Learning how to secure the network layer of your AWS workloads by splitting a three-tier app across public and private subnets, controlling traffic with internet and NAT gateways, and layering security groups, network ACLs, and VPC Flow Logs.

Documenting my hands-on journey with AWS networking, including VPC design, public and private subnets, routing, and the security considerations behind a three-tier architecture.

Subnets are network routing boundaries, not security boundaries. Discover why hardcoding subnet CIDRs exposes your database to lateral movement, and how Security Group Referencing enforces dynamic least privilege at the ENI hypervisor layer.

This article explains how AWS networking works by following a single user request through a VPC. It walks step by step through Route 53, the Internet Gateway, Application Load Balancer, private EC2 instances, RDS, S3 and NAT Gateway. Along the way it covers public vs private subnets, route tables, Security Groups vs NACLs, and IAM vs VPC Endpoints. It's written for beginners who want to see how AWS services connect, not just what each one does.

A beginner-friendly guide to Amazon VPC, including subnets, route tables, internet gateways, NAT gateways, security groups, and network design. Learn how AWS networking works behind the scenes and how to build a secure cloud architecture.

Emulate one or more IPv4/IPv6 devices in subnets with ARP/NDP resolution and ping support using Ostinato's GUI to replace end hosts in the test topology

When a packet capture is full of traffic you don't care about, narrow it with a capture filter. For...

I'm learning AWS networking as part of my Cloud and DevOps journey. In this article, I share five beginner-friendly concepts that helped me understand how VPCs, subnets, route tables, Internet Gateways, and Security Groups work together.

Learn how to design and deploy a secure, highly available 3-tier application using Amazon VPC, Application Load Balancer, EC2 Auto Scaling, private subnets, NAT Gateway, and a managed database.

When a packet capture is full of traffic you don't care about, narrow it with a **capture filter**. For an IP address, the key distinction is whether you want traffic in both directions, only packets from the address, or only packets going to it. sudo tcpdump -nn -i eth0 'host 192.0.2.25' This captures packets where `192.0.2.25` is either the source or destination. Replace the example address and interface with the ones relevant to your system. ## Start with the right interface An IP filter only sees packets that reach the interface you selected. On Linux, list available capture interfaces with: tcpdump -D Then select the interface carrying the traffic with `-i`. If you're unsure which device to inspect, this guide to listing network interfaces on Linux explains how to identify them. The options and the filter have separate jobs: * `-i eth0` selects the interface. * `-nn` keeps addresses and ports numeric instead of resolving names. * `'host 192.0.2.25'` is the capture filter. On many Linux systems, packet capture requires elevated privileges, which is why examples use `sudo`. ## Choose whether to match either direction or one side Use `host` to match an address appearing as either endpoint. Add `src` or `dst` to restrict which side of the packet must contain it: # Packets to or from the address sudo tcpdump -nn -i eth0 'host 192.0.2.25' # Packets sent by the address sudo tcpdump -nn -i eth0 'src host 192.0.2.25' # Packets sent to the address sudo tcpdump -nn -i eth0 'dst host 192.0.2.25' Direction is relative to the packet being observed. If you capture only `dst host 192.0.2.25`, a reply sent _from_ that address won't match. Start with `host` when you want to see both sides of a conversation; narrow to `src` or `dst` once you know which direction matters. ## Match a subnet instead of a single host To capture traffic involving any address in a network, use `net` with CIDR notation: sudo tcpdump -nn -i eth0 'net 192.0.2.0/24' This matches packets whose source or destination belongs to `192.0.2.0/24`. Add a direction qualifier if you only want one side: sudo tcpdump -nn -i eth0 'src net 192.0.2.0/24' sudo tcpdump -nn -i eth0 'dst net 192.0.2.0/24' Use a network address with the appropriate prefix length. For example, `192.0.2.0/24` represents addresses from `192.0.2.0` through `192.0.2.255`. ## Combine an IP filter with a port Capture filters can combine conditions. Use `and` when both conditions must match, and quote the whole expression so your shell passes it to tcpdump as one argument: sudo tcpdump -nn -i eth0 'host 192.0.2.25 and tcp port 443' This matches TCP traffic involving the address when either TCP port is 443. To require traffic to be headed to the host, add a direction qualifier: sudo tcpdump -nn -i eth0 'dst host 192.0.2.25 and tcp port 443' You can also match either of two hosts. Parentheses make the intended grouping clear when combining `or` with `and`: sudo tcpdump -nn -i eth0 '(host 192.0.2.25 or host 198.51.100.10) and tcp port 443' Without clear grouping, a compound filter can match more traffic than intended. When a complicated expression behaves unexpectedly, simplify it or add parentheses to show which conditions belong together. ## IPv4 and IPv6 `host` can match an IPv4 or IPv6 address. Use `ip` or `ip6` when you want to explicitly restrict the expression to one address family: sudo tcpdump -nn -i eth0 'ip and host 192.0.2.25' sudo tcpdump -nn -i eth0 'ip6 and host 2001:db8::25' An IPv4 filter won't match an IPv6 connection to the same service, or vice versa. If tcpdump rejects an expression, the supported filter syntax can depend on the local tcpdump/libpcap environment; check the local `pcap-filter` manual. ## If the capture shows nothing Before broadening a filter, check the assumptions behind it: 1. **Interface:** Is the traffic visible on the interface selected with `-i`? Use `tcpdump -D` to see the available capture interfaces. 2. **Direction:** Did you use `src` or `dst` when you meant to capture both directions? Try `host ADDRESS` as a first check. 3. **Address and family:** Verify the address you expect to see, and whether the connection uses IPv4 or IPv6. 4. **Extra conditions:** Temporarily remove port or protocol requirements to see whether the IP match works on its own. 5. **Quoting and grouping:** Quote the entire expression and use parentheses around mixed `and`/`or` logic. 6. **Permissions:** Use elevated privileges when required by your system. The examples here focus on Linux and Unix-like tcpdump environments. For a Windows packet-capture workflow, see options including WinDump and Pktmon. The useful starting points are `host ADDRESS` for either direction, `src host ADDRESS` or `dst host ADDRESS` for one direction, and `net CIDR` for a subnet. Add port and protocol conditions only after confirming you're looking at the right interface and address family. I originally published a more detailed version of this guide on the SSHFlow blog. I'm also building SSHFlow — an SSH client where every server gets its own workspace for terminals, SFTP, code, and databases.

A practical introduction to Amazon VPC for infrastructure professionals, connecting traditional networking concepts such as subnets, routing and firewalls with networking in AWS.

Pine Analytics data shows Bittensor's Chutes subnet subsidizes AI inference by a 22-to-1 to 40-to-1 ratio over paying customer revenue.

Continuing my AWS Cloud Foundations journey with Module 5, where I explored how networking works in the cloud , from VPCs and subnets to routing, security, DNS, and connecting networks.

Oct 5, 12:13 UTC **Resolved** - Our Engineering team fully resolved the VPC Networking disruption as of 10:29 UTC. Customers can now create and delete VPC peering connections, subnets, and routes as expected. Following the recovery, we monitored the affected systems and confirmed that VPC Networking operations remain stable. We apologize for any inconvenience this disruption may have caused. If you continue to experience unexpected behavior, please open a ticket with our Support team for further assistance. Oct 5, 11:02 UTC **Monitoring** - Our Engineering team has implemented a fix for the VPC Networking disruption. Customers should now be able to create and delete VPC peering connections, subnets, and routes as expected. Previously pending operations have been cleared, and VPC Networking operations are returning to normal. Our Engineering team is monitoring the affected systems to ensure continued stability and verify that operations remain healthy. We appreciate your patience and will provide another update once normal operation has been fully confirmed. Oct 5, 10:38 UTC **Identified** - Our Engineering team identified a disruption affecting VPC Networking operations that began at approximately 08:48 UTC. During this time, customers may have experienced delays or failures when creating or deleting VPC peerings, VPC Native DOKS clusters, or Private Network Connections (PNCs), as well as when adding cluster members. Creating routes and subnets may also have been affected. Operations are now returning to normal, and our Engineering team is monitoring the affected systems to ensure continued stability. Existing VPC resources and network connectivity remain unaffected. We will provide another update as soon as more information becomes available.

Learn AWS VPC networking through a practical troubleshooting approach, covering CIDR, subnets, route tables, Internet and NAT Gateways, Security Groups, and Linux-based connectivity diagnostics.

In this article I will discuss the best Bittensor (TAO) subnets for decentralized AI and describe the technologies, use cases, strengths and practical applications that make them special. We will review how these special purpose subnets support AI inference, machine learning, robotics, GPU computing, security, storage and financial intelligence and will consider their possible role in building a more open, scalable and decentralized artificial intelligence ecosystem.