0.11 bnog-2026 2026-09-23 2026-09-24 2 00:05 https://pretalx.balticnog.org https://pretalx.balticnog.org/media/bnog-2026/img/BalticNOG_2026_-_Logo_w_Year_YNfJwKO.png Europe/Riga ROOM ALFA Talk 2026-09-23T10:00:00+03:00 10:00 00:15 Opening remarks for BalticNOG 2026 in Riga. A short welcome covering this year's program, the four featured speakers, and the two hosts, followed by a look at who's in the room. Then two ways to take part over the next two days: the community wall and the social run. The talk closes on the people who made it happen and on how to join them. bnog-2026-41-opening-speech Vincentas Grinius en false https://pretalx.balticnog.org/bnog-2026/talk/3UGERE/ https://pretalx.balticnog.org/bnog-2026/talk/3UGERE/feedback/ ROOM ALFA Keynote 2026-09-23T10:15:00+03:00 10:15 00:55 The extreme bandwidth demands of AI data centers are accelerating the development of new optics that are denser, more reliable, and more power efficient than the previous optics roadmap. This talk will cover the AI optics roadmaps across the scale-up, scale-out and scale-across spectrum, and the implications for next generation switches, routers and optical line systems. bnog-2026-38-next-generation-optics-for-scale-up-scale-out-and-scale-across Andreas Bechtolsheim en false https://pretalx.balticnog.org/bnog-2026/talk/VE9TUR/ https://pretalx.balticnog.org/bnog-2026/talk/VE9TUR/feedback/ ROOM ALFA Keynote 2026-09-23T11:45:00+03:00 11:45 00:55 Project Jake is a fresh approach to collection and disclosure of registration data. It provides support for a wide variety of policies, distributed operation, and modern authentication and authorization processes. It uses RDAP and RFC 9560 protocols with substantial extensions. bnog-2026-29-project-jake Steve Crocker en false https://pretalx.balticnog.org/bnog-2026/talk/L73BSR/ https://pretalx.balticnog.org/bnog-2026/talk/L73BSR/feedback/ ROOM ALFA Talk 2026-09-23T14:00:00+03:00 14:00 00:25 Design-driven automation treats the design of a network — its topology, roles, relationships, and constraints — as an explicit model that exists independently of any device's running configuration. That model becomes the thing you reason about: the source of intent that configuration, validation, and change all refer back to. This talk looks at what that means once you're operating a real network, not sketching one. We'll walk through the lifecycle: expressing intent as a design, turning it into configuration, and (the hard part) keeping the two in agreement as the network drifts, as tickets land, and as people make changes out-of-band. We'll dig into how drift is detected and interpreted, why reconciliation is harder than pushing config, and how a design model changes the way operators handle refactoring and unplanned change. The same property that makes this work for humans, an explicit statement of intent to check reality against, is also what keeps the next wave of automation honest, whether that's a script or something smarter. We'll touch on that, but the focus stays on the mechanics operators live with today. Throughout, we'll ground the concepts in real declarative provisioning systems, including open-source NetBox, using them as concrete examples of the patterns and trade-offs: where design-driven approaches pay off, and where they still struggle in production. You'll leave with a clear mental model of design-driven automation, a realistic view of the reconciliation problem, and a sharper sense of where these approaches earn their place in day-to-day operations. bnog-2026-19-keeping-the-network-honest-design-models-drift-and-reconciliation Mark Robert Coleman en Intended for network engineers and operators, not just automation specialists. No prior familiarity with any specific tooling is assumed. Examples are drawn from open-source NetBox, but the talk is about the pattern: modelling intent, detecting drift, and reconciling the two, rather than any one product. The final section is a practical framing of how AI-assisted change can be introduced safely on top of a design model. false https://pretalx.balticnog.org/bnog-2026/talk/P9DYEB/ https://pretalx.balticnog.org/bnog-2026/talk/P9DYEB/feedback/ ROOM ALFA Panel 2026-09-23T14:30:00+03:00 14:30 00:55 AI is already changing how networks are operated, how traffic is generated and where infrastructure is built. But for network operators, the real question is not whether AI matters. It is where the value will move. This panel looks at AI from three angles: as an operational tool, as a new driver of traffic and infrastructure, and as a potential threat to the traditional role of the operator. bnog-2026-20-ai-and-operators-tool-traffic-or-threat Alfredo GiordanoAndrian VisnevschiZachary SmithAlissa Sõtsjova en AI is entering the operator industry from several directions at once. It can assist engineers, troubleshoot networks and increasingly take operational actions. At the same time, AI workloads are reshaping compute, interconnection and traffic demand. Beyond the technical impact lies a larger question: does AI strengthen the position of network operators, or make connectivity an even more invisible commodity? The discussion brings together three different perspectives: Andrian Visnevschi on AI and network operations, Alissa Sõtsjova of Tele2 Eesti on connectivity and interconnection, and Zac Smith on infrastructure built for an increasingly AI-driven Internet. false https://pretalx.balticnog.org/bnog-2026/talk/AW7ZSZ/ https://pretalx.balticnog.org/bnog-2026/talk/AW7ZSZ/feedback/ ROOM ALFA Talk 2026-09-23T16:00:00+03:00 16:00 00:25 This presentation describes the journey of achieving more than 1 Tbps throughput on a single x86 server by evolving a virtualized Broadband Network Gateway (vBNG). It walks through practical lessons learned while scaling from early multi-VM designs to a high-performance, single virtual machine capable of high packet rates. The talk covers the role of SR-IOV and Intel DPDK, extensive hardware tuning, deep code-level optimizations, and major redesigns driven by CPU cache behavior and PCIe bottlenecks. Real-world performance results highlight how systematic optimization, modern hardware, and iterative engineering can unlock massive throughput gains on commodity servers. bnog-2026-22-getting-1-tbps-from-an-x86-server Branimir Rajtar en false https://pretalx.balticnog.org/bnog-2026/talk/ENWYQA/ https://pretalx.balticnog.org/bnog-2026/talk/ENWYQA/feedback/ ROOM ALFA Talk 2026-09-23T16:30:00+03:00 16:30 00:25 Today's networks are highly virtualized large distributed systems. With network observability we monitor holistically by incorporating all 3 network planes and their dependencies. For AIOps we require network data done right. Data taxonomy, schema and semantics being preserved and ready in real-time at the Data Mesh. In this session I describe the relevance and differences between IPFIX, BMP and YANG-Push and its integration into Message Brokers for next generation Network Analytics applications and the differences between Data Lake and Data Mesh. I demonstrate with a real-life Network Incident Postmortem how Network Anomaly Detection is applied at Swisscom and show how symptom ontology is derived, where Knowledge Graphs will help us to obtain a statistical view, and why we intend to automate the incident and problem process by leveraging AI capabilities. Further, I will venture into the importance of network vendor, operator and academia collaboration in innovation and standards, and outline current innovation activities at the IETF NMOP working group. bnog-2026-18-how-ietf-and-swisscom-transforms-network-operation-in-the-age-of-ai Thomas Graf en Thomas Graf, Distinguished Network Engineer and Network Analytics Architect at Swisscom. Stuck with service providers since 1997. Rediscovered networks in 2015 with Network Analytics. The backseat driver of the Swisscom Daisy team with network, software and data engineering enthusiasts recently expressed themselves to feel like belonging to a startup. Authoring next generation data collection protocols in NMOP, GROW, OPSAWG and NETCONF working groups at IETF. Chairing IPPM (IP Performance measurement) working group and IP Performance Directorate at IETF. https://datatracker.ietf.org/person/thomas.graf@swisscom.com https://www.linkedin.com/in/networkanalytics-thomasgraf/ false https://pretalx.balticnog.org/bnog-2026/talk/MQNBVF/ https://pretalx.balticnog.org/bnog-2026/talk/MQNBVF/feedback/ ROOM ALFA Talk 2026-09-23T17:00:00+03:00 17:00 00:25 Route-server looking glasses already provide valuable visibility into routing at Internet Exchange Points (IXPs). They typically collect data either by querying route-server software directly, as Alice Looking Glass does, or through dedicated BGP monitoring sessions. These tools help operators and participants inspect advertised prefixes, troubleshoot connectivity, and better understand route-server behavior. In this presentation, we explore BMP as a complementary approach to monitoring BGP at IXPs. BMP can expose routes before and after policy application, including routes that are filtered or not selected as best paths, while also reporting peer and session state. BIRD and FRRouting can export BMP data when operating as route servers, although their current implementations have limitations and do not expose every standardized BMP view. We then present the new bgproutes.io IXP Explorer. By combining BMP data from route servers with routing data contributed by IXP participants, it provides near-real-time and historical visibility into routes learned over both route-server and bilateral BGP sessions. The platform enriches these data with RPKI route-origin validation (ROV) and ASPA validation results. The data are openly accessible through the IXP Explorer dashboard and the bgproutes.io public API, enabling both interactive exploration and programmatic analysis. bnog-2026-36-expanding-routing-visibility-at-ixps-with-bmp Thomas Holterbach en false https://pretalx.balticnog.org/bnog-2026/talk/X7ZZUS/ https://pretalx.balticnog.org/bnog-2026/talk/X7ZZUS/feedback/ ROOM BETA Talk 2026-09-23T14:00:00+03:00 14:00 00:25 Overdependence on AI: What could go wrong? bnog-2026-33-overdependence-on-ai-what-could-go-wrong Kirils Solovjovs en Overdependence on AI: What could go wrong? false https://pretalx.balticnog.org/bnog-2026/talk/ETQ7T7/ https://pretalx.balticnog.org/bnog-2026/talk/ETQ7T7/feedback/ ROOM BETA Talk 2026-09-23T16:00:00+03:00 16:00 00:25 Every connection, routing decision, and network boundary relies on a finite set of identifiers: IPv4, IPv6, and ASNs. But how did a research experiment’s addressing scheme scale to support billions of global users? This presentation will show the remarkable journey of Internet Number Resources from the early, informal days over the creation of the Regional Internet Registry (RIR) system until recent commercial developments. We will explore the critical milestones that shaped internet governance, including the exhaustion of IPv4 space, the market-driven rise of IP transfers and leasing, and the ongoing transition to IPv6. Finally, we will look ahead at the modern challenges facing the registry ecosystem, focusing on data accuracy, transparency, and the evolving geopolitical pressures on internet infrastructure. bnog-2026-13-the-infinite-ledger-tracking-the-evolution-politics-and-future-of-internet-number-resources Marco Schmidt en I plan to cover - The origins of the IANA function, early block allocations, and the transition from a single ledger to the distributed RIR framework. - The reality of IPv4 depletion, the emergence of secondary transfer markets, and the administrative shifts required to document legacy space and leasing practices. - The current situation of IPv4 and IPv6 deployment, the critical push for registry data quality, and how transparency safeguards the Internet ecosystem false https://pretalx.balticnog.org/bnog-2026/talk/BPWJNX/ https://pretalx.balticnog.org/bnog-2026/talk/BPWJNX/feedback/ ROOM BETA Talk 2026-09-23T16:30:00+03:00 16:30 00:25 Fortinet Secure SD-WAN combined with ADVPN enables dynamic, scalable, and secure connectivity across distributed environments, including branch offices, data centers, and cloud. By leveraging on-demand shortcut tunnels and intelligent path selection, organizations can optimize traffic flows regardless of underlay transport. This session demonstrates how template-based deployment and automation allow rapid rollout of hundreds of sites within hours rather than months, while maintaining consistent security and performance. bnog-2026-6-fortinet-secure-sd-wan-with-advpn-2-0-dynamic-and-scalable-deployments Braijens Staskevics en false https://pretalx.balticnog.org/bnog-2026/talk/GRYMVJ/ https://pretalx.balticnog.org/bnog-2026/talk/GRYMVJ/feedback/ ROOM BETA Talk 2026-09-23T17:00:00+03:00 17:00 00:25 IP engineers still view transceivers as plug & forget - something that just converts electrical to optical signal and vice versa. This talk provides a concise introduction to essential optical fundamentals for IP networking professionals, covering topics such as single-mode and multi-mode fiber and their structural and operational differences, common connector types and their usage, and a practical look at optical losses. In particular, it explains how attenuation accumulates across fibers, connectors, and splices, and how to perform optical link calculations and budgeting to ensure sufficient transmission margins. The talk also introduces wavelength-division multiplexing technologies, CWDM and DWDM, explaining their characteristics, channel spacing, use cases, and relevance in modern packet-optical networks. Each topic is illustrated with typical failure cases from transceiver support, such as single-mode optics on multi-mode fiber, contaminated MPO connectors, mismatched UPC and APC polish, and CWDM links limited by dispersion rather than attenuation. bnog-2026-31-optical-foundations-for-ip-engineers-from-fiber-basics-to-cwdm-dwdm-and-link-budgeting Andreas Glatz en false https://pretalx.balticnog.org/bnog-2026/talk/JQJS8N/ https://pretalx.balticnog.org/bnog-2026/talk/JQJS8N/feedback/ ROOM ALFA Keynote 2026-09-24T09:30:00+03:00 09:30 00:55 Europe’s digital infrastructure evolves to meet growing demands for resilience and digital sovereignty, to ensure resources for AI, cloud computing, research, and secure international connectivity, the importance of geographically diverse network routes has never been more important. The Polar Connect Initiative is aiming to establish a resilient, high-capacity digital backbone through the Central Arctic Ocean, providing secure and sovereign connectivity between Europe, North America and East Asia, along the shortest viable route. The Arctic may seem geographically distant from the Baltic region, however the Polar Connect submarine fibre cable route presents significant benefits for Northern Europe backbone network development. This new connectivity through the Arctic region positions the Nordic and Baltic countries as an international digital gateway between Europe and East Asia, creating additional opportunities for traffic exchange and interconnection, increase resilience for existing backbone networks, and support future growth opportunities for data centres, cloud services, and research infrastructure. This presentation will provide an update on the latest progress of the Polar Connect Initiative, including pre-marine surveys from the latest mission of summer 2026, technical feasibility studies, and the level of international collaboration required to achieve this one-of-a kind project. The talk will also map how the initiative fits within the broader European strategy for digital resilience, the Cable Projects of European Interest (CPEI), and the Digital Global Gateway. Rather than viewing Polar Connect as yet another submarine fibre cable, the presentation will focus on the opportunities for a new strategic layer of European digital infrastructure and what this means for operators, carriers, and infrastructure providers across the Baltic and Nordic region. bnog-2026-15-polar-connect-opportunities-with-the-new-arctic-connectivity-corridor Ieva Muraškienė en This Polar Connect Initiative presentation will provide an update on the latest progress, including pre-marine surveys in the Central Arctic Ocean, technical feasibility studies, stakeholder engagement, including building strong international collaboration. Special attention will be given to the opportunities and benefits for network operators, including: - strengthening resilience at the northern edge of European networks; - opportunities for new backbone and backhaul infrastructure in Northern Europe; - the role of carrier-neutral interconnection and open access infrastructure; - evolving traffic patterns driven by AI, hyperscalers, and high-performance computing; - research and education requirements alongside commercial connectivity; - Arctic infrastructure as an enabler both of new route, and future scientific sensing and environmental monitoring. The presentation invites for discussion on how the Baltic and Nordic networking community can help in developing the next generation of resilient, trusted, and globally connected infrastructure for Northern Europe. false https://pretalx.balticnog.org/bnog-2026/talk/G7UCNM/ https://pretalx.balticnog.org/bnog-2026/talk/G7UCNM/feedback/ ROOM ALFA Talk 2026-09-24T11:00:00+03:00 11:00 00:25 As AI platforms reshape global data, upend economies, disrupt workforces and challenges decades of the neutral, open Internet, a critical tension has emerged between the borderless nature of modern technology and the rising need for regional and sovereign data control. The Internet is dead! Long live the Internet! bnog-2026-11-the-splinternet-ecosystems-sovereignty-and-the-internet-in-the-age-of-ai Zachary Smith en As AI platforms reshape global data, upend economies, disrupt workforces and challenges decades of the neutral, open Internet, a critical tension has emerged between the borderless nature of modern technology and the rising need for regional and sovereign data control. In this session, Zachary Smith, CEO of Datum, explores the role of open-source ecosystems and community-driven interoperability and how they remain critical to infrastructure resilience even while the commercial systems, governments and regulatory frameworks are shifting all around us. We will explore what the Splinternet could and should look like and find out what it means for networks, service providers, builders and technology consumers of all sizes. false https://pretalx.balticnog.org/bnog-2026/talk/RXBWZU/ https://pretalx.balticnog.org/bnog-2026/talk/RXBWZU/feedback/ ROOM ALFA Talk 2026-09-24T11:30:00+03:00 11:30 00:25 This is a continued presentation around Artificial Intelligence (AI) from the BalticNOG 2025 where I covered the fundamental difference between AI for Networks and AI Networks - the intent of this talk is to cover more details around the challenges posed by AI workloads in data center infrastructure for TRAINING and INFERENCE, as these workloads pose some challenges around the data center infrastructure. This talk will cover fundamentals around how data is collected and structured/cleaned up for training usage as well as once the training is done how the model will be used for inference. It will look at data center design including AI Fabrics, scale-up vs. scale-out designs, challenges, and protocols used and provide some future guidelines around enhancements to such challenges under works within the UEC (Ultra Ethernet Consortium). UEC goal is to deliver a complete architecture that optimizes Ethernet for high performance AI and HPC networking, exceeding the performance of today’s specialized technologies.  UEC specifically focuses on functionality, performance, TCO, and developer and end-user friendliness, while minimizing changes to only those required and maintaining Ethernet interoperability bnog-2026-3-is-my-data-center-infrastructure-ready-for-ai-workloads Mikael Holmberg en false https://pretalx.balticnog.org/bnog-2026/talk/LCKLX8/ https://pretalx.balticnog.org/bnog-2026/talk/LCKLX8/feedback/ ROOM ALFA Talk 2026-09-24T12:00:00+03:00 12:00 00:25 AI networking discussions often stop at the GPU cluster. But a single inference task may increasingly cross devices, agents, models, tools, data sources, networks and providers—turning one user interaction into a dynamic distributed execution graph. This talk explores what that could mean for network architecture and interconnection. It examines how latency, compute availability, policy and state may influence where parts of a task execute, and why explaining performance becomes difficult across organisational boundaries. It maps existing observability building blocks and introduces FOX, a deliberately exploratory model for exchanging selected, policy-controlled evidence. The talk concludes by connecting observability with security and resilience, including agentic amplification, inference exhaustion, hidden dependencies and stateful failover. bnog-2026-21-beyond-the-gpu-cluster-building-networks-for-distributed-ai-inference Kaj Kjellgren en Most discussions about AI infrastructure focus on what happens inside the GPU cluster. This talk moves the discussion beyond the data centre and asks what happens when inference becomes distributed across devices, agents, models, tools, data sources, neoclouds and multiple network domains. The central proposition is that an AI task may increasingly resemble a dynamic distributed execution graph rather than a simple request to a single model endpoint. Different parts of that graph may execute at different distances, while model, provider and location choices change during the task. Latency, reachability, compute queues, policy, privacy and existing state may therefore become part of the placement decision—making the network an input to execution rather than passive transport. Using an illustrative five-second AI task, the talk then examines why attributing delay or failure becomes difficult when every participant sees only one part of the transaction. Existing technologies—including OpenTelemetry, W3C Trace Context, inference-server metrics, gNMI/OpenConfig, IPFIX, BMP, STAMP/TWAMP and IOAM—already provide many of the required signals. The unresolved problem is correlating selected evidence across organisational and trust boundaries. The talk introduces FOX, a Federated Observability Exchange, as a deliberately exploratory concept for policy-controlled exchange of such evidence. FOX is not presented as a finished architecture, standard or product, but as a way to stimulate discussion about whether neutral interconnection could help provide cross-domain observability. Finally, the talk connects observability to security and resilience: agentic amplification, inference exhaustion, hidden shared dependencies, stateful failover and the need for local fallback. The objective is not to predict one future, but to give the networking community a practical vocabulary for discussing the architectures now beginning to emerge. false https://pretalx.balticnog.org/bnog-2026/talk/KLRJXV/ https://pretalx.balticnog.org/bnog-2026/talk/KLRJXV/feedback/ ROOM ALFA Talk 2026-09-24T12:30:00+03:00 12:30 00:25 **2 years with an AI engineer on shift: what it fixed, what it almost broke, and the rules we wrote afterwards** We run a managed NOC for ISPs, data center operators and hosting providers worldwide. About two years ago we noticed that our engineers were doing the same investigation on every shift and on every customer network, regardless of vendor or topology: interface state, optics, neighbor tables, routing adjacencies, prefix reachability, logs, then a manual correlation across four or five terminals before anyone could say what broke and who was affected. So we built an internal AI NetOps assistant that uses the same tools our engineers already use, runs them in parallel across the stack, correlates the output and hands the on-call engineer a root cause hypothesis with the evidence attached, together with an assessment of which services are affected. This talk is the operational report after two years of running it inside a real NOC, not a product pitch and not a lab demo. We will cover the trust ladder we enforced and why each step existed. The agent started with no CLI access at all, reading only from monitoring, logs, flow data, BGP telemetry and the source of truth. It was then allowed a whitelist of operational show commands. Only later, and only for a narrow set of actions, was it permitted to propose changes, each gated by explicit human approval and a recorded audit trail. We will be honest about where that ladder stalled and which rungs we deliberately never climbed. We will then walk through the kind of production alerts every NOC sees in its NMS and show how the agent actually behaves on them: a BGP session that will not establish, an IGP topology change, an OSPF adjacency dropping, a Layer 2 circuit going down. These are real cases from networks we operate, with the agent's investigation shown step by step: which data it pulled, how it correlated it, what root cause it proposed, and how it assessed impact at the same time. Among the cases we have already presented: a BGP failure the agent traced to a malformed attribute list while confirming in parallel that redundant paths carried the traffic; an IGP link failure it reasoned about from BGP-LS data without polling a single router; an OSPF adjacency loss that came down to mismatched BFD timers; a PE-CE link failure where the system separated a transceiver fault from a fiber cut and mapped the affected services within minutes. The NOC keeps running, so the final selection will favor the most interesting cases we see between now and the conference. Across these workflows, median time from alert to identified root cause dropped from 22 minutes to under 4. We will also cover the cases where it was wrong. Some of them are the kind of mistake any engineer would catch instantly and the model did not, and those are the most instructive, because each one turned into a rule, a data fix or a guardrail. We will close with the numbers across [N] production infrastructures of different types: [X] alerts processed, [Y] percent resolved without escalation, plus screenshots of real investigations so the audience can judge the output for themselves. bnog-2026-28-two-years-with-an-ai-engineer-on-shift Andrian VisnevschiNicolai Moraru en This session tells the full story of how we built a AI NetOps agent, in the order it actually happened. The early phases were shaped by two hard constraints. Cost, because running large models against every alert on every network gets expensive fast. And speed, because a root cause hypothesis that arrives after the engineer has already found the answer is worthless. Those constraints pushed us to test small models first, and we will show what they could and could not do. From there the system grew in stages: from a read-only helper, to a chat bot engineers could question, to an agent that queries monitoring, logs, flow data, BGP telemetry and the source of truth in parallel, correlates the output and proposes a fix for human approval. We will also cover how we evaluated it along the way: the test cases we built from real incidents, how we ran them against different LLM models, and how those results decided what the agent was allowed to do next. We will close with where the system stands today and the numbers it produces in production. false https://pretalx.balticnog.org/bnog-2026/talk/THLKBE/ https://pretalx.balticnog.org/bnog-2026/talk/THLKBE/feedback/ ROOM ALFA Talk 2026-09-24T14:00:00+03:00 14:00 00:25 Inside the very "center" of the internet is a set of networks run by companies who have a special arrangement with each other that the rest of us do not have, These are sometimes called the "tier ones" or "transit free networks" However, are all of these "transit free networks" actually free of transit, and what does that actually mean? In this talk will go over some of the bgp.tools data that I have been analysing that will show have some of the T1 peering issues, where gaps exist, and how certain networks are getting closer to becoming a them, and what are the problems they will probably face, and finally does a network even want to be in this situation bnog-2026-30-transit-free-tier-ones-and-the-hopefuls Ben Cartwright-Cox en In this talk will go over some of the bgp.tools data that I have been analysing that will show have some of the T1 peering issues, where gaps exist, and how certain networks are getting closer to becoming a them, and what are the problems they will probably face, and finally does a network even want to be in this situation false https://pretalx.balticnog.org/bnog-2026/talk/XGGPP9/ https://pretalx.balticnog.org/bnog-2026/talk/XGGPP9/feedback/ ROOM ALFA Panel 2026-09-24T14:30:00+03:00 14:30 00:55 Geopolitical events are already shaping how operators buy, build, and run networks — including how much they can still rely on subsea cables between the Nordics and Central Europe. This panel looks at where that pressure hits Nordic and Baltic digital infrastructure hardest, how operators mitigate it, and what role Internet Exchanges play when the political map is moving. Moderated by Theo Voss, it brings together Kārlis Svilans (CERT.LV), Kamil Szczepański (Orange Polska), Aleksi Suhonen (TREX), Kaj Kjellgren (DE-CIX), and Fredrik Korsback (Meta). The conversation will stay practical: operational resilience, interconnection, and what the community should prepare for next. bnog-2026-39-building-resilient-networks-in-an-unstable-world Theo VossKaj KjellgrenKamil SzczepańskiAleksi SuhonenKārlis SvilansFredrik Korsbäck en false https://pretalx.balticnog.org/bnog-2026/talk/HYD8KL/ https://pretalx.balticnog.org/bnog-2026/talk/HYD8KL/feedback/ ROOM ALFA Talk 2026-09-24T16:00:00+03:00 16:00 00:25 For network operators, ISPs and Telcos in the Baltics, DDoS risk is changing - and the biggest attack is not necessarily the most dangerous one. Drawing on 12 months of DDoS data observed across RETN’s network, this presentation challenges the industry’s continued focus on peak attack size as the primary measure of threat. A 24.9 Tbps attack observed in November 2025 was almost nine times larger than any other monthly peak in the dataset - yet its size alone tells us little about the potential impact on a network or its customers. This talk touches on how smaller, distributed and deliberately low-volume attacks can be more disruptive than record-breaking floods. Carpet-bombing, precision attacks and evolving attack techniques can target multiple prefixes, place pressure on network infrastructure or evade traditional detection thresholds without producing headline-grabbing traffic volumes. For Baltic operators, the challenge is knowing what to look for and how to prepare. Andrejs will examine how the threat is evolving around the region, including risks from compromised network equipment and distributed attack sources, and why operators need to look beyond bandwidth - measuring detection speed, affected targets, root-cause clarity and the time it takes to understand and contain an attack. bnog-2026-35-is-the-biggest-attack-always-the-most-dangerous-one Andrejs Tihanovs en false https://pretalx.balticnog.org/bnog-2026/talk/JDYQ9N/ https://pretalx.balticnog.org/bnog-2026/talk/JDYQ9N/feedback/ ROOM ALFA Talk 2026-09-24T16:30:00+03:00 16:30 00:25 Volumetric DDoS protection can run on a host that terminates TCP connections, on a router protecting downstream networks, or on a scrubbing node receiving redirected traffic. These deployments differ in traffic visibility: a router-based filter may see mostly attack traffic or only client-to-server traffic. There are always-on, on-demand, and hybrid deployment models, and modern “hit-and-run” attacks challenge these architectures. Despite the differences in network architecture, these volumetric DDoS filtering approaches share a lot of functionality, which can be implemented in Linux eBPF. eBPF programs run at commodity Linux systems with capable yet standard network adapters. These programs run close to the network adapter driver and process traffic at 100+ Gbps on commodity servers. In this talk, we: 1. consider open-source eBPF implementations of filters for TCP SYN, ACK and RST floods, DNS reflection and random UDP floods, ICMP floods 2. discuss how to mitigate attacks with spoofed source addresses 3. cover deployment safety and monitoring 4. evaluate performance of filtering eBPF programs running on an x86-64 server with 200Gps NIC. bnog-2026-27-practical-volumetric-ddos-mitigation-with-linux-and-open-source Alexander Krizhanovsky en false https://pretalx.balticnog.org/bnog-2026/talk/SEWBLF/ https://pretalx.balticnog.org/bnog-2026/talk/SEWBLF/feedback/ ROOM ALFA Talk 2026-09-24T17:00:00+03:00 17:00 00:25 Modern DDoS botnets have evolved far beyond the original Mirai model. Kimwolf and Aisuru leverage large populations of compromised IoT devices and residential connectivity to generate attacks reaching approximately 30 Tbps and billions of packets per second, often sending traffic directly from infected devices without relying on traditional amplification. This presentation examines how these botnets evolved, how their command-and-control infrastructure operates, and the impact their attacks have not only on the targeted network, but also on every ASN carrying the traffic along the path. We will look at real-world mitigation approaches, including what failed, what helped, and why simply adding bandwidth or deploying traditional DDoS mitigation may not be enough at this scale. The presentation concludes with practical lessons from operators, including C2 disruption, trusted cross-network collaboration, and the role infrastructure takedowns and law-enforcement action can play in stopping attacks at their source. bnog-2026-12-massive-ddos-attacks-on-isps-a-look-into-kimwolf-and-aisuru Scott Fisher en Massive DDoS Attacks on ISPs: A Look into Kimwolf and Aisuru examines the newest generation of Mirai-descended botnets and the challenges they create for network operators. Using Kimwolf and Aisuru as case studies, the session explores how enormous attacks originating directly from compromised devices can overwhelm not only their intended target but also upstream and peering networks. It covers the evolution and operation of these botnets, their impact on ISP infrastructure, where traditional mitigation techniques break down, and the approaches that have proven most useful—from blocking and null-routing C2 infrastructure to close collaboration between trusted network operators. Ultimately, the presentation asks a larger question: when attacks reach tens of terabits per second, what actually stops them? false https://pretalx.balticnog.org/bnog-2026/talk/YZ97TP/ https://pretalx.balticnog.org/bnog-2026/talk/YZ97TP/feedback/ ROOM ALFA Talk 2026-09-24T17:30:00+03:00 17:30 00:15 TBU bnog-2026-42-closing-speech Paulius Judickas en false https://pretalx.balticnog.org/bnog-2026/talk/W8DXBW/ https://pretalx.balticnog.org/bnog-2026/talk/W8DXBW/feedback/ ROOM BETA Talk 2026-09-24T11:00:00+03:00 11:00 00:25 Many ISP use MPLS-TE auto-bandwidth to balance traffic in their network. With transition to Segment Routing, there is a challenge of implementing a similar solution due to the stateless nature of SR. The presentation describes challenges of auto-bandwidth implementation for SR and demonstrates a working prototype. bnog-2026-10-auto-bandwidth-for-segment-routing Dmytro Shypovalov en false https://pretalx.balticnog.org/bnog-2026/talk/LAULQN/ https://pretalx.balticnog.org/bnog-2026/talk/LAULQN/feedback/ ROOM BETA Talk 2026-09-24T11:30:00+03:00 11:30 00:25 The network engineering and interconnection industry is facing a critical challenge: the decline of experienced engineers and a growing shortage of new talent. In this presentation, I will share our project aimed at making it easier for new entrants to find the right resources and streamline their career paths in interconnection and peering. Recognizing that we cannot tackle this alone, we are partnering with universities and industry experts to build a more accessible, structured, and collaborative learning ecosystem. Together, we can ensure that the next generation of engineers is equipped to carry forward the essential work of interconnection and peering. bnog-2026-17-mission-critical-addressing-the-talent-black-hole-in-network-engineering Yolandi Cloete en false https://pretalx.balticnog.org/bnog-2026/talk/8PGEKK/ https://pretalx.balticnog.org/bnog-2026/talk/8PGEKK/feedback/ ROOM BETA Talk 2026-09-24T12:00:00+03:00 12:00 00:25 A random friday evening during July. - A BGP update with our customer prefix, and a correct AS-path. But it's not coming from our network. - Then a few minutes later, it's gone. 40 minutes later, there it was again - only to quickly disappear. Over and over again. bnog-2026-26-anatomy-of-a-bgp-spoofing-attack-bgp-filtering-a-quick-overview Lasse Jarlskov en A quick look at the details of a BGP spoofing attack on a customer in Lithuania. We take a look at the specifics, try to guess how this might have happened and what could be done to mitigate it. false https://pretalx.balticnog.org/bnog-2026/talk/X8EQJD/ https://pretalx.balticnog.org/bnog-2026/talk/X8EQJD/feedback/ ROOM BETA Talk 2026-09-24T12:30:00+03:00 12:30 00:25 Running diversely connected DNS servers requires that the list of zones and zone contents are synchronized on all servers. There are many approaches to handle this challenge, and many of them use mechanisms outside DNS. Catalog Zones are a newish mechanism that aims to do it all in-band in DNS. bnog-2026-14-automating-dns-secondaries-with-catalog-zones Aleksi Suhonen en false https://pretalx.balticnog.org/bnog-2026/talk/WCGBKA/ https://pretalx.balticnog.org/bnog-2026/talk/WCGBKA/feedback/ ROOM BETA Talk 2026-09-24T14:00:00+03:00 14:00 00:25 TBU bnog-2026-43-global-nog-alliance-update Sander Steffann en false https://pretalx.balticnog.org/bnog-2026/talk/APGWW8/ https://pretalx.balticnog.org/bnog-2026/talk/APGWW8/feedback/ ROOM BETA Talk 2026-09-24T16:00:00+03:00 16:00 00:25 Internet blocking is part of the operational reality of running an ISP in Italy. What looks like a simple requirement becomes considerably more complex when it reaches the network. Blocking orders come from several authorities, for different purposes and through different procedures, while courts can impose additional restrictions. There is no single system behind them. Yet an ISP has to identify what must be blocked, keep the information up to date and translate it into reliable network behaviour. This talk looks at how we deal with this at Airbeam, where we have built a largely automated DNS-based approach to handle these obligations. I will also share some real cases that show what can happen when regulatory requirements meet day-to-day network operations. bnog-2026-32-when-the-law-reaches-the-dns-operating-regulatory-blocking-at-isp-scale Livio Morina en Last year at BalticNOG, I presented Piracy Shield, Italy's anti-piracy blocking platform. This year, I want to continue that story. **Piracy Shield was only the tip of the iceberg.** Italian ISPs also receive blocking requirements from ADM, separately for gambling and tobacco, AGCOM, CONSOB, IVASS and CNCPO. On top of these administrative mechanisms, blocking can also result from court orders. Each has developed in its own way. Some provide lists, others issue individual orders; publication and notification methods differ, as do update procedures and technical expectations. There is no common interface designed for the operators that ultimately have to implement them. I will map this rather peculiar ecosystem and show how Airbeam brings much of it together at DNS level, from collecting and normalizing the sources to applying and removing restrictions. There will also be some real examples. A few of them are good illustrations of how not to design an operational process involving hundreds of network operators. The Italian case will then provide the starting point for a discussion with the BalticNOG community: what happens in other countries, and can we do this better? false https://pretalx.balticnog.org/bnog-2026/talk/39XGTR/ https://pretalx.balticnog.org/bnog-2026/talk/39XGTR/feedback/ ROOM BETA Talk 2026-09-24T16:30:00+03:00 16:30 00:25 Poland’s geography and economy Key IT & Telco companies in Poland Number of Poland’s Internet market indicators M&As important for polish Internet market Int’l cloud services market in Poland - local zones availability TOP 3 IXes in Poland Main service providers in Poland by selected categories - longhaul DF, IPT, internationals, DCs, ISPs & fixed from region telcos present in Poland Key infrastructural projects in PL New data centners planned in Poland bnog-2026-7-poland-as-a-hub-for-eastern-europe-connectivity Kamil Szczepański en false https://pretalx.balticnog.org/bnog-2026/talk/TYBQDZ/ https://pretalx.balticnog.org/bnog-2026/talk/TYBQDZ/feedback/