APNIC Blog

Here are some complementary resources/papers: 1. Performance of eBPF LSM Hooks: https://dl.acm.org/doi/10.1145/3672197.3673431 (Analyzes the overhead introduced by LSM/tracing hooks on the kernel). 2. Performance of eBPF Maps: https://dl.acm.org/doi/10.1145/3672197.3673430 (Useful context for the htab_map_hash bottleneck shown in the perf report). 3. Network eBPF performance: https://blog.apnic.net/2026/03/25/demystifying-performance-of-ebpf-net… (Great broader context on eBPF overhead).

I have not had a deal with this, but if I was going to, I would start at the /64 and move up by nibble (4-bit) boundaries: /64, /60, /56, /52, /48. /56 is often recommended as the minimum as for a (residential) customer. /48 is considered a "site" address prefix, and is the smallest allocation that can be advertised in BGP: * https://blog.apnic.net/2020/06/01/why-is-a-48-the-recommended-minimum-… * https://www.infoblox.com/blog/ipv6-coe/a-48-for-every-site-and-for-eve… You get 65k subnets with it, which is what you get with 10/8.

I really hope he did find out, or at least had a good theory, on what protocol stack Starlink runs on. The engineering achievement is amazing, but it's sad that it all seems to happen entirely behind closed doors. https://blog.apnic.net/2024/05/17/a-transport-protocols-view-of-starli… is the best resource on its channel properties I've seen so far, but it's all empirical.

I think it's also worth mentioning mtr, which is what I use much more frequently than traceroute. It can help diagnose intermittent packet loss, and gives you an averaged sense of how things flow. This article from APNIC explains more about mtr and how to read it (plus some interesting details about how MPLS can obscure true paths) https://blog.apnic.net/2022/03/28/how-to-properly-interpret-a-tracerou… Also worth noting: It's also sometimes useful to trace with UDP, and many routers will drop ICMP selectively under strain. Nice article, and excellent presentation!

Using LD_PRELOAD for IPv4 seems to me like using the wrong tool for the job. > "Most of the apps I use support IPv6 but there are some cases when lack of IPv4 connectivity on my machine negatively affects experience." Just install clatd to get 464XLAT so hardcoded ipv4 get routed to 192.0.0.1 (the clat iface is the default gw for ipv4) which does NAT64 through tayga too. IMHO the best strategy is a mix of strategies: - 1. Clatd doing 464XLAT (RFC 6877) so: - 1.1 Stateful protocol translation (RFC 6146) at CG-NAT64 - 1.2 Stateless protocol translation (RFC 6145) at the UE - 2. DNS64 (RFC 6147) mechanisms at the DNS server returning padded AAAA for A only entries - 3. IPv4 embedding into IPv6 addresses (RFC 6052 section 2.2) Suggested reading: https://www.apnic.net/wp-content/uploads/2017/01/IPv6_Migration_Strate…

> I would love to read more about how to set up a cheap self-managed CDN. See also: https://blog.apnic.net/2021/04/07/building-an-open-source-anycast-cdn/

https://blog.apnic.net. the editors welcome suggestions for network savvy tech or tech/policy content. I'm staff, so I got an easier run in but stuff which makes HN sometimes gets a rerun or a request for a write up.

It's not servers. It's who will have the best submarine cables. A game in which Apple is not participating btw. Not even with an Elon style moon, err, low earth orbit shot. https://blog.apnic.net/2019/04/03/the-future-of-undersea-internet-cabl…

The linked https://blog.apnic.net/2016/04/04/dns-zombies/ is also a good read.

The general arguments here are that CDNs have replaced tier1 ISPs as the predominant force on the Internet. Geoff Huston has written about this over the last ~10 years[0][1]. So the question as to alternatives is void - the problem is CDNs MitM'ing yur datas across multiple domains, and the loss of the nostalgia (or whatever) for the tier1 ISPs (who were all horrible in their own ways). I don't particularly subscribe to the harms Geoff purports, but I cannot fault his analysis of the situation. If you haven't read it before, it is worth the read. If you want a free and open Internet, then you don't want someone else's TLS proxy between every consumer and every producer. This ignores the problems of DDoS, scaling, etc. Buuutttttt.... 99% of websites don't have those problems, so why are you building a solution which trades decentralization for it? Anyhow, sounds like you're into all the wonderful things Cloudflare (and every other CDN) provides. Great. That's fine, just don't be angry when the free and open Internet promised to all of us in the 1990s requires 3rd party gate keepers. And no, there aren't solutions to all the problems. 0: https://blog.apnic.net/2016/10/28/the-death-of-transit/ 1: https://www.thousandeyes.com/blog/internet-report-evolution-network-ar…

Great feedback, I'll add a little more to the site to describe how it all works. Until then... At a 30,000ft view, the site works by building an in-memory routing table at boot time that has an entry for every route on the internet and which ASN (autonomous system number) announces it. From there, it stitches together data on the organization that the ASN belongs to, and geolocation data, and then exposes it in the API/UI. Under the hood it's using a treebitmap[1] data structure, which means that it can do _very_ fast lookups when given a particular ip address or ip address range. Zooming in a little more, the main data source is MRT dumps from the RIPE RIS project[2]. There are a number of routers that RIPE (one of the 5 regional internet registries that hand out ASNs and IPs) that rely on network operators to share their view of every route on the internet. These routers are probably some of the most well-connected routers in the world. For the purposes of this service, MRT dumps are effectively a point-in-time snapshot of the routing table of that router. IP Guide parses that file, rebuilds it in memory, and attaches other relevant data to each IP range (also known as a "prefix"). This allows the service to stay fast and stateless, which was one of the main things I was trying to optimize for when building it. [1]: https://blog.apnic.net/2021/06/04/storing-and-retrieving-ip-prefixes-e… [2]: https://ris.ripe.net/docs/10_routecollectors.html

An excellent find! > We will be destroying all “raw” DNS data as soon as we have performed statistical analysis on the data flow. We will not be compiling any form of profiles of activity that could be used to identify individuals, and we will ensure that any retained processed data is sufficiently generic that it will not be susceptible to efforts to reconstruct individual profiles. Furthermore, the access to the primary data feed will be strictly limited to the researchers in APNIC Labs, and we will naturally abide by APNIC’s non-disclosure policies. So it's a 5 year research program, with options to extend it as a research program. To me, that means they intend to keep DNS data for up to 5 years (or longer) before performing statistical analysis and processing on it. Here is APNIC Labs's privacy policy http://labs.apnic.net/privacy.shtml and APNIC's privacy policy https://www.apnic.net/about-apnic/corporate-documents/documents/corpor… So much for "privacy-first".

> 2. In many situations, we dont want devices on the internet at all, and on private only networks. ... Unique Local Addressing (RFC 4193) solves this problem and requires no coordination with outside parties. The network admin gets to choose the scope of the ULA prefix, so you can trivially make your ULA traverse multiple LANs if you wish. (This addresses your first point, too.) > 3. There is a lack of clearly communicated best practices for the industry. Eh? This is the first hit for "IPv6 BCP": https://www.apnic.net/community/ipv6-program/ipv6-bcp > 4. Knowing how heavily the NSA was involved in ipv6 (in particular ipv6 ipsec)... Then -uh- don't use IPSec and block IPSec connection establishment attempts at your border firewalls. Or, because implementation of IPSec is -sadly- not a requirement for IPv6 implementers, use an IPv6 implementation that doesn't implement it. Edit: You are aware that OpenVPN uses TLS for session authentication and IPSec for transport of tunnelled data? :) > 5. As the admin, I want to be able to see non encrypted traffic and metdata traversing my exit points. I am having a harder and harder time diagnosing IPv6 because of how often it wants to tunnel to some ipv4 address that I dont trust (read: microsoft). Are you talking about IPv6 over Teredo tunnels? If you are, then get a packet dump and fire up Wireshark... Teredo doesn't encrypt the traffic that it tunnels. If you aren't, and you're talking about something that's wrapping traffic…

They go into extreme detail about DNSsec root key security https://blog.apnic.net/2021/10/12/dns-security-and-key-ceremonies/

Denic should work out a desaster recovery test - like: https://blog.apnic.net/2022/02/14/disaster-recovery-with-dnssec/

> And still, in the year of our lord 2026, GitHub does not support IPv6. Especially given that it is now owned by Microsoft, which has been working on IPv6-only (at least on their corporate network) for almost a decade: * https://blog.apnic.net/2017/01/19/ipv6-only-at-microsoft/ * https://www.arin.net/blog/2019/04/03/microsoft-works-toward-ipv6-only-…

> This is precisely the situation that the internet was designed to prevent. Geoff Huston discuss this a few months back. The economic incentives helps shape centralized internet, to the point that most of today's traffic is cache push and private peering between major providers, rather than network transit. https://blog.apnic.net/2025/08/21/podcast-the-inevitability-of-central… Which kind of make sense, since with peering both end of the infra (if separate entity) can negotiate for better terms upfront. While the latter is basically unpredictable opex based on traffic shape and routing algorithm.

Problem with ULA is that it's functionally useless on a dual-stack network. https://blog.apnic.net/2022/05/16/ula-is-broken-in-dual-stack-networks…

IPv4 continues to be available to entities that have a need that fits a particular policy shape, just most people don't. Specifically, you can get IPv4 /24s for IPv6 transition purposes. This includes anycast DNS, MX, etc for legacy clients on other networks, v4-side of CGNAT, etc. E.g. I was able to get a /24 in the ARIN region in 2021 and could justify 2 more for a _logical_ network topology similar to what NK presents to the world. APNIC similarly has a pool available for IPv4 allocations: https://www.apnic.net/manage-ip/ipv4-exhaustion/#the-situationin-apnic

APNIC has some addresses [1] and will assign up to two /24s to qualified new accounts within the region. There are also carve outs for National Internet Registries and Internet eXchange Points. [1] as of Nov 2025, approximately 3 million or a little more than 12,000 /24s https://www.apnic.net/manage-ip/ipv4-exhaustion/#how-to-trasnfer-ipv4

I can't find 2025 stats, but HTTP/3 adoption was already widespread two years ago. https://blog.apnic.net/2023/09/25/why-http-3-is-eating-the-world/

I have found blogposts by Toni Pasanen to be quite good in explaining networking requirements of the AI Infra. Ex. https://nwktimes.blogspot.com/2025/04/ai-fabric-backend-network-topolo… There are more posts on the same blog. Articles by Sharada Yeluri on APNIC blog are also good: ex. https://blog.apnic.net/2025/06/03/scale-up-fabrics/ More articles here: https://blog.apnic.net/author/sharada-yeluri/

> possible for DNSSEC if people who want to solve the problem But for several decades, DNSSEC proponents have been complaining about the vocal detractors, rather than actually addressing the problems that have been identified. That's a pretty significant track record on which to make a fair judgment about who is making the strongest case. Someone above offered a link [1] that gives some pretty good reasons why nobody is stepping up to fix the problems. [1] https://blog.apnic.net/2024/05/28/calling-time-on-dnssec/

DNSSec has caused so many outages at this point it's a joke. You have to be so insanely careful and plan everything to the nth degree otherwise you break everything: https://internetnz.nz/news-and-articles/dnssec-chain-validation-issue-… The idea is important. What it aims to protect is important. The current implementation is horrible, far too complex and fraught with so many landminds that no one wants to touch it. If Geoff Huston is suggesting it might be time to stick a fork in DNSSec because it's done, then IMHO it's well cooked. https://blog.apnic.net/2024/05/28/calling-time-on-dnssec/

The vast majority of people will not see EDE errors. Even when they are set there is no guarantee that downstream resolvers have it enabled. The default in Unbound is disabled and people rarely check logs. Even if someone is using DoH their browser would have to translate the specific text to the user if it received such an error. Here [1] are some notes on the support of EDE around the internet. As a side note I do not see that error for that domain. I get an A record which belongs to Cloudflare. Cloudflare could just as easily drop that domain into an account that displays the censored error message as text/plain to the user and close the connection. streameast.app. 282 IN A 172.64.80.1 [1] - https://blog.apnic.net/2023/09/28/extended-dns-errors-unlocking-the-fu…

Based on this Geoff Huston post: https://blog.apnic.net/2024/05/28/calling-time-on-dnssec/

This is almost certainly a fragmentation issue caused by lower MTU and broken path MTU on the VPN. Drop the system to 1280 to troubleshoot, if things work immediately there's the culprit, raise it up til it doesn't or don't, I keep my VPN's at 1280. EDIT: I do not know why its an issue with firefox and not chrome, it's likely QUIC fucking up since it cant fragment and needs to fall back to TCP, chrome is probably error handling this better... dropping the MTU that low will make the fallback explicit: https://blog.apnic.net/2019/03/04/a-quick-look-at-quic/ EDIT2: Could also try disabling QUIC, instructions here: https://developers.cloudflare.com/cloudflare-one/policies/gateway/http…

icanhazip.com provides a similar service and has a good story behind it [0] [0] https://blog.apnic.net/2021/06/17/how-a-small-free-ip-tool-survived/

Those routing tables are badly made. An IPv6 route takes twice as much memory as an IPv4 route, and there are a lot less than half as many IPv6 routes. https://blog.apnic.net/wp-content/uploads/2023/01/Figure-1-%E2%80%93-I… https://blog.apnic.net/wp-content/uploads/2023/01/Figure-14-%E2%80%94-…

TCP can get confused by satellite handovers https://blog.apnic.net/2024/05/17/a-transport-protocols-view-of-starli…