Why our logs are append-only and how we query them
Here is a question we could not answer well a year ago: what really happens with why our logs are append-only and how we query them? We can answer it now.Observability firstEvery…
Engineering
Designing a risk score that analysts can explain (part 2)
This post is about designing a risk score that analysts can explain. It started, as most of our posts do, with an incident that did not go the way we expected.The numbersAcross…
Dropping 800 million packets per second with XDP
dropping 800 million packets per second with XDP sounds like a narrow topic. It turns out to touch almost every part of how an edge network behaves under attack.Observability firstEvery mitigation decision…
Measuring the real cost of a TLS handshake under attack
We get asked about measuring the real cost of a TLS handshake under attack more than almost anything else, so here is the long answer.The economics behind itA booter service rents out…
Tail latency is the only latency that matters
We get asked about tail latency is the only latency that matters more than almost anything else, so here is the long answer.Observability firstEvery mitigation decision is logged with its reasons, and…
Measuring the real cost of a TLS handshake under attack (part 2)
We get asked about measuring the real cost of a TLS handshake under attack more than almost anything else, so here is the long answer.Latency budgetOur budget for the whole filtering pipeline…
QUIC and HTTP/3 at the edge: what changes for DDoS mitigation (part 2)
qUIC and HTTP/3 at the edge: what changes for DDoS mitigation sounds like a narrow topic. It turns out to touch almost every part of how an edge network behaves under attack.Lessons…
eBPF maps, hash collisions and a very long night
Over the last few months we have spent a lot of time on eBPF maps, hash collisions and a very long night. This is what we learned.What we got wrongOur first version…
Why our logs are append-only and how we query them (part 2)
why our logs are append-only and how we query them sounds like a narrow topic. It turns out to touch almost every part of how an edge network behaves under attack.Observability firstEvery…
eBPF maps, hash collisions and a very long night (part 3)
Here is a question we could not answer well a year ago: what really happens with eBPF maps, hash collisions and a very long night? We can answer it now.Challenges beat blocksBlocking…
Keeping our control plane alive when the data plane is on fire (part 2)
keeping our control plane alive when the data plane is on fire sounds like a narrow topic. It turns out to touch almost every part of how an edge network behaves under…
The hidden cost of retries during a flood (part 2)
Here is a question we could not answer well a year ago: what really happens with the hidden cost of retries during a flood? We can answer it now.Protecting the originNone of…