Telecom & ISPs
We test whether your edge, subscriber systems, customer portals and APIs are safe from attackers, and fix what we find. A service provider is judged by its edge: routing, subscriber management, peering and the way it behaves under attack. Our engineers have built and operated those layers, and we protect the customer data that rides on them.
Regional ISPs, fiber builders, WISPs and carriers compete on reliability and price per subscriber. Both depend on the edge: how routes are learned and filtered, how subscribers authenticate and get addresses, how traffic reaches the internet and how the network behaves when a link, a router or an attacker fails.
Our engineers have built those edges: BGP with BIRD, RPKI origin validation, BFD, DDoS filtering with XDP and FlowSpec, 100G fabrics and colocation footprints. We also protect the customer data that carriers hold, which US law treats as a category of its own, customer proprietary network information.
What we see in your industry
- Subscriber growth outruns the edge. Moving from 10G to 100G uplinks, adding peering and keeping failover under a second all have to happen without an outage.
- IPv4 scarcity pushes providers to carrier-grade NAT. RFC 6888 sets the behavior a CGN must have, and logging and port allocation decide whether it is supportable.
- Telecommunications carriers must protect customer proprietary network information. 47 CFR 64.2010 requires authentication before CPNI is disclosed, and 64.2011 sets breach notice to the Secret Service, the FBI and customers, with a record kept for two years.
- Denial-of-service floods and route leaks are routine. Edge filtering, RPKI origin validation and tested scrubbing paths are part of the product.
The edge comes first. A pair of routers, 100G uplinks to two transit providers and a peering port at an exchange give you capacity and options. BFD brings detection of a dead link to well under a second, where the BGP hold timer alone would take much longer.
Subscriber management comes second. A BNG terminates subscribers with IPoE using DHCP, or PPPoE where legacy gear needs it, and enforces speed plans. Dual-stack IPv6 carries a growing share of traffic and takes load off the carrier-grade NAT.
Address sharing comes third. RFC 6888 lists the requirements for a CGN, including endpoint-independent mapping and limits on ports per subscriber. Port-block allocation keeps logs small enough to search when a legal request arrives.
Customer data comes last. CPNI covers what a carrier knows about a customer's use of the service. 47 CFR 64.2010 requires reasonable steps to prevent unauthorized access and authentication before disclosure, and 64.2011 requires notice of a breach to the Secret Service, the FBI and affected customers, plus a record kept for at least two years. We confirm the current timing in the rule text at the start of each engagement.
Every provider's runbooks and records can run offline. Our Apocalypse IT Package is an on-premises continuity kit with a local reference library, document scanning, a private AI desk, chat and battery backup, offered to every customer.
Related work on our track record: a regional ISP's BGP, BNG and CGNAT edge refresh (illustrative), a private 5G network for a port terminal (illustrative), private 5G for an automotive plant (illustrative), two colocation sites built from empty cages (illustrative) and a SaaS company's anycast DNS and BGP edge.
BGP at the Edge with BIRD 2: RPKI, Communities and Fast Failover
BGP (RFC 4271) decides how your network is reached from the internet and how it reaches everyone else. BIRD 2 is an open-source routing daemon that does the job on ordinary Linux or BSD servers. This article covers the pieces a sound edge needs: filters from RFC 7454, RPKI origin validation, communities, BFD for quick failure detection, and what BGPsec does and does not do.
Work like yours
How we help
Managed IT Services
We run your IT day to day so it stays secure: help desk, devices, Microsoft 365, Exchange, Active Directory, backups, networks and monitoring.
Learn moreCybersecurity
We find out whether everything you run is safe from attackers, then we fix it.
Learn moreDatacenter & Colocation Builds
Cages, racks, power, cabling and servers, built by the people who will run them.
Learn moreCloud Management
Cloud cost review and management, without compromising on quality or security.
Learn moreFrequently asked questions
Direct answers to the questions we hear most. Something else on your mind?
Send us a messageCan you refresh an ISP edge without an outage?
Our engineers stage the work over maintenance windows: build the new routers beside the old, test failover, then move uplinks and subscribers in steps with a rollback plan. See the regional ISP edge refresh in our Experience section.
What do you design at the network edge?
BGP on redundant routers with BFD for fast failover, route filtering, RPKI origin validation and communities for traffic engineering, plus BNG subscriber termination, carrier-grade NAT and IPv6 dual-stack. We document the policy so your team can run it.
How do you approach carrier-grade NAT?
We follow the behavior set in RFC 6888, including endpoint-independent mapping and per-subscriber port limits, with port-block allocation and searchable logs so a legal request can be answered. IPv6 dual-stack reduces how much traffic needs the NAT.
What does CPNI require of a carrier?
47 CFR 64.2010 requires authentication before customer proprietary network information is disclosed, and 64.2011 sets breach notice to the Secret Service, the FBI and customers, with a record kept for two years. We build the controls and logging; counsel advises on obligations.
How do you protect an ISP from DDoS floods and route leaks?
With edge filtering, RPKI origin validation, BGP FlowSpec and remotely triggered blackhole routing, plus a tested path to a scrubbing provider. We rehearse the paths before an attack, because an untested scrubbing path is not a defense.
Can you build datacenter or peering capacity for us?
Yes. Our Datacenter & Colocation Builds service covers colocation selection, cage design, power, cabling and server builds, and we plan 100G peering and exchange ports with you. Scope is discussed during scoping.