https://oncken.dev/articles/Field notes on enterprise networking: switching, Wi-Fi, segmentation, and the operations work that keeps a school district online.en-usThu, 29 Oct 2026 03:29:45 +0000https://oncken.dev/articles/unifi-firmware-and-rollback.htmlhttps://oncken.dev/articles/unifi-firmware-and-rollback.htmlSat, 31 Oct 2026 00:00:00 +0000UniFi PlaybooksAuto-update is a change window you gave to a vendor. How to stage firmware, read release notes, and get back to the previous version when a building starts rebooting.https://oncken.dev/articles/unifi-switching-ports-poe.htmlhttps://oncken.dev/articles/unifi-switching-ports-poe.htmlTue, 27 Oct 2026 00:00:00 +0000UniFi PlaybooksPort profiles, trunk tagging, PoE modes, and the two physical problems that produce most "the network is slow" tickets.https://oncken.dev/articles/unifi-wifi-and-ppsk.htmlhttps://oncken.dev/articles/unifi-wifi-and-ppsk.htmlSat, 24 Oct 2026 00:00:00 +0000UniFi PlaybooksFour SSIDs, 26 WLAN records, and one private-PSK map that decides which VLAN a printer lands on. How the wireless side is actually structured in a multi-building UniFi deployment.https://oncken.dev/articles/unifi-firewall-zones-policies.htmlhttps://oncken.dev/articles/unifi-firewall-zones-policies.htmlTue, 20 Oct 2026 00:00:00 +0000UniFi PlaybooksNetwork 9 replaced interface rules with zones and a single ordered policy table. Where the real table lives, how to read it, and the two settings that decide whether your policy matters.https://oncken.dev/articles/unifi-networks-vlans-dhcp.htmlhttps://oncken.dev/articles/unifi-networks-vlans-dhcp.htmlSat, 17 Oct 2026 00:00:00 +0000UniFi PlaybooksIn UniFi a "network" is three things at once: a VLAN, a subnet, and a DHCP scope. Understanding which one you are editing prevents most of the surprises.https://oncken.dev/articles/unifi-controller-and-backups.htmlhttps://oncken.dev/articles/unifi-controller-and-backups.htmlTue, 13 Oct 2026 00:00:00 +0000UniFi PlaybooksThe controller is the configuration and the configuration is the network. Where the backup lives, what it does not contain, and how to restore without a second outage.https://oncken.dev/articles/gitops-for-networks.htmlhttps://oncken.dev/articles/gitops-for-networks.htmlSat, 10 Oct 2026 00:00:00 +0000Network ProgrammabilityThe repository is the source of truth, a merge is a deployment, and a revert is a rollback. What that requires, and where it breaks in a district.https://oncken.dev/articles/validating-configuration.htmlhttps://oncken.dev/articles/validating-configuration.htmlTue, 06 Oct 2026 00:00:00 +0000Network ProgrammabilityAutomation turns a typo into a hundred-device outage. Five layers of validation, from syntax to behavior, are what make it safe to run unattended.https://oncken.dev/articles/python-libraries.htmlhttps://oncken.dev/articles/python-libraries.htmlFri, 02 Oct 2026 00:00:00 +0000Network ProgrammabilityFive libraries cover almost every network automation task. Which one to reach for, and the two lines of code that save you from a week of parsing.https://oncken.dev/articles/ansible-for-networks.htmlhttps://oncken.dev/articles/ansible-for-networks.htmlTue, 29 Sep 2026 00:00:00 +0000Network ProgrammabilityThe tool most teams reach for first, and the one most likely to become a pile of CLI commands in YAML. How to keep it idempotent, reviewable, and safe.https://oncken.dev/articles/netconf-restconf-yang.htmlhttps://oncken.dev/articles/netconf-restconf-yang.htmlFri, 25 Sep 2026 00:00:00 +0000Network ProgrammabilityTwo protocols, one data model, and a datastore that can be validated before it is committed. What each transport is for, and the operations that matter.https://oncken.dev/articles/models-before-protocols.htmlhttps://oncken.dev/articles/models-before-protocols.htmlTue, 22 Sep 2026 00:00:00 +0000Network ProgrammabilityA CLI is a user interface, not an API. Before you automate anything, you need a schema that says what a valid configuration looks like.https://oncken.dev/articles/wireless-qos-wmm.htmlhttps://oncken.dev/articles/wireless-qos-wmm.htmlFri, 18 Sep 2026 00:00:00 +0000QoS and Real-Time TrafficOn Wi-Fi, QoS buys you contention advantage, not bandwidth. Four access categories, one shared medium, and a hard limit on how many calls an AP can carry.https://oncken.dev/articles/qos-video.htmlhttps://oncken.dev/articles/qos-video.htmlTue, 15 Sep 2026 00:00:00 +0000QoS and Real-Time TrafficVideo is bursty, adaptive, and unforgiving in different ways than voice. Screen sharing adds I-frame spikes that break naive bandwidth plans.https://oncken.dev/articles/qos-voice.htmlhttps://oncken.dev/articles/qos-voice.htmlFri, 11 Sep 2026 00:00:00 +0000QoS and Real-Time TrafficA voice call is 87 kbps that must arrive on time. Bandwidth is never the problem; delay, jitter, and one-way audio are.https://oncken.dev/articles/queuing-and-shaping.htmlhttps://oncken.dev/articles/queuing-and-shaping.htmlTue, 08 Sep 2026 00:00:00 +0000QoS and Real-Time TrafficA queue is a waiting room with a doorman. Shaping builds the room, scheduling decides who enters first, and the depth decides how long anyone waits.https://oncken.dev/articles/classification-and-marking.htmlhttps://oncken.dev/articles/classification-and-marking.htmlFri, 04 Sep 2026 00:00:00 +0000QoS and Real-Time TrafficA packet carries a label that says how important it thinks it is. QoS works only if you control who is allowed to write that label.https://oncken.dev/articles/why-qos-exists.htmlhttps://oncken.dev/articles/why-qos-exists.htmlMon, 31 Aug 2026 00:00:00 +0000QoS and Real-Time TrafficNetworks are shared, and sharing is unfair by default. QoS is the set of decisions about who waits when the link is full — and most links are not full.https://oncken.dev/articles/racks-labeling-standards.htmlhttps://oncken.dev/articles/racks-labeling-standards.htmlFri, 28 Aug 2026 00:00:00 +0000Physical Layer and CablingA closet is a maintenance interface. Airflow, power, labeling, and documentation decide whether the next person can fix something in ten minutes or two hours.https://oncken.dev/articles/cabling-for-poe.htmlhttps://oncken.dev/articles/cabling-for-poe.htmlMon, 24 Aug 2026 00:00:00 +0000Physical Layer and CablingPower over Ethernet turns cable into a power circuit. Bundles get hot, voltage drops over distance, and a cable rated for data may not be rated for the current.https://oncken.dev/articles/testing-and-certification.htmlhttps://oncken.dev/articles/testing-and-certification.htmlFri, 21 Aug 2026 00:00:00 +0000Physical Layer and CablingA cable that links is not a cable that passes. What the tester measures, which results matter, and why the report is the deliverable.https://oncken.dev/articles/fiber-types-connectors.htmlhttps://oncken.dev/articles/fiber-types-connectors.htmlMon, 17 Aug 2026 00:00:00 +0000Physical Layer and CablingMultimode for buildings, single-mode for distance, and a connector that must match the polish and the polarity. The four mismatches that produce a link that will not come up.https://oncken.dev/articles/copper-standards.htmlhttps://oncken.dev/articles/copper-standards.htmlFri, 14 Aug 2026 00:00:00 +0000Physical Layer and CablingCat5e, Cat6, Cat6A, and the distance that decides whether 10 Gbps works. What the categories actually guarantee, and where installed cable falls short of the label.https://oncken.dev/articles/dashboards.htmlhttps://oncken.dev/articles/dashboards.htmlMon, 10 Aug 2026 00:00:00 +0000Monitoring and ObservabilityEvery dashboard should answer one question for one audience. Most answer none, for everyone, with forty panels and a refresh rate nobody needs.https://oncken.dev/articles/alert-design.htmlhttps://oncken.dev/articles/alert-design.htmlThu, 06 Aug 2026 00:00:00 +0000Monitoring and ObservabilityAn alert is a promise that someone should stop what they are doing. Most monitoring systems break that promise hundreds of times a week, and then nobody answers.https://oncken.dev/articles/metrics-logs-traces.htmlhttps://oncken.dev/articles/metrics-logs-traces.htmlMon, 03 Aug 2026 00:00:00 +0000Monitoring and ObservabilityThe three pillars were named for applications, not networks. What transfers, what does not, and the one statistical habit that fixes most bad dashboards.https://oncken.dev/articles/logs-and-flows.htmlhttps://oncken.dev/articles/logs-and-flows.htmlThu, 30 Jul 2026 00:00:00 +0000Monitoring and ObservabilityMetrics say how much, logs say what happened, flows say who. The three answer different questions, and a district needs all three to close a ticket.https://oncken.dev/articles/snmp-still.htmlhttps://oncken.dev/articles/snmp-still.htmlMon, 27 Jul 2026 00:00:00 +0000Monitoring and ObservabilityThe protocol is thirty years old and still the only common way to read a switch. What to poll, which counters lie, and how to secure it without breaking it.https://oncken.dev/articles/what-to-measure.htmlhttps://oncken.dev/articles/what-to-measure.htmlThu, 23 Jul 2026 00:00:00 +0000Monitoring and ObservabilityMost dashboards measure what is easy, not what matters. Six signals, one baseline, and the difference between a device being up and a user being able to work.https://oncken.dev/articles/qos-at-the-edge.htmlhttps://oncken.dev/articles/qos-at-the-edge.htmlMon, 20 Jul 2026 00:00:00 +0000WAN, SD-WAN, and the Internet EdgeQoS inside a 10 Gbps campus does nothing. The only queue that matters is the one in front of the circuit you are paying for — and shaping is what creates it.https://oncken.dev/articles/nat-cgnat-at-the-edge.htmlhttps://oncken.dev/articles/nat-cgnat-at-the-edge.htmlThu, 16 Jul 2026 00:00:00 +0000WAN, SD-WAN, and the Internet EdgeYour ISP can put you behind a translator you do not control. What changes when the public address is shared, and why port forwarding quietly stops working.https://oncken.dev/articles/what-sdwan-solves.htmlhttps://oncken.dev/articles/what-sdwan-solves.htmlSun, 12 Jul 2026 00:00:00 +0000WAN, SD-WAN, and the Internet EdgeSD-WAN is policy per application over mixed links, with central management. It is not more bandwidth, not diversity, and not a substitute for understanding routing.https://oncken.dev/articles/bgp-at-the-edge.htmlhttps://oncken.dev/articles/bgp-at-the-edge.htmlThu, 09 Jul 2026 00:00:00 +0000WAN, SD-WAN, and the Internet EdgeYou do not need to run an ISP to need BGP. Two providers, one address block, and a failover that actually works — plus the four filters that keep you from becoming a transit network.https://oncken.dev/articles/circuits-diversity-failover.htmlhttps://oncken.dev/articles/circuits-diversity-failover.htmlSun, 05 Jul 2026 00:00:00 +0000WAN, SD-WAN, and the Internet EdgeTwo circuits are not redundancy if they share a conduit, a provider, or a power feed. What diversity actually means, and how to test a failover before you need it.https://oncken.dev/articles/when-zero-trust-replaces-vpn.htmlhttps://oncken.dev/articles/when-zero-trust-replaces-vpn.htmlThu, 02 Jul 2026 00:00:00 +0000VPNs and Remote AccessA VPN says "you are inside." Zero trust says "you are you, on that device, for this app." The second is harder and narrower, and it is where remote access is going.https://oncken.dev/articles/split-tunneling.htmlhttps://oncken.dev/articles/split-tunneling.htmlSun, 28 Jun 2026 00:00:00 +0000VPNs and Remote AccessSend everything through the tunnel or only what needs it. Both are defensible; doing neither deliberately produces the leaks, the slowness, and the one-way traffic.https://oncken.dev/articles/tls-vpns.htmlhttps://oncken.dev/articles/tls-vpns.htmlThu, 25 Jun 2026 00:00:00 +0000VPNs and Remote AccessWhen the tunnel has to look like HTTPS to get out of a network, TLS-based VPNs win. Certificates, user auth, and the 443 advantage.https://oncken.dev/articles/wireguard-in-practice.htmlhttps://oncken.dev/articles/wireguard-in-practice.htmlSun, 21 Jun 2026 00:00:00 +0000VPNs and Remote AccessA few hundred lines of kernel code, two keys per peer, and one list that decides both routing and cryptography. Simple enough to audit, sharp enough to cut you.https://oncken.dev/articles/ipsec-without-acronyms.htmlhttps://oncken.dev/articles/ipsec-without-acronyms.htmlThu, 18 Jun 2026 00:00:00 +0000VPNs and Remote AccessTwo phases, one child SA, and a traffic selector that decides what actually crosses. The five settings that must match, and what a failed negotiation looks like.https://oncken.dev/articles/what-a-vpn-buys.htmlhttps://oncken.dev/articles/what-a-vpn-buys.htmlSun, 14 Jun 2026 00:00:00 +0000VPNs and Remote AccessA VPN protects data in transit and authenticates the endpoints. It does not make a laptop trustworthy, and it is not anonymity software.https://oncken.dev/articles/auditing-a-rulebase.htmlhttps://oncken.dev/articles/auditing-a-rulebase.htmlWed, 10 Jun 2026 00:00:00 +0000Firewalls and Policy EngineeringHit counters turn a rulebase from a document into evidence. A repeatable audit finds the rules that do nothing, the rules that do everything, and the zones that were never segmented.https://oncken.dev/articles/writing-policy-you-can-defend.htmlhttps://oncken.dev/articles/writing-policy-you-can-defend.htmlSun, 07 Jun 2026 00:00:00 +0000Firewalls and Policy EngineeringA rulebase is a record of decisions. Naming, ordering, testing, and documenting each rule so that a year from now the answer to "why is this open?" is written down.https://oncken.dev/articles/nat-without-the-mystique.htmlhttps://oncken.dev/articles/nat-without-the-mystique.htmlWed, 03 Jun 2026 00:00:00 +0000Firewalls and Policy EngineeringSource NAT, destination NAT, and the hairpin case that breaks internal access to a public name. What translation hides, and the protocols that refuse to be translated.https://oncken.dev/articles/state-tables-and-conntrack.htmlhttps://oncken.dev/articles/state-tables-and-conntrack.htmlSun, 31 May 2026 00:00:00 +0000Firewalls and Policy EngineeringA stateful firewall remembers every flow so the reply does not need a rule. That memory is finite, ages out, and breaks the moment the return path changes.https://oncken.dev/articles/zones-rules-order.htmlhttps://oncken.dev/articles/zones-rules-order.htmlWed, 27 May 2026 00:00:00 +0000Firewalls and Policy EngineeringA firewall evaluates top to bottom and stops at the first match. Understanding that one sentence explains why a correct rule can do nothing at all.https://oncken.dev/articles/core-services-failure-modes.htmlhttps://oncken.dev/articles/core-services-failure-modes.htmlSun, 24 May 2026 00:00:00 +0000DNS, DHCP, and Core ServicesA symptom-to-cause table for the three services everything depends on, written for the ten minutes before you have a theory.https://oncken.dev/articles/high-availability-core-services.htmlhttps://oncken.dev/articles/high-availability-core-services.htmlWed, 20 May 2026 00:00:00 +0000DNS, DHCP, and Core ServicesTwo servers is not high availability. Matching configuration, tested failover, and a monitor that proves the service works are what make the second one count.https://oncken.dev/articles/ipam-and-naming.htmlhttps://oncken.dev/articles/ipam-and-naming.htmlSat, 16 May 2026 00:00:00 +0000DNS, DHCP, and Core ServicesAn address plan is a promise you make to your future self. Scheme, naming, and the small amount of tooling that keeps 113 networks from turning into folklore.https://oncken.dev/articles/dhcp-in-depth.htmlhttps://oncken.dev/articles/dhcp-in-depth.htmlWed, 13 May 2026 00:00:00 +0000DNS, DHCP, and Core ServicesBeyond DORA: options that decide whether a device works, relays that let one server serve forty VLANs, and the lease mechanics behind a pool that fails at 09:00.https://oncken.dev/articles/dns-zones-records-delegation.htmlhttps://oncken.dev/articles/dns-zones-records-delegation.htmlSat, 09 May 2026 00:00:00 +0000DNS, DHCP, and Core ServicesA zone is a file with an owner, a serial number, and a promise. Record types, apex rules, and the split between what the district sees and what the internet sees.https://oncken.dev/articles/dns-resolution-step-by-step.htmlhttps://oncken.dev/articles/dns-resolution-step-by-step.htmlWed, 06 May 2026 00:00:00 +0000DNS, DHCP, and Core ServicesFour servers, two protocols, and a cache that decides how fast the fifth lookup is. What actually happens between typing a name and getting an address.https://oncken.dev/articles/five-capture-patterns.htmlhttps://oncken.dev/articles/five-capture-patterns.htmlSat, 02 May 2026 00:00:00 +0000Packet AnalysisRetransmission, zero window, reset, one-way traffic, and name resolution delay. Five fingerprints that cover the overwhelming majority of "the network is broken" tickets.https://oncken.dev/articles/tls-and-quic-in-a-capture.htmlhttps://oncken.dev/articles/tls-and-quic-in-a-capture.htmlWed, 29 Apr 2026 00:00:00 +0000Packet AnalysisYou cannot read the URL, but you can read the handshake. What TLS 1.2, TLS 1.3, and QUIC expose, what they hide, and how to use the difference.https://oncken.dev/articles/dns-and-dhcp-in-a-capture.htmlhttps://oncken.dev/articles/dns-and-dhcp-in-a-capture.htmlSat, 25 Apr 2026 00:00:00 +0000Packet AnalysisTwo protocols, both plaintext, both decisive. What the query and the lease exchange look like on the wire, and how to read failure from the flags.https://oncken.dev/articles/tcp-handshake-failures.htmlhttps://oncken.dev/articles/tcp-handshake-failures.htmlWed, 22 Apr 2026 00:00:00 +0000Packet AnalysisThree packets establish a connection. Where the sequence stops tells you which device is at fault, and the timers tell you how long it has been failing.https://oncken.dev/articles/capturing-at-the-right-point.htmlhttps://oncken.dev/articles/capturing-at-the-right-point.htmlSat, 18 Apr 2026 00:00:00 +0000Packet AnalysisA capture taken in the wrong place answers a different question. Where to tap, what each point hides, and how to avoid the three mistakes that make a capture useless.https://oncken.dev/articles/when-routes-break.htmlhttps://oncken.dev/articles/when-routes-break.htmlTue, 14 Apr 2026 00:00:00 +0000Static Routing and the Multi-Site NetworkFive failures account for almost every static routing problem. A method that checks forward path, return path, and MTU in that order finds them in minutes.https://oncken.dev/articles/routing-between-sites.htmlhttps://oncken.dev/articles/routing-between-sites.htmlSat, 11 Apr 2026 00:00:00 +0000Static Routing and the Multi-Site NetworkA second campus needs a link you can defend. Fiber, wireless, or IPsec over the internet, and the static routes and policy that make either one behave.https://oncken.dev/articles/designing-a-second-campus.htmlhttps://oncken.dev/articles/designing-a-second-campus.htmlTue, 07 Apr 2026 00:00:00 +0000Static Routing and the Multi-Site NetworkThe first off-site campus is a routing design problem disguised as a construction schedule. Address block, link, services, and cutover order, decided before the first cable is pulled.https://oncken.dev/articles/static-routes-right-tool-common-trap.htmlhttps://oncken.dev/articles/static-routes-right-tool-common-trap.htmlSat, 04 Apr 2026 00:00:00 +0000Static Routing and the Multi-Site NetworkStatic routes are the correct answer for a two-site network with one link. They become a trap the moment the topology has more paths than you can remember.https://oncken.dev/articles/the-routing-table-line-by-line.htmlhttps://oncken.dev/articles/the-routing-table-line-by-line.htmlTue, 31 Mar 2026 00:00:00 +0000Static Routing and the Multi-Site NetworkConnected, static, and dynamic routes all live in one table. Reading it correctly is the difference between guessing and knowing why a packet went that way.https://oncken.dev/articles/multicast-igmp-snooping.htmlhttps://oncken.dev/articles/multicast-igmp-snooping.htmlSat, 28 Mar 2026 00:00:00 +0000Operations and AutomationWhy one unconfigured video wall can saturate a campus uplink, and how a querier, an mrouter port, and multicast-to-unicast conversion fix it.https://oncken.dev/articles/change-windows-blast-radius.htmlhttps://oncken.dev/articles/change-windows-blast-radius.htmlTue, 24 Mar 2026 00:00:00 +0000Operations and AutomationEvery change has a blast radius. Estimating it before the window is what separates a maintenance task from an outage with a ticket number.https://oncken.dev/articles/read-only-api-auditing.htmlhttps://oncken.dev/articles/read-only-api-auditing.htmlFri, 20 Mar 2026 00:00:00 +0000Operations and AutomationA read-only account, a snapshot, and a diff. How to verify what the network actually does instead of what the dashboard claims, without ever writing a change.https://oncken.dev/articles/documentation-that-survives.htmlhttps://oncken.dev/articles/documentation-that-survives.htmlTue, 17 Mar 2026 00:00:00 +0000Operations and AutomationMost documentation is written for the person who already knows. The test is whether someone else can use it at 02:00, with no context and no way to ask you.https://oncken.dev/articles/dns-as-a-security-control.htmlhttps://oncken.dev/articles/dns-as-a-security-control.htmlFri, 13 Mar 2026 00:00:00 +0000Segmentation and SecurityContent filtering is DNS policy wearing a different hat. If a client can choose its own resolver, the filter is optional — and most networks leave that door open.https://oncken.dev/articles/ssl-tls-inspection.htmlhttps://oncken.dev/articles/ssl-tls-inspection.htmlTue, 10 Mar 2026 00:00:00 +0000Segmentation and SecurityWhat a break-and-inspect proxy actually does to a TLS 1.3 handshake, what it costs in silicon, and when the answer is simply no.https://oncken.dev/articles/8021x-dynamic-vlans.htmlhttps://oncken.dev/articles/8021x-dynamic-vlans.htmlFri, 06 Mar 2026 00:00:00 +0000Segmentation and SecurityPort-based access control end to end: the EAP-TLS handshake, the three RADIUS attributes that decide your VLAN, and what MAB costs you.https://oncken.dev/articles/object-based-networking.htmlhttps://oncken.dev/articles/object-based-networking.htmlTue, 03 Mar 2026 00:00:00 +0000Segmentation and SecurityWhy a 400-line rule table collapses under its own weight, and how object-oriented policy turns O(n) matching into O(1) group membership.https://oncken.dev/articles/migrating-to-segmentation.htmlhttps://oncken.dev/articles/migrating-to-segmentation.htmlFri, 27 Feb 2026 00:00:00 +0000Segmentation and SecurityMoving 98 networks out of one zone without an outage. The order, the dependency inventory, and the make-before-break rule that keeps a school day intact.https://oncken.dev/articles/trust-boundaries.htmlhttps://oncken.dev/articles/trust-boundaries.htmlMon, 23 Feb 2026 00:00:00 +0000Segmentation and SecurityA VLAN separates broadcasts. A firewall enforces policy. Confusing the two is how districts end up with 113 networks and one trust boundary.https://oncken.dev/articles/roaming-in-practice.htmlhttps://oncken.dev/articles/roaming-in-practice.htmlFri, 20 Feb 2026 00:00:00 +0000Enterprise Wi-FiThe client decides when to roam. The infrastructure can only make the decision easier — and misconfiguring the helpers is worse than leaving them off.https://oncken.dev/articles/rf-tuning-wifi-7.htmlhttps://oncken.dev/articles/rf-tuning-wifi-7.htmlMon, 16 Feb 2026 00:00:00 +0000Enterprise Wi-FiMulti-link operation changes the roaming model, 320 MHz channels change the planning model. What to configure now and what to leave alone.https://oncken.dev/articles/rf-tuning-wifi-6.htmlhttps://oncken.dev/articles/rf-tuning-wifi-6.htmlFri, 13 Feb 2026 00:00:00 +0000Enterprise Wi-FiOFDMA resource units, BSS coloring, and a channel plan you can defend. Why automated tuning creates the pileups it claims to fix.https://oncken.dev/articles/reading-a-site-survey.htmlhttps://oncken.dev/articles/reading-a-site-survey.htmlMon, 09 Feb 2026 00:00:00 +0000Enterprise Wi-FiA heatmap is a claim about signal, not a promise about performance. What to measure, which numbers matter, and why surveying an empty building lies to you.https://oncken.dev/articles/wifi-airtime-not-bandwidth.htmlhttps://oncken.dev/articles/wifi-airtime-not-bandwidth.htmlFri, 06 Feb 2026 00:00:00 +0000Enterprise Wi-FiWi-Fi is a shared medium with a queue, not a pipe with a rate. One slow client can consume more airtime than twenty fast ones, and no amount of bandwidth fixes it.https://oncken.dev/articles/wifi-basics-bands-channels.htmlhttps://oncken.dev/articles/wifi-basics-bands-channels.htmlMon, 02 Feb 2026 00:00:00 +0000Enterprise Wi-FiThree bands, a handful of non-overlapping channels, and one decision that ruins most networks: leaving channel width at the default.https://oncken.dev/articles/poe-budgets.htmlhttps://oncken.dev/articles/poe-budgets.htmlFri, 30 Jan 2026 00:00:00 +0000Switching and the Campus LANPower over Ethernet is a budget, not a feature. How classes are negotiated, why an access point reboots every forty minutes, and how to size a switch before you buy it.https://oncken.dev/articles/link-aggregation.htmlhttps://oncken.dev/articles/link-aggregation.htmlMon, 26 Jan 2026 00:00:00 +0000Switching and the Campus LANBundling links buys bandwidth and removes a single point of failure — but only if both ends agree, and only for flows, not for packets.https://oncken.dev/articles/spanning-tree-without-fear.htmlhttps://oncken.dev/articles/spanning-tree-without-fear.htmlThu, 22 Jan 2026 00:00:00 +0000Switching and the Campus LANRedundant cabling without redundant broadcast storms. How the root bridge is elected, why one port blocks, and how to make the topology deterministic instead of accidental.https://oncken.dev/articles/how-a-switch-learns.htmlhttps://oncken.dev/articles/how-a-switch-learns.htmlMon, 19 Jan 2026 00:00:00 +0000Switching and the Campus LANA switch has no map of your network when it boots. It builds one from source addresses, and every strange layer 2 behavior follows from that.https://oncken.dev/articles/dhcp-and-dns.htmlhttps://oncken.dev/articles/dhcp-and-dns.htmlThu, 15 Jan 2026 00:00:00 +0000Networking from First PrinciplesOne hands out addresses, the other resolves names. When either fails, everything looks broken in a different way — and both fail in ways you can predict.https://oncken.dev/articles/routing-and-the-default-gateway.htmlhttps://oncken.dev/articles/routing-and-the-default-gateway.htmlMon, 12 Jan 2026 00:00:00 +0000Networking from First PrinciplesWhy a host sends some packets directly and hands the rest to a router, and how longest-prefix matching decides the path one hop at a time.https://oncken.dev/articles/vlans-one-switch-many-networks.htmlhttps://oncken.dev/articles/vlans-one-switch-many-networks.htmlThu, 08 Jan 2026 00:00:00 +0000Networking from First PrinciplesHow a single 48-port switch keeps students, staff, and cameras in separate broadcast domains, and why that separation is convenience rather than security.https://oncken.dev/articles/ip-addresses-and-subnets.htmlhttps://oncken.dev/articles/ip-addresses-and-subnets.htmlMon, 05 Jan 2026 00:00:00 +0000Networking from First PrinciplesSubnetting is arithmetic, not trivia. Learn the four numbers every address carries and you can size a network without a calculator.https://oncken.dev/articles/what-happens-when-you-open-a-web-page.htmlhttps://oncken.dev/articles/what-happens-when-you-open-a-web-page.htmlThu, 01 Jan 2026 00:00:00 +0000Networking from First PrinciplesOne keystroke, four protocols, and about 200 milliseconds. A walk through the exact sequence a browser performs before it can render a single pixel.