Pinoy IT Share

Default network gateway configurations are rarely optimized for security out of the box. In MikroTik RouterOS, the connection tracking engine defaults to keeping established TCP connections alive for up to 24 hours (`1d`). In active environments, this accumulates thousands of "ghost connections," burdening system memory and opening doors to resource exhaustion attacks. This article highlights how to harden your conntrack state table through strict timeout reduction and aggressive SYN flood mitigation. Architecture Overview: Conntrack State Table Hardening graph TD A[Incoming Network Packets] -->|State Inspection| B[MikroTik Conntrack Table] subgraph Hardening ["Timeout & Security Policy"] B -->|TCP Established: Lowered to 4 Hours| C[Purges Stale / Ghost Sessions] B -->|SYN Sent/Received: Lowered to 5 Seconds| D[Mitigates Port Scans & SYN Floods] ...

In small to medium networks (such as 10 to 30 active users doing simultaneous streaming, downloads, and competitive gaming), standard router queues frequently fail to manage latency. When a single user saturates the bandwidth, packets pile up in buffers inside the router, causing ping to spike dramatically—a destructive phenomenon known as bufferbloat . This article details how to implement and optimize the advanced CAKE (Common Applications Kept Enhanced) queue type in MikroTik RouterOS v7 to guarantee absolute latency control. Architecture Overview: CAKE Queue Flow & Memory Allocation graph TD A[Incoming Heavy Traffic] -->|Router Interface| B[CAKE Queue Engine] subgraph Tuning ["CAKE Precision Tuning"] B -->|Flow Mode: dual-dsthost / dual-srchost| C[Fair Bandwidth Distribution] B -->|Memory Limit: 4MB - 8MB| D[Optimized Dropping Without RAM Bloat] ...

Real-world infrastructure, networking, and virtualization solutions. When running a virtualization environment on Windows Server Hyper-V, encountering sudden hard reboots (Event ID 41 or 6008) without a preliminary Blue Screen of Death (BSOD) typically points to an underlying Network Driver Interface Specification (NDIS) deadlock between the Hyper-V Virtual Switch and the physical Network Interface Cards (NICs), rather than a direct hardware failure. This article explores how to execute targeted host hardening to eliminate these production-level faults and ensure absolute infrastructure stability. Architecture Overview: NDIS Deadlock vs Hardened Stack graph TD A[Heavy VM Traffic & Host Load] -->|Bypasses Offloads| B[Hyper-V Virtual Switch] B --> C[Physical NIC / Driver] subgraph Problem ["The Problem (NDIS Deadlock)"] C -->|Interrupt Storm & Conge...

In local area network (LAN) administration, maintaining strict adherence to proper IP addressing frameworks is critical for network stability and security. Misconfigurations—such as relying on APIPA or inadvertently hardcoding public IP blocks—frequently lead to routing conflicts, dropped packets, and severe segmentation failures. 1. The Pitfalls of APIPA (Automatic Private IP Addressing) APIPA ( 169.254.x.x ) is a fallback mechanism used by operating systems when a DHCP (Dynamic Host Configuration Protocol) server cannot be reached. The Mechanism: When a device fails to lease a valid IP address, it automatically self-assigns an address from the link-local block 169.254.0.0/16 . The Operational Impact: Because link-local addresses are non-routable outside the immediate local broadcast domain, devices stuck in an APIPA state cannot communicate across subnets, reach the gateway, or access internal services. Relying on "plug-and-play" behavi...

What happens when two DHCP servers start answering the same network? At first, it may look like a simple connectivity problem. A few computers cannot access a system. Some users can browse the Internet while others cannot. Someone reports that the server is down, while someone else suspects the firewall. But sometimes, the real problem is much simpler—and much easier to overlook. There may be more than one DHCP server answering the same clients. I recently encountered this situation in a real production environment. What started as a network configuration issue eventually affected access to a hospital's Electronic Medical Records (EMR) environment. That experience was a good reminder that some of the most disruptive network problems can come from small configuration inconsistencies. Are Two DHCP Servers Always a Problem? No. Multiple DHCP servers can be part of a perfectly valid network design. They may be used for: DHCP redundancy DHCP failover High availability Different VLA...

Collision Domain vs Broadcast Domain: VLANs, DHCP, and Real-World Network Troubleshooting What happens when a network has multiple DHCP servers, improperly configured VLANs, and access points that were never moved to the new VLAN? Networking concepts such as collision domains , broadcast domains , VLANs , and DHCP can sound intimidating when first encountered. In theory, they are relatively straightforward. In a real network, however, these concepts can become the difference between a network that works reliably and one that suddenly causes users to lose access to critical systems. This article explains these concepts in a practical and beginner-friendly way while still keeping the technical details useful for network administrators and IT professionals. I'll also share a recent real-world lesson involving two DHCP servers operating within the same network , as well as a VLAN implementation issue where existing access points were not properly included in the new VLAN design. What ...