into your capture
- 6 Reading a BIG-IP Capture: The F5 Trailer in Wireshark
- 7 TMM Detail Levels and Peer Flows (:n, :nn, :nnn, :p)
- 8 qkview and iHealth: the Support Snapshot Workflow
- 9 EUD: BIG-IP Hardware Diagnostics Before You RMA
- 10 UCS Archives: the BIG-IP Backup That Contains Everything
- 11 Custom Alerting on BIG-IP: SNMP Traps, Email, and Remote Syslog
- 12 AVR: Application Visibility and Reporting on BIG-IP
BIG-IP SSL profiles and ciphers
Which side of the session each SSL profile owns, the certificate, key and chain it binds, the protocol versions it offers, the cipher string, rules, groups and order, forward secrecy, renegotiation and stapling, mutual TLS, post-quantum key exchange, ACME, and SSL Orchestrator.
12 of 12 parts written
Start hereClient SSL vs Server SSL Profiles on BIG-IP
The parts
- 1 Certificates, Keys, and Chain Building in an SSL Profile
- 2 Enabling and Disabling TLS Versions with the options Field
- 3 Reading an F5 Cipher String
- 4 F5 Cipher Rules, Cipher Groups, and Why Expansion Is Version-Specific
- 5 Cipher Ordering and Negotiation on BIG-IP
- 6 TLS 1.3 and TLS 1.2 Ciphers on BIG-IP
- 7 Enforcing Forward Secrecy on F5 BIG-IP
- 8 Renegotiation, Secure Renegotiation, and OCSP Stapling
- 9 Mutual TLS with peer-cert-mode
- 10 Post-Quantum TLS on BIG-IP: ML-KEM Hybrids From 17.5 to 21.1
- 11 ACME on BIG-IP: from DevCentral scripts to a native client
- 12 F5 SSL Orchestrator: Forward and Reverse Proxy Topologies
BIG-IP DNS and global load balancing
Which of seven answering machines replies to a query, how iQuery tells BIG-IP DNS what is up, global load balancing as two decisions with a three-step chain inside, topology records, and the resolver as a policy engine.
5 of 5 parts written
Start hereOne Query, Seven Answering Machines: the BIG-IP DNS Processing Order
The parts
- 1 How iQuery Connects BIG-IP DNS to the Rest of the Network
- 2 GSLB in Two Tiers: The Wide IP Picks a Pool, the Pool Picks a Server
- 3 BIG-IP DNS Load Balancing: the Wide IP, the Pool, and the Three-Step Chain
- 4 GTM Topology Records: Longest Match Is a Sort, Not the Pick
- 5 DNS as a Policy Engine: Multi-RPZ in BIG-IP 21.1
The BIG-IP automation toolchain
Declarations instead of commands: onboarding the device, describing the applications, streaming what it observes, and the templates that came before and after.
3 of 3 parts written
Start hereDeclarative Onboarding: The L1-L3 Half of the Automation Toolchain
Network security on the BIG-IP
The checkpoints a packet passes on a BIG-IP before any application sees it: packet filters, the network firewall's contexts, SYN flood protection, and the policy that decides which connections die when the table fills.
3 of 3 parts written
Start herePacket Filters: The Checkpoint Before Everything, and the Switch That Ships Off
BIG-IP APM
Where the access policy keeps what it learned, the single sign-on methods and the blast radius of one bad object, and APM as a SAML proxy in both roles.
2 of 2 parts written
Start hereSession Variables: Where APM Keeps Everything It Learned
BIG-IP Advanced WAF
A web application firewall policy read as a template plus adjustments, then what it enforces and when, how it parses payloads and layers policies, tracks sessions and masks responses, sees through evasion, tells browsers from bots and absorbs application-layer floods, and how to triage a block without poisoning the policy.
14 of 14 parts written
Start hereHow a BIG-IP Advanced WAF Declarative Policy Is Structured
The parts
- 1 Blocking vs Transparent: What Advanced WAF Enforcement Mode Really Does
- 2 Signature Staging and the Enforcement Readiness Period
- 3 Advanced WAF Content Profiles: Parsing JSON, XML, GraphQL, and GWT Safely
- 4 Nested Policies in Advanced WAF: Parent/Child Inheritance and Policy Microservices
- 5 Advanced WAF Session Tracking: Finding and Stopping the Client Behind the Requests
- 6 Data Guard: Masking Sensitive Data in Responses
- 7 Evasion Techniques: How Advanced WAF Normalizes Around Attacker Encoding
- 8 Client-Side Signals and Challenges: How Advanced WAF Tells a Browser from a Bot
- 9 L7 Behavioral DoS (BaDoS): How Advanced WAF Learns Normal and Mitigates the Rest
- 10 Handling False Positives in Advanced WAF: Triage by Rating, Then Tune with Scope
- 11 Why AWAF Blocked It, in the Order That Answers Fastest
- 12 Automatic Learning in Production: How an Attacker Poisons a WAF Policy
- 13 WAF Over QUIC: HTTP/3 Web Protection in BIG-IP 21.1
- 14 QUERY Meets BIG-IP: LTM, iRules, and the Advanced WAF Verdict
iRules events and the connection lifecycle
When an iRule runs: the fixed order of events through a connection, the two sides of the full proxy, what makes an event exist at all, the events a fast path gives up, the TLS handshake events, priority among several rules, and the order of the questions when you write one.
6 of 6 parts written
The Tcl inside iRules
The language an iRule is written in, read through F5's own style guide: comparisons and numbers, strings and the commands that cut them, branching and lookups, loops, procedures, the namespace that keeps every core busy, performance, and iRules LX.
12 of 12 parts written
Start hereThe DevCentral iRules Style Guide, rule by rule, with the reasons
The parts
- 1 iRules comparisons: == versus eq, precedence, and the quiet fallback to text
- 2 Numbers in iRules: octal, hexadecimal, and why 08 is not a number
- 3 Building strings in iRules: quotes, braces, append, concat and lists
- 4 Tcl string commands in iRules: indexes, map, match, compare and trim
- 5 findstr, substr and getfield: what F5 documents, and what it leaves open
- 6 scan in iRules: taking values apart without regular expressions
- 7 iRules: choosing between if, switch, class match, and static arrays
- 8 Loops and lists in iRules, and why they block
- 9 iRules procedures: reusable code with proc and call
- 10 iRules, CMP, and the static:: namespace
- 11 iRules performance: cycles, timing, and the runtime calculator
- 12 iRules LX, explained: what runs where when Tcl calls Node.js
Fortinet 6 series
FortiGate administration
A FortiGate from its factory state to its edges: the CLI and its traps, policies, address translation and their order, debug flow and the sniffer, routing and SD-WAN, security profiles and SSL inspection, identity, IPsec, clustering, logging, shaping, DNS, carrier-scale NAT and ACME.
16 of 16 parts written
Start hereFortiGate Initial Configuration: Factory State, Access, and Operation Modes
The parts
- 1 The FortiOS CLI verb that quietly deletes things
- 2 FortiGate Firewall Policies and NAT: Matching Order, SNAT, and DNAT
- 3 Why your FortiGate rule did not fire
- 4 Reading a FortiGate debug flow
- 5 Reading a FortiGate Packet Sniffer Trace
- 6 FortiGate Routing and SD-WAN: Route Selection Order and Rule Evaluation
- 7 FortiGate Security Profiles: Antivirus, IPS, and Application Control
- 8 FortiGate SSL Inspection: Certificate vs Deep Inspection
- 9 FortiGate Firewall Authentication and FSSO: Identity in a Policy
- 10 FortiGate IPsec VPN: Phase 1, Phase 2, and Redundant Topologies
- 11 FortiGate FGCP High Availability: Active-Passive, Active-Active, and Failover
- 12 FortiGate Logging and Diagnostics: Where Logs Go and How to Find a Problem
- 13 FortiGate Traffic Shaping and QoS: Guaranteeing Bandwidth That Is Already Full
- 14 FortiGate as a DNS server: four modes, and where the filter applies
- 15 Carrier-Scale NAT, MAP-E, Domain Fronting, and WCCP
- 16 ACME on FortiGate: a built-in client for the box's own certificate
Fortinet security operations
A security operations centre read as questions rather than products: the analyser that stores and reports, the correlation engine and its database, the orchestration platform and its playbooks, endpoint and network detection, deception, and the attack surface seen from outside.
17 of 17 parts written
Start hereSOC Architecture and Adversary Behaviour: Attack Vectors and What the Products Are For
The parts
- 1 FortiAnalyzer Log Ingestion: Normalization, and the Analytics/Archive Split
- 2 FortiAnalyzer Reports: Datasets, Charts, and Why a Report Comes Back Empty
- 3 FortiAnalyzer SOC: Event Handlers, Incidents, Indicators, and Playbooks
- 4 FortiSIEM Rules, Subpatterns, and Turning Incidents Into Action
- 5 FortiSIEM Analytics: Building Queries, Aggregation, and the CMDB
- 6 FortiSIEM Machine Learning, UEBA, and Integrating the Rest of the Platform
- 7 FortiSOAR Architecture and Data Model: Modules, Records, and Relationships
- 8 FortiSOAR Playbooks, Jinja, and Connectors
- 9 FortiSOAR Incident Workflow, Queues, War Rooms, and Debugging Playbooks
- 10 FortiEDR Architecture: Components, Deployment, Multi-Tenancy, and the Cloud Service
- 11 FortiEDR Policies, Communication Control, and Playbooks
- 12 FortiEDR Threat Hunting, Forensics, and Investigating an Alert
- 13 FortiNDR Cloud: Architecture, Sensors, Event Types, and Detections
- 14 FortiNDR Cloud: IQL Queries, Threat Hunting, and Integration
- 15 FortiDeceptor: Decoys, Lures, Tokens, and Designing a Deception Strategy
- 16 FortiDeceptor Deployment: Networks, Air-Gapped Sites, Central Management, and Incident Analysis
- 17 FortiRecon: Attack Surface Management and What the Dark Web Actually Is
FortiMail
Mail security on FortiMail: the operation mode that decides everything else, the layered policies and antispam, content security, archiving and identity-based encryption, and protecting the cloud mail platforms.
3 of 3 parts written
Start hereFortiMail Deployment: SMTP Fundamentals, Operation Modes, and Protected Domains
FortiManager
Central management where the database is the source of truth: administrative domains and registration, policy packages and their installs, and where to look when a change does not land.
2 of 2 parts written
Start hereFortiManager ADOMs and Device Registration: The Database Is the Source of Truth
FortiSwitch
A switch managed by a FortiGate: FortiLink provisioning and topologies, the VLANs, spanning tree, ports and QoS of the daily work, and port security and diagnostics.
2 of 2 parts written
Start hereFortiSwitch and FortiLink: Provisioning, Topologies, and When the Switch Will Not Come Up
FortiAP
Wireless managed by a FortiGate: the integrated controller and the profiles a fleet is built from, authentication and the segment a client lands in, and troubleshooting what users actually report.
2 of 2 parts written
Start hereFortiAP Deployment: Wireless Fundamentals, the Integrated Controller, and AP Profiles
Check Point 1 series
Check Point, from the three tiers to the upgrade
The platform that separates where policy is written from where it is enforced: sessions and publishing, the rule base and its layers, address translation and its silent failure, identity, HTTPS inspection, threat prevention, site-to-site tunnels, logging and events, management high availability, clustering and upgrades.
14 of 14 parts written
Start hereCheck Point's Three-Tier Architecture: Management, Gateway, and SmartConsole
The parts
- 1 Check Point Administrators, Sessions, and Objects: Publish Is Not Install
- 2 The Check Point Rule Base: Order, Implied Rules, and the Rules Everyone Forgets
- 3 Check Point Policy Layers: Ordered, Inline, and Shared
- 4 Check Point NAT: Automatic Versus Manual, Hide Versus Static, and Proxy ARP
- 5 Check Point NAT that logs nothing: proxy ARP and the failure one layer down
- 6 Check Point Identity Awareness: Writing Rules About People Instead of Addresses
- 7 Check Point HTTPS Inspection, Application Control, and URL Filtering
- 8 Check Point Threat Prevention: The Blades, Profiles, and Prevent Versus Detect
- 9 Check Point Site-to-Site VPN: Communities, Encryption Domains, and Why the Tunnel Is Empty
- 10 Check Point Logging and Monitoring: Where Logs Go and How to Ask Them Questions
- 11 Check Point SmartEvent and the Compliance Blade: Turning Logs into Events Worth Reading
- 12 Check Point Management High Availability: Active, Standby, and Why Failover Is Manual
- 13 Check Point ElasticXL: One Cluster Object, Many Members
- 14 Check Point Upgrades and Migrations: Order, Compatibility, and Getting the Database Out
Zscaler 3 series
The Zscaler Zero Trust Exchange
A proxy where the perimeter used to be: the tunnels and the Client Connector that reach it, device posture, the cloud access security broker, the experience score, the logs and reports that come out of it, and the scenarios where the platform earns its architecture.
12 of 12 parts written
Start hereThe Zscaler Zero Trust Exchange: A Proxy Where the Perimeter Used to Be
The parts
- 1 Zscaler Tunnel Types: Z-Tunnel, GRE, and IPsec, With the Numbers
- 2 Client Connector Profiles: Where the Endpoint Decides How to Forward
- 3 Troubleshooting Client Connector: The Diagnostics Menu and the First Four Checks
- 4 Posture and Device Trust: Letting the Device's State Vote
- 5 CASB in the Exchange: Inline, Out-of-Band, and the Posture of SaaS Itself
- 6 The ZDX Score: What the Probes Measure and How the Number Is Made
- 7 Nanolog, NSS, Cloud NSS, and LSS: Getting the Logs Out
- 8 The Administrator Audit Log: Who Changed What, From Where, With What Outcome
- 9 Reports and Executive Summaries: Turning the Nanolog Into Sentences Leadership Reads
- 10 The Exfiltration Alert: A Walkthrough From Signal to Posture Answer
- 11 Updates and Change Management: Running Change on a Platform That Also Changes Itself
- 12 Mergers and Acquisitions on the Exchange: Day-One Access Without Merging Networks
Zscaler Internet Access
The cloud proxy for internet traffic: how traffic reaches it, locations, TLS inspection and its bypasses, URL filtering and cloud app control, the firewall's rule order, file type control and the sandbox, data loss prevention, and the log fields investigations are written in.
7 of 7 parts written
Start hereGetting Traffic to ZIA: The Forwarding Decision
The parts
- 1 Locations and Sublocations: Teaching the Cloud Where Your Sites Are
- 2 TLS Inspection in ZIA: The Policy, the Bypasses, and the Bill
- 3 URL Filtering and Cloud App Control: Two Policies, One Precedence Rule
- 4 ZIA Cloud Firewall: Rule Order Is the Whole Ballgame
- 5 File Type Control and Cloud Sandbox: The Download's Two Judges
- 6 ZIA Data Loss Prevention: Dictionaries, Engines, and the Fingerprint Tiers
- 7 ZIA Log Fields: The Vocabulary Investigations Are Written In
Zscaler Private Access
Private applications reached without exposing them: two outbound calls and a broker in the middle, the vocabulary that names applications and earns access to them, and the three suspects when access fails.
2 of 2 parts written
Start hereZPA Architecture: Two Outbound Calls and a Broker in the Middle
Netskope 1 series
Netskope, one platform and two data paths
A security cloud on a private network, inspecting traffic two ways: steering and the client, inline TLS decryption, real-time against API protection, the cloud firewall for everything that is not web, private access, and the events and analytics that turn traffic into evidence.
7 of 7 parts written
Start hereNetskope Platform Architecture: One Platform, Two Data Paths, One Private Cloud
The parts
- 1 Choosing how traffic reaches the service edge
- 2 Netskope Client Deployment: Enrollment, Identity, and the Tunnel
- 3 Netskope: Cloud Forward Proxy and Inline TLS Decryption
- 4 Real-time vs API Protection: The Two Vantage Points of a Security Cloud
- 5 Netskope Cloud Firewall: Egress Control for Everything That Isn't Web
- 6 Netskope Private Access: ZTNA Instead of the VPN
- 7 Netskope Events and Advanced Analytics: From Traffic to Evidence
Ping Identity 2 series
PingFederate, installed to upgraded
A PingFederate server's life: what it needs before the archive is unpacked, the files that control it, the two port families, who administers it, the data stores, adapters and authentication policies, OGNL expressions, the logs, the operational habits, and the upgrade.
10 of 10 parts written
Start hereInstalling PingFederate: Requirements, First Run, and the Setup Wizard
The parts
- 1 The PingFederate Startup Files: Who Controls What
- 2 The PingFederate Endpoints Map: Admin Port, Runtime Port, and What Lives Where
- 3 Who Administers PingFederate: Native Accounts, Roles, and Console Login via LDAP
- 4 PingFederate Data Stores: LDAP and JDBC, Defined Once, Used Everywhere
- 5 How Users Prove Who They Are: PCVs and the Five Adapters
- 6 PingFederate Authentication Policies: Trees, Selectors, and the Contract at the End
- 7 PingFederate OGNL Expressions: Mappings, Criteria, and Why Authoring Is Its Own Role
- 8 The PingFederate Log Files: Which One Answers Which Question
- 9 PingFederate Operational Hygiene: License, Notifications, and the Configuration Archive
- 10 Upgrading PingFederate: The Utility, the Merge, and the Cluster Order
The Ping identity platform
What PingOne is behind its product names, identity orchestration on a canvas, the PingAccess policy model, the PingDirectory data platform, and the lineage that gives the catalogue two of everything.
4 of 4 parts written
Extreme Networks 1 series
Extreme Fabric Connect, one service edge to edge
Extreme's fabric in the order a service comes into existence: the two operating systems and their names, the configuration model, the vocabulary, the fabric itself, the control plane, the service identifier, multicast without configuration, the edge that asks for what it needs, and dual-homing.
10 of 10 parts written
Start hereExtreme Fabric Connect: one service, edge to edge
The parts
- 1 VOSS vs EXOS: Two Extreme Operating Systems
- 2 Switch Engine, Fabric Engine, and the switches that kept the old names
- 3 How an ExtremeXOS Config Is Structured
- 4 The SPB vocabulary, sorted
- 5 Fabric Connect and SPBM: Why VOSS Retires Spanning Tree
- 6 IS-IS, Nicknames, and B-MACs: The VOSS Control Plane
- 7 The I-SID: How VOSS Replaces VLAN Stretching
- 8 SPBM multicast: the address is arithmetic, not a lookup
- 9 Fabric Attach: Auto-Provisioning the Edge (Where VOSS Meets EXOS)
- 10 SMLT and vIST: Dual-Homing a Fabric Edge