Intelligence

Latest Articles

Latest intelligence on infrastructure operators, policy decisions, market moves, and digital power shifts.

Many cool-blue request streams and one larger amber stream enter a transparent hourly ledger, then leave through several unlabelled outcome chambers over an Asia-Pacific map.

Story

One Source IP Accounted for 38.76% of APNIC's WHOIS Queries in an Hour

One Source IP Accounted for 38.76% of APNIC's WHOIS Queries in an Hour intelligence summary explains the development, the public evidence available to readers, the organisations involved, the regional context, market exposure, and the infrastructure consequences that may follow.…

Editorial illustration of a structured public registry record with separate maintenance pathways controlling different field groups.

Number Resource Society

Who can change the Dunnes RIPE record—and what that power does not prove

The authority behind a public internet-resource record is neither unlimited nor merely clerical. In the Dunnes case, protected RIPE Database entities are governed through maintainer authentication, `mnt-by` references and controlled member procedures. Those mechanisms can…

Three vintage routers form a triangle around a broken destination link while blue route tokens move one way, red barred tokens return, and an amber three-router loop remains visible

History

The Route That Came Back as Unreachable: How RIP Used Poisoned Reverse

A router learned a path from its neighbour, then deliberately told that same neighbour the path was unreachable. RIP called this poisoned reverse. The apparent contradiction bought fast escape from one kind of loop, while exposing how little any router could know about the…

A cyan authenticated record opens into three endpoint-parameter bundles that a central client selector filters, choosing one amber path through a fixed white original-identity aperture.

CASE FILE

The Record Bound the Options. The Client Still Chose the Connection: DNS SVCB, HTTPS and Service Authority

A domain owner can authenticate a list of preferred endpoints, protocols and connection parameters before the first application exchange. That does not make the first preference a command, turn a routing target into the origin, or prove which path a real client can securely…

Three mechanical configuration rows show an incomplete row, a complete but disengaged row, and a complete row coupled to a running machine

History

The Row That Existed Before It Could Be Used: How SNMP Separated Creation from Service

A network manager could write every visible cell in a configuration table and still not know whether the device had accepted a usable configuration. SNMP's answer was not to pretend that creation and operation were one event. `RowStatus` gave a conceptual row a lifecycle in which…

A stack of luminous inventory plates hits a hard ceiling while one intact plate crosses an amber epoch aperture into continuing verification lanes and converges through independent validator prisms.

CASE FILE

The Counter Hit Its Ceiling. The Filename Opened a New Epoch: RPKI Manifests and Recovery Authority

A correctly signed RPKI manifest can become unusable because a relying party remembers an impossible predecessor. RFC 9981 gives the issuer a narrow way out: change the manifest filename, start a new comparison epoch and preserve every other freshness, location and integrity…

An intact cyan policy feed passes through a verification ring into a local resolver where an amber first-priority exception plate and a central selector route the response toward preserved, redirected, denied or silent outcomes.

CASE FILE

The Feed Was Valid. The Answer Was Local: DNS Response Policy Zones and the Authority to Rewrite Resolution

An authenticated threat feed can tell a resolver what a publisher recommends. It cannot decide which users lose a name, whether the answer should disappear or be replaced, or who owns the damage when a correct transfer produces the wrong operational result.

Enke Chen in an editorial portrait against abstract BGP path traces

IETF

Enke Chen and the Best Path That Kept Its Seat

A BGP router can change its forwarding choice even when the challenger is no better by policy, path length, origin, MED, session type or interior cost. RFC 5004 asks a narrower question: if the only remaining reason to move is the remote speaker's lower BGP Identifier, why move…

Split editorial illustration of duplicate signed RPKI source cards passing through a validator while identical final VRP arrays remain on both sides

Story

AFRINIC's Validator Counted One Fewer Duplicate. The Final Set Stayed at 30,847

Two consecutive validation records moved in an oddly disciplined way. AFRINIC's public Routinator first counted 39,059 valid input VRPs and 8,212 duplicates, then 39,058 inputs and 8,211 duplicates. The final set offered to routers remained 30,847. That unchanged number is not…

Two vintage network endpoints exchange matching teal proposal cards, an amber counterproposal and a red rejected option across one point-to-point cable

History

The Reply That Could Not Edit the Request: How PPP Negotiated a Link

Two machines could share a point-to-point wire and still disagree about the link they were using. PPP did not resolve that disagreement by choosing a master. Each endpoint proposed the changes it wanted, and the other endpoint could accept the proposal exactly, suggest different…

A continuous glass byte conduit passes through a brass control gate, where two identical crimson tiles enter, one is diverted into the command mechanism and one continues as data

History

The Byte That Had to Repeat Itself to Remain Data: How Telnet Made Room for Commands

Telnet put a terminal's characters and the protocol's own instructions into one TCP stream. That economy created a question every parser had to answer: when the value 255 arrived, was it data or the beginning of control? Telnet's answer was that a literal 255 could cross only by…

A complete cyan digest ring closes around an intact DNS zone lattice while one amber-red record takes a wrong branch, a separate admission gate quarantines the candidate, and a blue prior lattice remains connected as the last known good state.

CASE FILE

The Digest Matched. The Zone Was Still Wrong: ZONEMD and the Limits of Cryptographic Integrity

A whole-zone checksum can expose truncation, corruption and substitution. It can also authenticate a mistake with perfect precision. The decision for infrastructure leaders is not whether to trust cryptography, but how narrowly to interpret what it has proved.

A cyan DHCP client asks one original server before an amber broadcast reaches authorised alternates, with a red deadline separating renewed and expired lease tokens

History

The Lease Could Outlive One Server, but Not Its Deadline: How DHCP Moved from Renewal to Rebinding

A DHCP client does not lose its address merely because one server falls silent. It first asks the server that granted the lease, later widens the request to other authorised servers, and keeps using the address only while the existing deadline still permits it. DHCP made…

A locked blue mail cabinet holds envelopes with reversible red deletion seals, while an amber exit gate leads to a removal chute and a broken network cable stops before the boundary

History

The Deletion That Wasn't Real Until Goodbye: Why POP3 Waited for QUIT

A mail client could ask a server to delete a message and receive a cheerful `+OK`, yet the message still existed. That was not evasive protocol design. POP3 treated deletion first as a reversible intention, then made the final goodbye the boundary at which the server tried to…

Three transparent document-service chambers share one chronology rail: a green completed change, a split path where document creation proceeds while retrieval is blocked, and an amber configuration-monitoring stage.

Story

RIPE Marked the Upgrade Complete. Retrieval Failed Twice Afterward

At 17:56 CEST on 22 August, RIPE NCC marked its Alfresco maintenance complete. On Monday afternoon, document creation still worked but some files could not be viewed or downloaded. On Wednesday, a second incident began; RIPE NCC later changed the document system’s configuration…

Editorial illustration of three authenticated DNS operator signal paths converging on a guarded parent-zone DS publication gate, with an isolated destructive removal path and downstream validating resolvers.

CASE FILE

The Signal Was Signed. The Delegation Was Not Yet Secure: CDS/CDNSKEY and the Authority to Publish DS

A child zone can publish a perfectly signed request for a new DNSSEC secure entry point and still lack the one chain that would validate it. CDS/CDNSKEY makes parent coordination machine-readable; it does not collapse operational control, registrant authority, parent admission…

An intact glass DNS catalog cartridge arrives by a cyan authenticated-transfer rail while an amber consumer gate stops red mass-deletion changes before a field of zone modules and diverts them to quarantine.

CASE FILE

The Catalog Was Valid. The Deletion Was Not: DNS Catalog Zones and the Authority to Provision

An authenticated DNS transfer can deliver a perfectly formed catalog whose operational consequence is to remove every zone from a secondary fleet. The transport may be trustworthy and the syntax impeccable while the decision encoded inside it is still wrong. DNS Catalog Zones…

AI-generated editorial portrait of Dr Mohamed Awang-Lah against an abstract blue-teal network background with a restrained amber accent.

Leaders

What Mohamed Awang-Lah controlled at MY.NeuTrans—and what he did not

Dr Mohamed Awang-Lah made a consequential structural choice after JARING: he founded a company designed to supply passive network infrastructure to operators without also competing for their retail customers. The public record supports that decision, its implementation and the…

Three translucent calendar panels stand before one coastal registry office: the first is entirely cyan, the second mixes cyan with three amber rows, and the third is mostly amber beneath four cyan rows.

Story

One LACNIC Office Has Three Public Calendar States

LACNIC’s contact record describes one Montevideo office, one set of weekday opening hours and one institutional doorway. Change the language, however, and its public holiday calendar changes year. Spanish presents thirteen dates in 2026; English leaves three in 2025; Portuguese…

Conceptual global DNS infrastructure with distributed server nodes, highlighted degraded routes, monitoring controls and traffic rerouting paths.

CASE FILE

The F-Root outage that showed why redundancy is not the same as readiness

A January 2020 DNS incident exposed a narrow but consequential weakness in distributed infrastructure: many nodes can exist, yet recovery can still depend on whether separate organisations can detect a semantic fault, agree on its cause and exercise emergency routing authority…