Kevin Myers

Sr. Net Arch focusing on #MikroTik, #whitebox and #OSS for ISP design. Advocate for #IPv6 & rural ISPs. Husband. Dad. #Chesspunks War Eagle. Geek. #Lego

[Kevin Myers @stubarea51]

I've been working on a graphic to make teaching #IPv6 subnetting a little easier for engineers that are transitioning from #IPv4.

One of the challenges I've run across is that textbook & training examples often use very simple patterns to illustrate IPV6 subnetting.

However, when faced with a random assignment of a /48 prefix from an ISP, it's harder for engineers to wrap their head around how letters and numbers increment and where in the prefix that happens.

Here is an example of a "real-world" IPv6 prefix (using the doc prefix) and we got from a /32 to a /48.

Hope this is helpful!

[Mikrotik build @mikrotik_build]

RouterOS 7 testing update
Version: 7.24rc1 (2026-07-01 15:53:30)
Previous: 7.23rc4 (2026-05-22 09:53:19)
https://t.co/SFlNerZCzP

[Mikrotik build @mikrotik_build]

RouterOS 7 development update
Version: 7.24beta1 (2026-05-26 13:47:00)
Previous: 7.23beta5 (2026-04-01 18:30:08)

[Mikrotik build @mikrotik_build]

RouterOS 7 stable update
Version: 7.23 (2026-05-25 11:05:50)
Previous: 7.22.3 (2026-05-07 11:19:52)
https://t.co/pCGxYuWTli

[Mikrotik build @mikrotik_build]

RouterOS 7 testing update
Version: 7.23rc4 (2026-05-22 09:53:19)
Previous: 7.23rc3 (2026-05-06 18:26:08)
https://t.co/SFlNerZCzP

[Mikrotik build @mikrotik_build]

RouterOS 7 stable update
Version: 7.22.3 (2026-05-07 11:19:52)
Previous: 7.22.2 (2026-04-22 10:03:57)
https://t.co/pCGxYuWTli

[Kevin Myers @stubarea51]

@BergNetwork Oh man that sucks. I've always cloned the entire VM in Proxmox and upgraded the clone when it comes to EVE-NG because the upgrade process terrifies me lol.

Heard good things about container lab. @ioshints also has a good solution with https://t.co/lvwGwOT0Wb

[Kevin Myers @stubarea51]

Inflation really hit #Lego hard this month 😱

That UCS Millenium Falcon just keeps getting further out of reach 🤣

[Mikrotik build @mikrotik_build]

RouterOS 7 testing update
Version: 7.23rc3 (2026-05-06 18:26:08)
Previous: 7.23rc2 (2026-04-21 17:18:37)
https://t.co/SFlNerZCzP

[Kevin Myers @stubarea51]

#AI #LLM #ITJobs #NetworkEngineering

[Mikrotik build @mikrotik_build]

RouterOS 7 stable update
Version: 7.22.2 (2026-04-22 10:03:57)
Previous: 7.22.1 (2026-03-23 16:35:15)
https://t.co/pCGxYuWTli

[Mikrotik build @mikrotik_build]

RouterOS 7 testing update
Version: 7.23rc2 (2026-04-21 17:18:37)
Previous: 7.23rc1 (2026-04-14 13:35:26)
https://t.co/SFlNerZCzP

[Mikrotik build @mikrotik_build]

RouterOS 7 long-term update
Version: 7.21.4 (2026-04-21 08:49:05)
Previous: 7.20.8 (2026-01-30 11:17:54)
https://t.co/t7EipFCMkO

[Mikrotik build @mikrotik_build]

Winbox 4 update
Version: 4.1
Previous: 4.0.1
https://t.co/EgsRwU7N5L

[Mikrotik build @mikrotik_build]

RouterOS 7 testing update
Version: 7.23rc1 (2026-04-14 13:35:26)
Previous: 7.22rc4 (2026-03-04 15:06:44)
https://t.co/SFlNerZCzP

[Kevin Myers @stubarea51]

Artemis 2: "Houston, we have a problem"
Houston: "Do you have a ticket number?"

They probably spent 12 hours on the remote support session only to get transferred to entitlements. 🤓

[Tom's Hardware @tomshardware]

Artemis II astronaut finds two Outlook instances running on computers, call on Houston to fix Microsoft anomaly — puzzled caller describes ‘two Outlooks, and neither one of those are working’ https://t.co/brXHO9SfLi

[Kevin Myers @stubarea51]

When you've got to relax for that security maintenance window.... #40Gate #Fortinet

[Kevin Myers @stubarea51]

👀

[Plamen @plamenpetkov]

Over the last 24 hours, multiple ISPs using NetSense reached out to us with the same strange pattern.

A noticeable chunk of subscribers suddenly started generating outbound UDP traffic to:
- port 80
- port 443
- and even port 0

Mostly towards a small set of external ASNs / IP ranges.

A few things made this stand out:

→ Upload traffic spiking higher than download
→ Bursts of upload traffic, then pause, then again
→ Same behavior replicated across many users at the same time
→ Different regions of India
→ Very consistent destination patterns

QUIC can explain some UDP/443.

But UDP/80 and especially UDP/0? That’s definitely not normal Internet behavior.

This points strongly towards:
compromised devices at scale: routers, CPEs, IoT, etc which are acting in coordination.

What’s interesting is not just the pattern, but the simultaneity across different networks.

That usually means one of two things:
- a large botnet waking up
- or a new exploit spreading quietly across edge devices

(And yes — having flow visibility helps. Being able to quickly look at NetFlow/IPFIX data and spot patterns like this makes a big difference in response time.)

Now the real question:

Are others seeing this too?

If you operate an ISP / broadband network:
- Any unusual spikes in outbound UDP?
- Traffic hitting port 0?
- Similar destination concentration (specific ASNs / regions)?

Would be useful to compare notes.

Feels like one of those early signals you don’t want to ignore.

[Kevin Myers @stubarea51]

@sentdefender https://t.co/mqbb5WOgxP

[Kevin Myers @stubarea51]

Added a map to see which Data Centers were most at risk. This doesn't include every DC in the target region, but the most common public cloud DCs and cities with local/provider COLO DCs.

This is a general estimate using AI (Claude) and public Iranian missile data.

[Kevin Myers @stubarea51]

@sentdefender Quite a few ISP POPs and cloud DCs within range of their missiles.

https://t.co/UJbommE0Fm

[Kevin Myers @stubarea51]

With "Information Technology" on the target list, quite a few ISP POPs are within range of Iran's missiles.

Tata (AS6453), Sparkle (AS6762), Lumen (AS3356) and Arelion (AS1299) seem to be at the highest risk based on @PeeringDB locations & AS CAIDA rank.