Pinoy IT Share

Building a Zero-Cloud AIOps & Security Digest Engine Executive Summary Objective: Establish a 100% self-hosted, private SOC/NOC reporting system that aggregates network telemetry and threat logs without relying on external cloud infrastructure. Core Stack: Zabbix 7, n8n, Suricata IDS/IPS, MikroTik REST API, Ollama (Qwen), and SMTP. Key Impact: Reduced daily log review time from 30+ minutes down to a 1-minute email digest, eliminating third-party API costs while keeping internal IP architectures fully isolated. The Problem: Alert Fatigue vs. Data Sovereignty Log Telemetry Overload: Manually reviewing thousands of daily Suricata entries ( fast.log / eve.json ) alongside Zabbix metrics induces severe operator fatigue. Data Sovereignty & Privacy Constraints: Transmitting internal IP schemas, network topology, and vulnerability vectors to public cloud LLM APIs poses...

Default network gateway configurations are rarely optimized for security out of the box. In MikroTik RouterOS, the connection tracking engine defaults to keeping established TCP connections alive for up to 24 hours (`1d`). In active environments, this accumulates thousands of "ghost connections," burdening system memory and opening doors to resource exhaustion attacks. This article highlights how to harden your conntrack state table through strict timeout reduction and aggressive SYN flood mitigation. Architecture Overview: Conntrack State Table Hardening graph TD A[Incoming Network Packets] -->|State Inspection| B[MikroTik Conntrack Table] subgraph Hardening ["Timeout & Security Policy"] B -->|TCP Established: Lowered to 4 Hours| C[Purges Stale / Ghost Sessions] B -->|SYN Sent/Received: Lowered to 5 Seconds| D[Mitigates Port Scans & SYN Floods] ...

In small to medium networks (such as 10 to 30 active users doing simultaneous streaming, downloads, and competitive gaming), standard router queues frequently fail to manage latency. When a single user saturates the bandwidth, packets pile up in buffers inside the router, causing ping to spike dramatically—a destructive phenomenon known as bufferbloat . This article details how to implement and optimize the advanced CAKE (Common Applications Kept Enhanced) queue type in MikroTik RouterOS v7 to guarantee absolute latency control. Architecture Overview: CAKE Queue Flow & Memory Allocation graph TD A[Incoming Heavy Traffic] -->|Router Interface| B[CAKE Queue Engine] subgraph Tuning ["CAKE Precision Tuning"] B -->|Flow Mode: dual-dsthost / dual-srchost| C[Fair Bandwidth Distribution] B -->|Memory Limit: 4MB - 8MB| D[Optimized Dropping Without RAM Bloat] ...

Real-world infrastructure, networking, and virtualization solutions. When running a virtualization environment on Windows Server Hyper-V, encountering sudden hard reboots (Event ID 41 or 6008) without a preliminary Blue Screen of Death (BSOD) typically points to an underlying Network Driver Interface Specification (NDIS) deadlock between the Hyper-V Virtual Switch and the physical Network Interface Cards (NICs), rather than a direct hardware failure. This article explores how to execute targeted host hardening to eliminate these production-level faults and ensure absolute infrastructure stability. Architecture Overview: NDIS Deadlock vs Hardened Stack graph TD A[Heavy VM Traffic & Host Load] -->|Bypasses Offloads| B[Hyper-V Virtual Switch] B --> C[Physical NIC / Driver] subgraph Problem ["The Problem (NDIS Deadlock)"] C -->|Interrupt Storm & Conge...

In local area network (LAN) administration, maintaining strict adherence to proper IP addressing frameworks is critical for network stability and security. Misconfigurations—such as relying on APIPA or inadvertently hardcoding public IP blocks—frequently lead to routing conflicts, dropped packets, and severe segmentation failures. 1. The Pitfalls of APIPA (Automatic Private IP Addressing) APIPA ( 169.254.x.x ) is a fallback mechanism used by operating systems when a DHCP (Dynamic Host Configuration Protocol) server cannot be reached. The Mechanism: When a device fails to lease a valid IP address, it automatically self-assigns an address from the link-local block 169.254.0.0/16 . The Operational Impact: Because link-local addresses are non-routable outside the immediate local broadcast domain, devices stuck in an APIPA state cannot communicate across subnets, reach the gateway, or access internal services. Relying on "plug-and-play" behavi...

What happens when two DHCP servers start answering the same network? At first, it may look like a simple connectivity problem. A few computers cannot access a system. Some users can browse the Internet while others cannot. Someone reports that the server is down, while someone else suspects the firewall. But sometimes, the real problem is much simpler—and much easier to overlook. There may be more than one DHCP server answering the same clients. I recently encountered this situation in a real production environment. What started as a network configuration issue eventually affected access to a hospital's Electronic Medical Records (EMR) environment. That experience was a good reminder that some of the most disruptive network problems can come from small configuration inconsistencies. Are Two DHCP Servers Always a Problem? No. Multiple DHCP servers can be part of a perfectly valid network design. They may be used for: DHCP redundancy DHCP failover High availability Different VLA...