--- title: "Networking" description: "10 posts about Networking, summarised, each linking to the original." --- # Networking > 10 posts about Networking, summarised, each linking to the original. ## Articles ### [Introducing Private Network Gateway](https://yomu.fyi/post/introducing-private-network-gateway.md) - Company: [Databricks](https://yomu.fyi/company/databricks.md) - Author: Alex Esibov, Manish Bansal, Stanley Wang, Justin Ly, Vijay Raja - Published: Oct 14, 2026 - Type: Announcement Databricks announced Private Network Gateway (PNG) in public preview on Azure and private preview on AWS, addressing the networking friction that prevented teams from moving workloads to serverless compute. PNG provides a single managed gateway from serverless compute into a customer’s virtual network, eliminating the need for per-resource private endpoints, load balancers, and proxy VMs. Customers configure the gateway via a Network Connectivity Configuration (NCC) and delegate one subnet, with Databricks managing the gateway infrastructure while customers retain control over routing and security. PNG supports use cases such as ingesting from private databases via Lakeflow Connect, connecting AI agents to private MCP servers, using private package repositories, and routing egress through customer firewalls. The gateway offers two traffic modes for precise control or broad egress inspection and works alongside existing private connectivity without disruption. ### [Chasing that 32 ms tail latency in ClickHouse](https://yomu.fyi/post/chasing-that-32-ms-tail-latency-in-clickhouse.md) - Company: [Clickhouse](https://yomu.fyi/company/clickhouse.md) - Published: Oct 13, 2026 - Type: Problem & solution A customer observed an extra ~32 ms tail latency on simple SELECT queries after idle periods in ClickHouse’s Native TCP protocol. The root cause was that after a TCP idle period (RTO), the congestion window resets to initcwnd (8 MSS), and with TCP\_NODELAY enabled, each metadata packet (ProfileEvents, Logs, Progress) becomes a separate TCP segment, exceeding the small window and forcing an additional round trip. The ClickHouse Native protocol sends these metadata packets between Data and EndOfStream, and the unbatched writes caused the problem. The team reproduced the issue deterministically using Linux network namespaces and tc to simulate 32 ms RTT and initcwnd 8. They fixed it by batching those metadata packets into a single buffer write at the application layer, reducing tail latency from ~32 ms to ~1 ms, as confirmed by a Go client program that measured the time between the last Data packet and EndOfStream. ### [OCP Summit 2026: Powering AI with Open Innovations in Scale-Up, Scale-Out, and Scale-Across Networks](https://yomu.fyi/post/ocp-summit-2026-powering-ai-with-open-innovations-in-scale-up-scale-ou.md) - Company: [Meta](https://yomu.fyi/company/meta.md) - Published: Oct 12, 2026 - Type: Announcement At OCP Summit 2026, Meta unveiled next-generation open networking infrastructure for AI, including IcePack, its first liquid-cooled network rack, and IceCube, a 102.4T switch blade delivering 128×800G non-blocking capacity. The Flattened Planar Fabric (FPF) introduces a multiplane scale-out design where each GPU connects via eight independent 100G links to different switches, reducing latency and enabling larger clusters. Meta also shared its BAG super-spine for multi-site aggregation and Tahan, an Ethernet-based 51.2T scale-up switch for MTIA 300 systems. The company launched the Open Switch Platform Architecture (OSPA) initiative with Microsoft and Alibaba to standardize switch platform hardware and software interfaces. Additionally, Meta announced open-source implementations of MetaRoCE, its RDMA transport protocol optimized for AI cluster networks over Ethernet. ### [Egress network quality of service on Red Hat OpenShift](https://yomu.fyi/post/egress-network-quality-of-service-on-red-hat-openshift.md) - Company: [Red Hat](https://yomu.fyi/company/red-hat.md) - Author: James Force, Raffaele Spazzoli - Published: Oct 8, 2026 - Type: Tutorial Network bandwidth is a compressible resource, so setting a flat cap wastes capacity when the link is idle. The real goal is to prioritise production traffic while guaranteeing background workloads a minimum floor, allowing either class to burst to full capacity when the other is idle. The upcoming NetworkQoS CRD in OVN-Kubernetes will bring declarative traffic management, but until then administrators can use Linux traffic control (tc). A hierarchical token bucket (HTB) qdisc tree on the node’s physical interface, with filters matching background traffic by destination IP, provides the desired dynamic prioritisation. In a lab test with 25 Gbps bonded NICs, production traffic maintained 19.5 Gbps under contention while background traffic was throttled to 2.7 Gbps, just above its guaranteed floor. ### [2026 Birthday week: network performance update](https://yomu.fyi/post/2026-birthday-week-network-performance-update.md) - Company: [Cloudflare](https://yomu.fyi/company/cloudflare.md) - Author: Lai Yi Ohlsen - Published: Oct 2, 2026 - Type: Announcement Cloudflare is now the fastest provider in 74% of the top 1,000 global networks, up from 60% in April 2026, representing an additional 150 networks and 38 countries. Performance is measured using connection time (TCP handshake) and the trimean of connection times, which combines the 25th, 50th, and 75th percentiles to reduce outlier influence. To expand data collection, Cloudflare introduced a new methodology using Challenge Pages, which run non-interactive background measurements fetching lightweight files from providers including Cloudflare, Amazon CloudFront, Google, Fastly, and Akamai. Challenge Pages are delivered by Turnstile and preserve privacy while providing broader reach than error-page measurements alone. This increased measurement volume narrows confidence intervals around trimean values, making rankings more stable in networks where top providers are separated by only a millisecond or two. ### [Preventing quantum downgrade attacks against IPsec](https://yomu.fyi/post/preventing-quantum-downgrade-attacks-against-ipsec.md) - Company: [Cloudflare](https://yomu.fyi/company/cloudflare.md) - Author: Lina Baquero - Published: Sep 29, 2026 - Type: Announcement Cloudflare has identified a design flaw in IPsec that allows a quantum attacker to downgrade post-quantum-protected connections to classical cryptography. The attack exploits the fact that IKEv2 endpoints sign only their outbound messages rather than the full handshake transcript. This vulnerability requires a quantum computation in real time during the handshake, and resource estimates for such attacks have decreased, prompting Cloudflare to move its transition deadline to 2029. To mitigate this, Cloudflare worked with the IETF to develop a full transcript authentication extension for IKEv2 that prevents downgrade attacks. The extension is now available in beta for Cloudflare WAN and Magic Transit customers on an opt-in basis. ### [Scaling localnet user-defined networks (CUDNs) in Red Hat OpenShift to 3,500 networks](https://yomu.fyi/post/scaling-localnet-user-defined-networks-cudns-in-red-hat-openshift-to-3.md) - Company: [Red Hat](https://yomu.fyi/company/red-hat.md) - Author: Joe Talerico - Published: Sep 21, 2026 - Type: Benchmark Migrating from legacy virtualization with flat VLAN-based tenant networks to Red Hat OpenShift Virtualization often requires re-architecting network topology, creating friction. Red Hat OpenShift supports localnet user-defined networks (CUDNs) to preserve existing VLAN infrastructure while modernizing. Red Hat tested localnet CUDNs at scale, successfully managing up to 3,500 localnet CUDNs hosting over 3,500 active virtual machines. OVN-Kubernetes achieved 100% SSH connectivity, near-line-speed data-path performance over 100GbE interfaces without Geneve tunnel overhead, and stable control plane resource usage. Resource peaks reached approximately 5.5 CPU cores per worker node and 10 CPU cores on control plane nodes during bulk creation, then returned to low baselines. ### [Inside Petal: Building the World’s First Petabit-Class Transoceanic Subsea Cable](https://yomu.fyi/post/inside-petal-building-the-world-s-first-petabit-class-transoceanic-sub.md) - Company: [Meta](https://yomu.fyi/company/meta.md) - Author: By Elizabeth Rivera Hartling, Pascal Pecci, Matthew Mitchell - Published: Sep 21, 2026 - Type: Announcement Meta announced Petal, the first transoceanic subsea cable to deliver petabit capacity, connecting France and the United States over 7,000 km and expected to enter service in 2029. It will be the first subsea cable system to deploy multi-core fiber technology at scale, using 2-core fiber in a 24 fiber-pair system to achieve 1 Pbps. The cable overcomes the Shannon Limit by adopting spatial division multiplexing with multi-core fiber, requiring ultra-pure synthetic silica for low attenuation and counter-propagation to minimize crosstalk. Petal’s repeaters use a single-body 96 amp design with a Fan-In/Fan-Out interface to transition between 2-core and single-core fiber for amplification, staying within existing 18 kV power feeding limits. Built with NEC, Sumitomo Electric, and Orange, Petal represents the largest generational capacity increase of any repeatered subsea system. ### [Your sandbox can now serve requests](https://yomu.fyi/post/your-sandbox-can-now-serve-requests.md) - Company: [Boxcompute](https://yomu.fyi/company/boxcompute.md) - Author: boxy - Published: Sep 19, 2026 - Type: Announcement Sandboxes have traditionally been outbound-only machines, unable to receive inbound connections because they sit behind NAT with no public IP or open ports. BoxCompute now enables sandboxes to serve requests by using Tailcat, an open-source library from Tailscale that performs NAT traversal. Tailcat establishes a direct peer-to-peer WireGuard-encrypted path between the client and sandbox, using a DERP relay only for the initial handshake. This approach avoids the latency and bandwidth bottlenecks of relay-based tools like ngrok or Cloudflare Tunnel, and keeps the relay out of the data path. The feature is rolling out as an early preview with scoped, short-lived grants for selected TCP ports. ### [Product updates: VM Sandboxes, Lower latency routing, RBAC, and more](https://yomu.fyi/post/product-updates-vm-sandboxes-lower-latency-routing-rbac-and-more.md) - Company: [Modal](https://yomu.fyi/company/modal.md) - Published: Jun 15, 2026 - Type: Announcement Modal also announced several product updates including VM Sandboxes in alpha, lower latency regional routing, and role-based access control. VM Sandboxes, currently in alpha, are a new VM runtime that runs a real Linux kernel, supporting Docker containers and Linux features like eBPF, systemd, cgroups, and custom filesystem mounts for better I/O performance. Regional routing lets Functions run in US West, EU West, or Asia Pacific South instead of default US East with a single setting, lowering latency and keeping data in-region. RBAC is now available for Team and Enterprise plans, with Environments as security boundaries and read-only defaults via Restricted Environments, tied into Audit Logs. Other updates include domain allowlisting, named images, volume subdirectory mounts, readiness probes, configurable snapshot TTLs with a 30-day default, SDK updates, and a partnership with Anthropic for Claude Managed Agents.