Security Engineering · Cluster
Network Security
Firewalls, segmentation, and detection.
- 01 How a Stateful Firewall Matches a Packet The order in which a packet filter evaluates rules, how the connection-tracking table overrides the rule set, and where the model breaks under fragmentation and asymmetric routing.
- 02 VLAN Segmentation and the Limits of Layer 2 Isolation How 802.1Q tags create separate broadcast domains on shared hardware, why trunk links and layer 3 boundaries decide whether isolation holds, and where VLAN hopping attacks get their leverage.
- 03 Connection Tracking Under NAT How address and port translation rewrites the five-tuple, why the mapping table is the real policy state, and which behaviours the NAT requirement documents leave to the implementation.
- 04 Application Proxy Firewalls and Parser Differentials What a layer 7 proxy gains by terminating and re-originating a connection, why the parser it runs becomes an attack surface, and how two systems disagreeing about the same bytes creates a bypass.
- 05 Microsegmentation and Policy at the Workload Boundary Why per-workload policy beats address-based rules, how enforcement located in the host kernel changes the failure model, and what has to be observed before a policy can be written at all.
- 06 Multi-Pattern Matching in Network Intrusion Detection How signature engines match thousands of byte patterns against a reassembled stream with one pass, why normalisation decides what the engine actually sees, and where matching still fails.
- 07 Flow Records and Traffic Baselining How routers summarise traffic into flow records, what the cache timeouts decide about those records, and which questions the resulting telemetry can and cannot answer.
- 08 Detecting DNS Tunnels from Query Structure How DNS becomes a bidirectional data channel, which structural properties of queries carry the signal, and why entropy alone is a weak discriminator against legitimate naming schemes.
- 09 Detecting Periodic Beacons in Flow Telemetry Why fixed-interval check-ins are visible in timing even when the payload is encrypted, how jitter and distribution shape change the test, and where the statistical approach fails on sparse data.
- 10 Remote Blackholing and FlowSpec Distribution How a network tells its upstream to drop traffic for a specific prefix or flow, why the trigger is a BGP route rather than a firewall rule, and what collateral damage the mechanism accepts by design.