nog.fi meeting 2026.11nog.fi meeting

In August 2026, a DDoS attack knocked Norway's government digital services offline and made the news. We had not watched it happen live. What we did was go back through our botnet tracking feed and find the attack orders: two of the botnets we track had been commanded to hit a single IP address, the one behind its digital-identity service, with a TCP socket flood. A socket flood needs a completed TCP handshake, so in practice its sources are real: every connection came from a reachable device in someone's home.

The industry has a polite name for a consumer device that carries other people's traffic: a residential proxy. But when the device was enrolled without its owner's knowledge, cannot be removed by a factory reset because the software ships in the firmware, and accepts inbound sessions on demand, "proxy" is marketing. It is a backdoor. This talk argues the word should track consent, not function, and shows what the residential-proxy industry actually looks like once you stop taking its brochure at face value.

That backdoor is also a billion-dollar business, driven mostly by AI scraping and fronted by enough legitimate customers that operators can't simply block it. These are your subscribers' devices, so the collateral is yours. You can find them by the backend infrastructure they call, not by inspecting subscriber traffic, though getting the software off is another matter. Whether those legitimate uses are worth the cost is the question the industry would rather you never asked.

Most network automation answers one question: can we push the config? Intent-based networking asks a harder one: is the network actually doing what we meant?

This talk defines what intent actually is: a declaration of outcomes, constraints, and safety rules that is versioned, validated, auditable and verifiable against reality.

Intent is stable, renderers change. Expectations are the proof

We’ll focus on the step most automation never reaches: compiling intent into expectations that define the evidence proving the intent is met.

We’ll close by naming common traps and share a simple way to know whether you’re really building IBN or just automating config.

AI networking discussions often stop at the GPU cluster. But a single inference task may increasingly cross devices, agents, models, tools, data sources, networks and providers—turning one user interaction into a dynamic distributed execution graph.

This talk explores what that could mean for network architecture and interconnection. It examines how latency, compute availability, policy and state may influence where parts of a task execute, and why explaining performance becomes difficult across organisational boundaries.

It maps existing observability building blocks and introduces FOX, a deliberately exploratory model for exchanging selected, policy-controlled evidence. The talk concludes by connecting observability with security and resilience, including agentic amplification, inference exhaustion, hidden dependencies and stateful failover.

Coherent optics does not have to feel like black magic. This presentation moves from the essentials of 100G, 400G and 800G coherent technology to real deployment scenarios: selecting the right module and transmission mode, checking the optical budget and making sense of OSNR, Q-factor and Q-margin. Expect practical configuration and troubleshooting examples - no marketing jargon, just the answers you need when a link refuses to come up.

RTBH is twenty years old and everyone supports it. Yet when you actually send a blackhole route to a neighbour during an attack, you often have no idea what will happen: is it enabled on this session or do you need a ticket first, which community and prefix lengths are accepted, will your /32 survive their RPKI policy, and does the null route stop at one router or propagate to their neighbours?

This talk looks at RTBH as it is actually implemented. Using data from a community project where 88 networks have self-reported their RTBH policies, I show how far apart the implementations are: fewer than half use the RFC 7999 community, a quarter need a ticket before it works, only half forward the route onward, and there is no agreement on how to treat a blackhole route that is RPKI Invalid. None of this is wrong, but almost none of it is documented, and that is what makes RTBH unreliable across network borders.

As network architectures transition towards open, disaggregated hardware, Open Source Switch Operating Systems (like SONiC) have unlocked unprecedented access to hardware telemetry. Concurrently modern transceivers offer advanced Vendor Digital Monitoring (VDM) capabilities that go far beyond classic Digital Diagnostic Monitoring (DDM). However the industry still struggles to utilize this data for proactive operations.

This presentation demonstrates how to leverage open VDM interfaces within Open Source Switch OS architectures to establish a continuous, high-frequency telemetry pipeline. By analyzing realtime physical layer metrics - such as pre-FEC bit error rates, laser bias current shifts and optical signal degradation - we showcase how to move from reactive troubleshooting to predictive maintenance. Attendees will learn how open software paradigms enable operators to detect impending Layer 1 failures before packet loss occurs ensuring maximum network uptime without vendor lock-in.

This is going to be a lightning talk about the recent memory layout optimizations for BGP in FRRouting and how they're important.

A short introduction on what ICP documents are and why the ICP2 document is being updated, not all the deep details but a very brief overview and some dates on the process.

I now have a draft presentation,which is not yet verified, but it will give you an idea on what i think it could be.

i would like your comments on what to add or leave out and why.

The reason it can only be done during the ripe meeting is that in the week before the ripe meeting at ICANN87 there will be decisions made about that document, so the latest info is only then available.

What if nog.fi was a registered association?