Topic
Network-resource Evidence
Within the Topic facet, Network-resource Evidence topic intelligence connects articles that share a specific subject, signal focus, or monitoring theme. The page gives readers a richer path through related reporting, source evidence, market actors, and infrastructure implications, with enough context to understand why the topic matters across company movements, governance decisions, regional exposure, and operational risk. Readers can compare recurring signals, affected organisations, public evidence, market context, service continuity, procurement, competition, compliance, and strategic planning questions behind the subject instead of stopping at a thin list of matching articles. It explains what the topic covers, which infrastructure actors or policies are involved, what evidence supports the coverage, and why the subject may matter for operators, customers, investors, and policy readers.
Story
LACNIC’s RDAP Conformance List Identifies Response Specifications, Not Network Authority
An RDAP response can look like a compact certificate of power: it carries a registry name, a range, a handle, a hierarchy link and a row of terse technical tokens. But the tokens in `rdapConformance` answer a narrower question. They describe the specifications used to build the…
History
The Pointer That Was Never Out of Band: TCP Urgent Data
TCP urgent data is a small control surface with a long history. The URG flag makes a 16-bit urgent pointer meaningful, but RFC 793 described the boundary it marks in two contradictory ways. That ambiguity crossed from the specification into implementations and application APIs.
IETF
The Bitmap Says a UDP Option Appeared—not What It Did: RFC 9870
RFC 9870 gives IPFIX exporters a compact way to report which UDP Option kinds appeared in a Flow. Its bitmaps are useful precisely because their claim is narrow: they preserve observed presence, not a packet history, a receiver’s processing decision or an application outcome.
IETF
DNS TCP Fallback Is a Capacity Path, Not an Exception
A resolver can pass every small UDP health check and still fail the first answer that matters. When a response is truncated, correctness moves onto TCP; listener capacity, connection state and middlebox policy then become part of DNS availability.
Story
LACNIC’s IPv4 transfer market and the price of scarcity
IPv4 exhaustion does not end allocation politics. It changes the place where they happen: from the distribution of a free pool to the rules governing transfers of resources that are already held.
History
Six Bytes Became an Address Only After the Domain Was Known: RFC 1449
An archive can preserve every octet and still lose the fact. Imagine finding six bytes in an old SNMP configuration: four could be an IPv4 address and two could be a UDP port. That reading is valid only if another field says the value belongs to the UDP transport domain. Without…
Story
AFRINIC's IPv6 Monitor Shows What Its 54% Contains
A routing dashboard now distinguishes an advertised allocation prefix from routes to smaller pieces of it. Its South Africa data show why that distinction is useful—and why neither the combined total nor the narrower category is a service-quality score.
History
The Database Said One Address. The Reply Followed the Packet Back: RFC 1445
The address book and the live packet disagreed. For a new request, the 1993 SNMPv2 administrative model used the address recorded for the destination. For the reply, it ordered something else: use the transport domain and address from which this request actually arrived, even if…
History
The Clock Went Back. The Key Had to Change: RFC 1446
After a power failure, an SNMP agent wakes with yesterday’s shared secret and a clock that thinks yesterday has not happened yet. A captured request, previously too old to accept, can become “recent” again. Its digest never changed. The receiver’s boundary of acceptable time did.…
History
The Key Changed Before the Reply Arrived. The Manager Had to Remember Both: RFC 1446
The agent had already installed the new secret. Its reply was built with that new value. The manager, still waiting for the reply before changing its own database, continued to trust the old one. RFC 1446 made this awkward interval explicit: a secure command could succeed at its…
Story
One Prefix, Two Countries in LACNIC’s Geofeed
A public location feed repeats 23 prefixes, four with conflicting country codes. The useful repair is narrower than deciding where the networks are: stop a loading rule from masquerading as geographic evidence.
CASE FILE
The Name Stayed the Same. The Module Did Not: RFC 9890
RFC 9890 makes a small registry correction with a large evidentiary consequence: a YANG module keeps its name and XML namespace across revisions, so identity alone can never tell an operator which definitions a system actually uses.
IETF
Mukul Srivastava and the BMP Gauge That Counted a RIB but Did Not See a Route
A number can be both useful and radically incomplete. RFC 9972 gives BMP operators a more precise way to report how many routes occupy a named RIB view at a particular moment. It does not turn that count into a route record, a policy explanation or a delivery observation. Mukul…
History
The Module Kept Its Name. The Device Did Not Prove Its Version: RFC 1442
A monitoring console can display a MIB module's latest revision date with complete confidence and still know almost nothing about the code answering from a particular device. RFC 1442 gave SNMP information modules a stable identity and a disciplined memory of change. It also drew…
IETF
A DNS Cookie Supplies Return-Path Evidence, Not Client Identity
A valid DNS Server Cookie can show that a requester at a source address is returning a value issued in an earlier exchange. That is useful evidence against off-path forgery. It is not a login, a durable device identifier or permission to attach a person’s name to the query.
Story
ARIN’s Reverse-DNS Controls Follow the Parent Block
A customer’s address range does not tell an operator where the reverse-DNS handoff belongs. ARIN’s direct-allocation rules put the editing boundary higher in the tree than a downstream inventory may suggest.
History
The Same Application Crossed Two Versions. The Proxy Changed the Operation: RFC 1452
The application asked for a bulk retrieval. The old agent never saw one. Between them, a bilingual manager consulted a local database, selected SNMPv1, zeroed two fields and changed the PDU into a single next-step request. RFC 1452 called the result transparent to the…
Story
What Comes After ARIN’s Empty Whois Replies
ARIN resolved a problem with some Whois queries in August. For anyone whose tools retained a suspect result, the next task is different: checking the local copy without turning a failed observation into a registration verdict.
Creators
Stefan Savage and measuring cybercrime as a system
Stefan Savage’s research repeatedly replaced isolated attack stories with measurements of traffic, supply chains, incentives and failure paths. From DDoS and network worms to spam, payment networks, cloud infrastructure and connected vehicles, the method is consistent: identify…
CASE FILE
The Slice Identifier Reached the Transport Edge. The Guarantee Still Had to Be Built: RFC 9889
RFC 9889 turns 5G network slicing into a chain of accountable translations: the mobile domain can name a slice, but the transport domain must still classify traffic, allocate resources, install state and prove the resulting service.