NetToolset Blog
Practical explanations of the protocols, math, and trade-offs behind the tools.
- 2026-05-23 · dns · performance
Public DNS Resolvers: 1.1.1.1 vs 8.8.8.8 vs 9.9.9.9
Cloudflare is usually the fastest, Quad9 blocks malware domains, Google is the universal fallback. Latency, privacy, and a decision tree for picking one.
- 2026-05-23 · ssh · security
What's a Safe SSH Port to Use in 2026?
Port 22 is fine with key-only auth and fail2ban. Moving to a high port cuts log noise 99% but is hygiene, not security. Numbers from a real internet-facing box.
- 2026-05-23 · ipv6 · networking
IPv4 vs IPv6: Should You Migrate Your Internal Network in 2026?
For most networks under 10,000 hosts — no. RFC 1918 gives 17.9M private addresses. Dual-stack at the edge, IPv4 internally, until you hit hyperscaler size.
- 2026-05-23 · http · infrastructure
Reverse Proxy in 2026: Nginx vs Caddy vs Traefik
Caddy for automatic HTTPS in 3 lines. Traefik for Docker/Kubernetes label-driven routing. Nginx for raw throughput. Side-by-side configs and a decision tree.
- 2026-05-23 · dns · vpn · privacy
Is Your DNS Leaking? How to Test and Fix It
If dnsleaktest.com shows your ISP while you are on a VPN, your DNS is leaking. The four causes, the four fixes, plus the WebRTC leak you forgot about.
- 2026-05-20 · networking · subnet
Subnet Masks Explained: What a /24 Actually Means
A /24 is not "256 IPs." It is 256 addresses, of which 254 are usable hosts. Here is what the slash notation, mask, and wildcard all really represent.
- 2026-05-18 · email · security
SPF, DKIM, and DMARC: The Email Auth Stack in 10 Minutes
Three TXT records decide whether your mail lands in inbox or spam. What each one verifies, how they stack, and the rollout order that actually works.
- 2026-05-16 · networking · subnet
CIDR Notation Cheatsheet: From /8 to /32
A reference table for every CIDR prefix — usable hosts, mask, wildcard — plus the four things people consistently get wrong about CIDR math.
- 2026-05-13 · networking · performance
MTU and MSS: Why Your VPN Feels Slow
A 1500-byte MTU gets shaved down by every tunnel (IPsec, GRE, PPPoE). When MSS clamping is wrong, you get black-hole connections that "kind of" work.
- 2026-05-10 · http · security
CORS Preflight Requests Demystified
Why your fetch fires an OPTIONS first, what the browser checks, and why Access-Control-Allow-Origin: * stops working the moment you add credentials.
- 2026-05-07 · tls · security
TLS 1.2 vs TLS 1.3: What Actually Changed
TLS 1.3 cut the handshake from 2-RTT to 1-RTT, removed RSA key exchange, and mandated forward secrecy. Here is what that means for real servers.