https://blog.pathvector.dev/ Hands-on networking and protocol engineering notes from PathVector Studio. en https://blog.pathvector.dev/protocol-in-code-ospf-03/ https://blog.pathvector.dev/protocol-in-code-ospf-03/ OSPF's DR/BDR election on a broadcast segment is a filter, a max(), and a tie-break — read it as three lines of Python instead of a bullet list. Wed, 05 Aug 2026 19:02:45 +0000 https://blog.pathvector.dev/protocol-in-code-ospf-02/ https://blog.pathvector.dev/protocol-in-code-ospf-02/ OSPF's neighbor state machine reads as two separate gates in code: Hello-phase booleans decide Init/2-Way/ExStart, and database-exchange inputs decide Loading/Full. Tue, 04 Aug 2026 19:02:58 +0000 https://blog.pathvector.dev/protocol-in-code-ospf-01/ https://blog.pathvector.dev/protocol-in-code-ospf-01/ Reading OSPF's Hello check as code: the five fields that must match before a neighbor relationship can even begin, and why seeing your own router ID changes everything. Mon, 03 Aug 2026 19:02:53 +0000 https://blog.pathvector.dev/protocol-in-code-bgp-15/ https://blog.pathvector.dev/protocol-in-code-bgp-15/ Fourteen sessions of BGP logic collapse into one small Python object: six pieces of state, three methods, and one three-line rhythm repeated in each of them. Sun, 02 Aug 2026 19:02:44 +0000 https://blog.pathvector.dev/protocol-in-code-bgp-14/ https://blog.pathvector.dev/protocol-in-code-bgp-14/ Best-path selection alone breaks down once validation and policy exist. Reading a toy BGP decision process shows why one prefix has to become a set of peer-specific candidates first. Sat, 01 Aug 2026 19:02:38 +0000 https://blog.pathvector.dev/protocol-in-code-bgp-13/ https://blog.pathvector.dev/protocol-in-code-bgp-13/ Reading a BGP event dispatcher as code: why announce gates the peer, withdraw skips the gate, and peer-down is the only branch that can touch many prefixes at once. Fri, 31 Jul 2026 19:02:42 +0000 https://blog.pathvector.dev/protocol-in-code-bgp-12/ https://blog.pathvector.dev/protocol-in-code-bgp-12/ Reading BGP export refresh as code: how one Loc-RIB change turns into an advertise for one peer, a withdraw for another, and silence for a third. Thu, 30 Jul 2026 19:02:36 +0000 https://blog.pathvector.dev/protocol-in-code-bgp-11/ https://blog.pathvector.dev/protocol-in-code-bgp-11/ In BGP, whether a route reaches Adj-RIB-In comes down to the placement of a single if. Read the session-state gate as code. Wed, 29 Jul 2026 19:02:37 +0000 https://blog.pathvector.dev/protocol-in-code-bgp-10/ https://blog.pathvector.dev/protocol-in-code-bgp-10/ Trace a single received BGP route end to end through validation, import policy, best-path, and export — and watch nine sessions of isolated snippets turn into one small control plane. Tue, 28 Jul 2026 20:51:40 +0000 https://blog.pathvector.dev/protocol-in-code-bgp-09/ https://blog.pathvector.dev/protocol-in-code-bgp-09/ Reading BGP peer loss as code: why a single session going down triggers a set of withdrawals plus a per-prefix best-path recomputation, and why some prefixes survive while others vanish. Tue, 28 Jul 2026 11:02:31 +0000 https://blog.pathvector.dev/protocol-in-code-bgp-08/ https://blog.pathvector.dev/protocol-in-code-bgp-08/ The route you install locally and the route you advertise to a peer are different objects. A 25-line Python function shows exactly where they diverge. Mon, 27 Jul 2026 11:02:40 +0000 https://blog.pathvector.dev/protocol-in-code-bgp-07/ https://blog.pathvector.dev/protocol-in-code-bgp-07/ Reading BGP import policy as code: the candidate that enters best-path selection is not always the one the peer sent. Sun, 26 Jul 2026 11:03:06 +0000 https://blog.pathvector.dev/protocol-in-code-bgp-06/ https://blog.pathvector.dev/protocol-in-code-bgp-06/ A BGP router keeps the same route in three different stores. Reading ribs.py shows why received, selected, and advertised state are deliberately kept apart. Sat, 25 Jul 2026 11:02:43 +0000 https://blog.pathvector.dev/protocol-in-code-bgp-05/ https://blog.pathvector.dev/protocol-in-code-bgp-05/ RPKI tells you a route is invalid — it does not tell the router to drop it. Read the BGP policy layer as code and see why validation and policy are separate. Fri, 24 Jul 2026 11:02:32 +0000 https://blog.pathvector.dev/protocol-in-code-bgp-04/ https://blog.pathvector.dev/protocol-in-code-bgp-04/ BGP picking a best path doesn't mean the origin AS is authorized — read RPKI origin validation as code and see why valid, invalid, and not_found are three distinct answers. Thu, 23 Jul 2026 11:03:00 +0000 https://blog.pathvector.dev/protocol-in-code-bgp-03/ https://blog.pathvector.dev/protocol-in-code-bgp-03/ Reading BGP best path selection as ordered branches: the first differing field decides the winner, and everything after it never runs. Wed, 22 Jul 2026 11:02:41 +0000 https://blog.pathvector.dev/protocol-in-code-bgp-02/ https://blog.pathvector.dev/protocol-in-code-bgp-02/ A BGP UPDATE can remove routes and add routes in one message — reading the Python shows why withdrawal is a different mutation from a dead session. Tue, 21 Jul 2026 11:02:41 +0000 https://blog.pathvector.dev/protocol-in-code-bgp-01/ https://blog.pathvector.dev/protocol-in-code-bgp-01/ A BGP session isn't a config line — it's a state machine that stops at a different place depending on which input is missing. We read that machine in Python. Mon, 20 Jul 2026 21:51:20 +0000 https://blog.pathvector.dev/network-protocol-roadmap-2026/ https://blog.pathvector.dev/network-protocol-roadmap-2026/ Two free courses — hands-on labs and code-reading sessions — organized into genre maps and goal-based routes, so you know exactly where to start and what to read next. Sun, 12 Jul 2026 08:35:27 +0000 https://blog.pathvector.dev/protocol-lab-lb-33/ https://blog.pathvector.dev/protocol-lab-lb-33/ Put a Linux IPVS director in front of three backends, hit one virtual IP thirty times, and watch round-robin NAT split the connections exactly 10/10/10 — while the client never sees a backend address. Fri, 10 Jul 2026 13:35:12 +0000 https://blog.pathvector.dev/protocol-lab-mcast-29/ https://blog.pathvector.dev/protocol-lab-mcast-29/ Join two receivers to group 239.1.1.1 with IGMP, send one UDP stream, and watch both receive it in full — then find the IGMP reports and the 01:00:5e multicast MAC in a packet capture. Fri, 10 Jul 2026 13:35:12 +0000 https://blog.pathvector.dev/protocol-lab-mss-37/ https://blog.pathvector.dev/protocol-lab-mss-37/ When a narrow link hides deep in the path and ICMP is filtered, PMTUD black-holes your TCP connections. Watch a router rewrite the SYN's MSS from 1460 to 1360 so every segment fits — no PMTUD required. Fri, 10 Jul 2026 13:35:12 +0000 https://blog.pathvector.dev/protocol-lab-mtu-25/ https://blog.pathvector.dev/protocol-lab-mtu-25/ Build a path with a 1400-byte bottleneck link, send a 1500-byte Don't-Fragment packet into it, and watch ICMP fragmentation-needed teach the sender the Path MTU — the mechanism that silently breaks when firewalls drop ICMP. Fri, 10 Jul 2026 13:35:12 +0000 https://blog.pathvector.dev/protocol-lab-nat-20/ https://blog.pathvector.dev/protocol-lab-nat-20/ Build a masquerading NAT in a container lab, watch the server see only the NAT's public address, and inspect the conntrack table that routes replies back to the right private host. Fri, 10 Jul 2026 13:35:12 +0000 https://blog.pathvector.dev/protocol-lab-ndp-23/ https://blog.pathvector.dev/protocol-lab-ndp-23/ Clear the neighbor cache, ping an IPv6 neighbor, and capture the Neighbor Solicitation / Advertisement exchange that replaces ARP — multicast instead of broadcast, ICMPv6 instead of a dedicated protocol. Fri, 10 Jul 2026 13:35:12 +0000 https://blog.pathvector.dev/protocol-lab-ospf-34/ https://blog.pathvector.dev/protocol-lab-ospf-34/ Build a three-router OSPF triangle, watch every router flood the same link-state map, see SPF pick the cheapest path by cost, then kill the best link and watch it reconverge automatically. Fri, 10 Jul 2026 13:35:12 +0000 https://blog.pathvector.dev/protocol-lab-pbr-38/ https://blog.pathvector.dev/protocol-lab-pbr-38/ Two hosts send to the same destination IP, yet one exits via up1 and the other via up2 — add a single ip rule and watch Linux route by source, not destination. Fri, 10 Jul 2026 13:35:12 +0000 https://blog.pathvector.dev/protocol-lab-qos-28/ https://blog.pathvector.dev/protocol-lab-qos-28/ Attach a tbf token-bucket qdisc to a container's egress and watch iperf3 drop from tens of Gbit/s to exactly the rate you configured — plus why a too-small burst throttles you almost to zero. Fri, 10 Jul 2026 13:35:12 +0000 https://blog.pathvector.dev/protocol-lab-quic-11/ https://blog.pathvector.dev/protocol-lab-quic-11/ Multiplex three requests over one TCP connection with HTTP/2, read the Alt-Svc header that advertises HTTP/3, and see why QUIC moves streams onto UDP to kill head-of-line blocking. Fri, 10 Jul 2026 13:35:12 +0000 https://blog.pathvector.dev/protocol-lab-rpf-39/ https://blog.pathvector.dev/protocol-lab-rpf-39/ Spoof a source address from the wrong network, watch strict rp_filter drop it at ingress while real traffic sails through, then switch it off and see the forgery get forwarded — BCP 38 anti-spoofing, hands-on. Fri, 10 Jul 2026 13:35:12 +0000 https://blog.pathvector.dev/protocol-lab-rpki-04/ https://blog.pathvector.dev/protocol-lab-rpki-04/ Connect FRRouting to a local RPKI-to-Router cache, announce the same prefix from an authorized and an unauthorized AS, and watch origin validation label each route valid, invalid, or not found. Fri, 10 Jul 2026 13:35:12 +0000 https://blog.pathvector.dev/protocol-lab-tcp-07/ https://blog.pathvector.dev/protocol-lab-tcp-07/ Open a single TCP connection in a two-node container lab and annotate its entire life in one packet capture: the three-way handshake, one data exchange, and the four-way teardown. Fri, 10 Jul 2026 13:35:12 +0000 https://blog.pathvector.dev/protocol-lab-tcp-08/ https://blog.pathvector.dev/protocol-lab-tcp-08/ Add 25ms of delay and 15% packet loss with tc netem, push 3 MB through, and watch TCP detect the loss, retransmit, shrink its congestion window — and still complete the transfer. Fri, 10 Jul 2026 13:35:12 +0000 https://blog.pathvector.dev/protocol-lab-tls-09/ https://blog.pathvector.dev/protocol-lab-tls-09/ Open one TLS 1.3 connection, capture the handshake, and pinpoint the exact boundary where cleartext ends: SNI and the ALPN offer are visible, but the certificate is not. Fri, 10 Jul 2026 13:35:12 +0000 https://blog.pathvector.dev/protocol-lab-tls-15/ https://blog.pathvector.dev/protocol-lab-tls-15/ Run a tiny lab CA, sign a server cert and a client cert, then watch a -Verify server accept the client that presents a certificate and reject the one that doesn't — with a 'certificate required' TLS alert. Fri, 10 Jul 2026 13:35:12 +0000 https://blog.pathvector.dev/protocol-lab-trace-19/ https://blog.pathvector.dev/protocol-lab-trace-19/ Build a real client → r1 → r2 → server path in containers, run traceroute, and capture the ICMP time-exceeded messages that turn a simple loop-prevention field into a hop-by-hop map. Fri, 10 Jul 2026 13:35:12 +0000 https://blog.pathvector.dev/protocol-lab-vlan-26/ https://blog.pathvector.dev/protocol-lab-vlan-26/ Put two VLANs on a single physical link, ping across each, and watch 802.1Q tags keep them completely isolated — one wire, two broadcast domains. Fri, 10 Jul 2026 13:35:12 +0000 https://blog.pathvector.dev/protocol-lab-vxlan-18/ https://blog.pathvector.dev/protocol-lab-vxlan-18/ Build a point-to-point VXLAN overlay, ping across it, then capture the underlay and watch the inner ICMP appear in plain text — proof that encapsulation and encryption are two different jobs. Fri, 10 Jul 2026 13:35:12 +0000 https://blog.pathvector.dev/protocol-lab-wg-16/ https://blog.pathvector.dev/protocol-lab-wg-16/ Build a WireGuard tunnel between two containers, then capture the same ping twice — encrypted UDP on the real link, cleartext ICMP inside wg0 — to see exactly where a VPN's encryption applies. Fri, 10 Jul 2026 13:35:12 +0000 https://blog.pathvector.dev/protocol-lab-arp-24/ https://blog.pathvector.dev/protocol-lab-arp-24/ Clear the ARP cache, ping a neighbor, and capture the broadcast 'who has 10.0.0.2?' request and unicast 'is-at' reply that make IPv4 delivery on a link actually work. Fri, 10 Jul 2026 13:28:02 +0000 https://blog.pathvector.dev/protocol-lab-bfd-35/ https://blog.pathvector.dev/protocol-lab-bfd-35/ When a link stays up but forwarding silently dies, OSPF alone waits 40 seconds to notice. Add BFD and the same failure is detected in ~900 ms — here's a hands-on lab that proves it. Fri, 10 Jul 2026 13:28:02 +0000 https://blog.pathvector.dev/protocol-lab-bgp-01/ https://blog.pathvector.dev/protocol-lab-bgp-01/ Build a two-router eBGP lab with containerlab and FRRouting, announce a single prefix, and learn to read NLRI, AS_PATH, NEXT_HOP, and ORIGIN straight out of RFC 4271 — packet capture included. Fri, 10 Jul 2026 13:28:02 +0000 https://blog.pathvector.dev/protocol-lab-bgp-02/ https://blog.pathvector.dev/protocol-lab-bgp-02/ Announce a prefix over eBGP, withdraw it, and re-announce it — then confirm in FRRouting output and a packet capture that one UPDATE message does both the advertising and the withdrawing. Fri, 10 Jul 2026 13:28:02 +0000 https://blog.pathvector.dev/protocol-lab-bgp-03/ https://blog.pathvector.dev/protocol-lab-bgp-03/ Make two different ASNs originate the same prefix, watch an upstream router receive both competing paths, and learn why the BGP table alone can never tell you which origin is legitimate. Fri, 10 Jul 2026 13:28:02 +0000 https://blog.pathvector.dev/protocol-lab-cc-30/ https://blog.pathvector.dev/protocol-lab-cc-30/ Impair one path with 100 ms RTT and 2% random loss, run iperf3 with CUBIC and then BBR, and watch the same link deliver 12 Mbit/s or 88 Mbit/s depending only on the algorithm. Fri, 10 Jul 2026 13:28:02 +0000 https://blog.pathvector.dev/protocol-lab-dane-17/ https://blog.pathvector.dev/protocol-lab-dane-17/ Pin a self-signed certificate with a DNSSEC-signed TLSA record, watch openssl accept it with Verify return code 0, then throw an impostor cert at the same pin and watch DANE reject it. Fri, 10 Jul 2026 13:28:02 +0000 https://blog.pathvector.dev/protocol-lab-dhcp-22/ https://blog.pathvector.dev/protocol-lab-dhcp-22/ Boot a client with no IP address at all, run a DHCP client against a tiny server, and capture the full Discover-Offer-Request-Ack (DORA) exchange on the wire. Fri, 10 Jul 2026 13:28:02 +0000 https://blog.pathvector.dev/protocol-lab-dnat-40/ https://blog.pathvector.dev/protocol-lab-dnat-40/ Hit a public address:port and get nothing, add one DNAT rule, and the same request lands on a hidden internal server — then read the conntrack table to see how the reply gets un-NATed. Fri, 10 Jul 2026 13:28:02 +0000 https://blog.pathvector.dev/protocol-lab-dns-05/ https://blog.pathvector.dev/protocol-lab-dns-05/ Build a tiny private DNS hierarchy — root, TLD, and authoritative — then watch a recursive resolver walk the delegation chain with dig +trace and see caching kick in on the second query. Fri, 10 Jul 2026 13:28:02 +0000 https://blog.pathvector.dev/protocol-lab-dns-06/ https://blog.pathvector.dev/protocol-lab-dns-06/ Query the same name twice and watch the TTL shrink, compare short and long TTLs, then ask for a name that doesn't exist and see why NXDOMAIN comes back with an SOA — and gets cached anyway. Fri, 10 Jul 2026 13:28:02 +0000 https://blog.pathvector.dev/protocol-lab-dns-13/ https://blog.pathvector.dev/protocol-lab-dns-13/ Sign a DNS zone, validate it with a trust anchor and watch the AD flag appear — then flip one byte of the data and see the resolver reject the answer with SERVFAIL. Fri, 10 Jul 2026 13:28:02 +0000 https://blog.pathvector.dev/protocol-lab-dns-14/ https://blog.pathvector.dev/protocol-lab-dns-14/ Query the same name over classic port-53 DNS, DNS over TLS, and DNS over HTTPS, capture all three on the wire, and see exactly what an on-path observer can and cannot read. Fri, 10 Jul 2026 13:28:02 +0000 https://blog.pathvector.dev/protocol-lab-dns-views-42-split-horizon/ https://blog.pathvector.dev/protocol-lab-dns-views-42-split-horizon/ Serve the same zone through two BIND views, ask from an internal and an external client, and watch one name resolve to a private address for insiders and a public one for everyone else. Fri, 10 Jul 2026 13:28:02 +0000 https://blog.pathvector.dev/protocol-lab-dnsrr-41/ https://blog.pathvector.dev/protocol-lab-dnsrr-41/ Give one name three A records, let BIND rotate the order on every response, and watch clients spread across backends — the simplest load distribution there is, and the coarsest. Fri, 10 Jul 2026 13:28:02 +0000 https://blog.pathvector.dev/protocol-lab-e2e-12/ https://blog.pathvector.dev/protocol-lab-e2e-12/ Run a single curl command in a container lab and watch it traverse every layer in sequence — DNS resolution, the TCP handshake, TLS 1.3 with SNI and ALPN, and an HTTP/2 200 — captured on the wire. Fri, 10 Jul 2026 13:28:02 +0000 https://blog.pathvector.dev/protocol-lab-ecmp-32/ https://blog.pathvector.dev/protocol-lab-ecmp-32/ Install a two-next-hop BGP route with maximum-paths, blast 16 TCP flows across two parallel links, then flip Linux's hash policy and watch one link do all the work — the classic ECMP gotcha. Fri, 10 Jul 2026 13:28:02 +0000 https://blog.pathvector.dev/protocol-lab-fw-36/ https://blog.pathvector.dev/protocol-lab-fw-36/ Set FORWARD to default-DROP, allow only ESTABLISHED/RELATED flows and NEW connections from the inside, then watch conntrack let replies through automatically while blocking unsolicited traffic. Fri, 10 Jul 2026 13:28:02 +0000 https://blog.pathvector.dev/protocol-lab-gre-21/ https://blog.pathvector.dev/protocol-lab-gre-21/ Build a point-to-point GRE tunnel, ping across the overlay, and capture the underlay to watch IP protocol 47 carry your inner packets in the clear — completing the WireGuard/VXLAN/GRE tunnel trilogy. Fri, 10 Jul 2026 13:28:02 +0000 https://blog.pathvector.dev/protocol-lab-http-10/ https://blog.pathvector.dev/protocol-lab-http-10/ Send four cleartext HTTP/1.1 requests — 200 with cache headers, HEAD, a conditional GET that returns 304, and a 404 — and learn to name every line in the exchange. Fri, 10 Jul 2026 13:28:02 +0000 https://blog.pathvector.dev/protocol-lab-http-27/ https://blog.pathvector.dev/protocol-lab-http-27/ Drive a 302 redirect and a Set-Cookie/Cookie round trip with curl in a container lab, and see exactly how stateless HTTP pretends to remember you. Fri, 10 Jul 2026 13:28:02 +0000 https://blog.pathvector.dev/protocol-lab-anycast-31/ https://blog.pathvector.dev/protocol-lab-anycast-31/ Announce the same IP from two servers, let BGP choose the best path, then kill the winner and watch traffic fail over automatically — no client changes needed. Thu, 09 Jul 2026 21:36:49 +0000