# FoundryNet

> Vendor-neutral guides to load balancing, switching, routing and monitoring, plus an independent archive of the Foundry Networks product lines and CLI.

An independent network engineering reference and the unofficial archive of Foundry Networks (1996 to 2008). Guides explain load balancing, Ethernet switching, routing and network monitoring in vendor-neutral terms, with IronWare configuration shapes as worked examples, and a growing set of pages on AI crawler, bot and agent traffic at the edge. One named editor; every guide links its standards and sources. No advertising, no cookies, no cross-site tracking. Not affiliated with Foundry Networks or its successors.

## Newest: provenance on the wire (authenticity at the network layer)
- [Bot Verification: Proving a Crawler Is Who It Claims to Be](https://foundrynet.com/provenance/bot-verification/): How to verify the origin of a client claiming to be a search or AI crawler: reverse then forward DNS, published IP range feeds, RFC 9421 signatures, a log.
- [mTLS Between Edge and Origin: Mutual TLS as Proof of Both Ends](https://foundrynet.com/provenance/mtls-edge-to-origin/): Mutual TLS proves both ends of an edge-to-origin connection, provenance for the link itself: the TLS 1.3 client certificate exchange, a private CA, rotation.
- [Content Integrity in Transit: Proving a Response Arrived Unchanged](https://foundrynet.com/provenance/content-integrity-in-transit/): How to prove a response arrived unchanged and verify the source: where TLS stops, Subresource Integrity, RFC 9530 Content-Digest and Repr-Digest, signatures.
- [Edge Logs as Evidence: An Audit Log That Proves What Was Served](https://foundrynet.com/provenance/edge-logs-as-evidence/): How to keep edge and balancer logs with a chain of custody: fields that prove what was served, NTP time, RFC 5424 syslog, RFC 5848 signatures, retention.
- [RPKI and Route Origin Validation: Proving a Route Is Authentic](https://foundrynet.com/provenance/rpki-route-origin-validation/): How RPKI lets a router verify the origin of a BGP route: what an ROA states, how validators build VRPs and feed routers over RTR, the three validation states.
- [C2PA Through a CDN: Serving Content Credentials Without Breaking Them](https://foundrynet.com/provenance/c2pa-through-a-cdn/): Serving files that carry a C2PA manifest through a CDN, optimiser or proxy: where the manifest lives, what breaks the signature, pass-through and testing.
- [Image Metadata Through the Pipeline: What Survives Optimisation](https://foundrynet.com/provenance/image-metadata-through-the-pipeline/): Which image metadata blocks (EXIF, IPTC, XMP, ICC, C2PA) exist in JPEG, PNG, WebP and AVIF, which operations strip them, and how to inspect and preserve them.
- [Syslog as Evidence: Provenance and Integrity of Network Logs](https://foundrynet.com/provenance/syslog-as-evidence/): Syslog per RFC 5424, RFC 3164 and RFC 5425 TLS, why provenance and integrity decide whether a log is evidence, and how to build a pipeline reviewers trust.
- [Audit Trail for Network Changes: An Authorship Record](https://foundrynet.com/provenance/audit-trail-for-network-changes/): Build an audit trail for network changes: AAA command accounting, config version history with hashes, tickets and an authorship record for AI-assisted edits.
- [Packet Capture as Evidence: Chain of Custody for pcap Files](https://foundrynet.com/provenance/packet-capture-chain-of-custody/): How to take a packet capture that holds up later: capture point, clock source, pcapng metadata, SHA-256 at close, a chain of custody record, sealed storage.
- [Network Forensics: Provenance of Captures, Flows and Logs](https://foundrynet.com/provenance/network-forensics-provenance/): Network forensics reconstructs events from packet captures, flow records and device logs: how each is made, its chain of custody and what it proves.
- [DNSSEC: How a Resolver Can Verify the Origin of a DNS Answer](https://foundrynet.com/provenance/dnssec-verify-the-origin-of-a-dns-answer/): How DNSSEC lets a validating resolver verify the origin of a DNS answer: RRSIG, DNSKEY, DS and NSEC records, the root trust anchor, the AD flag and delv.
- [Certificate Transparency: A Public Provenance Log for TLS](https://foundrynet.com/provenance/certificate-transparency-provenance-log/): Certificate transparency explained: RFC 6962 and RFC 9162 Merkle-tree logs, SCT delivery, browser policy, and monitoring your domains as a provenance record.
- [Subresource Integrity: Verify the Origin of Every Script](https://foundrynet.com/provenance/subresource-integrity-verify-the-origin-of-scripts/): Subresource integrity lets a browser verify the origin of a script's bytes against a digest the author set. How SRI works, what breaks it at a CDN, rollout.
- [SHA-256 Checksums and Signed Firmware: Verify the Source](https://foundrynet.com/provenance/sha256-checksum-verify-the-source-of-a-download/): What a sha256 checksum proves and how to verify the source of a firmware image with sha256sum, shasum, certutil, Get-FileHash and a detached GPG signature.
- [Code Signing: Provenance of the Firmware and Configs You Run](https://foundrynet.com/provenance/code-signing-provenance-of-firmware-and-configs/): Code signing is a private-key signature over a hash of firmware, packages or config bundles. What it proves, what it does not, and how to verify the origin.
- [NTP Server Time as Provenance: Timestamps You Can Defend](https://foundrynet.com/provenance/ntp-server-time-as-provenance/): An NTP server hierarchy is the provenance of every timestamp on the network: RFC 5905 NTPv4, stratum design, RFC 8915 NTS, PTP and RFC 3161 timestamping.
- [WARC Files: Archiving Web Pages as Evidence With Provenance](https://foundrynet.com/provenance/warc-files-archiving-web-content-as-evidence/): What a WARC file records (ISO 28500 request, response and digest records), how to capture one with wget, verify the payload digest and keep chain of custody.
- [DMARC, SPF and DKIM: Verify the Origin of Email at the Edge](https://foundrynet.com/provenance/dmarc-spf-dkim-verify-the-origin-of-email/): How a mail gateway uses SPF, DKIM and DMARC to verify the origin of a message: RFC 7208, 6376 and 7489, alignment, p=none to p=reject, and reading reports.

## Machine traffic at the edge
- [AI Crawler Traffic: Identifying LLM Bots at the Network Edge](https://foundrynet.com/network-monitoring/ai-crawler-traffic/): Identify AI crawler and LLM bot traffic: user-agent tokens, reverse DNS with forward confirmation, published ranges, robots.txt limits and log patterns.
- [Bot vs Human Traffic: Fingerprinting Automated Clients](https://foundrynet.com/network-monitoring/bot-vs-human-traffic/): Tell bot from human traffic: TLS ClientHello fingerprints, HTTP/2 SETTINGS and header order, TCP/IP signals, timing, session behaviour and false positives.
- [Crawler Rate Limiting on a Load Balancer or Reverse Proxy](https://foundrynet.com/load-balancing/crawler-rate-limiting/): Rate limit crawlers on a load balancer: token and leaky buckets, choosing the client key, 429 with Retry-After, caching first, health checks and logging.
- [Verifying AI-Written Network Configs Before Deployment](https://foundrynet.com/routing/verifying-ai-written-configs/): Verify AI-written router and switch configs before deployment: common hazards, lint, diff, reachability analysis, lab tests, rollback timers, show commands.
- [Checking AI Answers About Legacy IronWare and Foundry Hardware](https://foundrynet.com/foundry-networks/checking-ai-answers-about-legacy-gear/): Why AI-generated answers about end-of-life Foundry and IronWare gear go wrong, how to check one against show version and CLI help, and how to judge sources.
- [robots.txt and llms.txt: Telling AI Agents What to Fetch](https://foundrynet.com/network-monitoring/robots-txt-and-llms-txt/): How robots.txt groups, Allow and Disallow rules and the newer llms.txt file work for AI crawlers and agents, what each can express, and what neither enforces.
- [AI Agent Traffic: When a Browser Drives Itself](https://foundrynet.com/network-monitoring/ai-agent-traffic/): What AI agent traffic looks like on the wire: real browsers under automation, bursty task sessions, form posts and logins, and how operators can measure it.
- [Verifying Bots With HTTP Message Signatures](https://foundrynet.com/network-monitoring/verifying-bots-with-http-signatures/): How signed requests let a site verify which operator sent a crawler or agent: RFC 9421 signature headers, key discovery, checking a request and failure modes.
- [Answer Engine Referral Traffic: Measuring Visits From AI Answers](https://foundrynet.com/network-monitoring/answer-engine-referral-traffic/): How to measure visits that arrive after an AI answer engine cites a page: Referer and referrer policy, landing patterns, what logs can and cannot show.
- [Caching to Absorb Crawler Load: Keep Bots Off the Origin](https://foundrynet.com/load-balancing/caching-for-crawler-load/): Use HTTP caching, conditional requests and accurate sitemap lastmod to absorb AI crawler and fetcher load at the proxy instead of the origin servers.
- [Writing an AI Crawler Access Policy for Your Organisation](https://foundrynet.com/load-balancing/ai-crawler-access-policy/): How to write an AI crawler access policy: who decides, what to allow, shape or block per operator, how to express it in robots.txt and at the edge.
- [Load Balancing LLM Inference Servers: What Changes](https://foundrynet.com/load-balancing/load-balancing-llm-inference/): Why round-robin and least-connections struggle with language model inference, and how queue-aware, cache-aware routing and streaming change the balancer.
- [Checking AI-Generated Subnet and ACL Math Before You Use It](https://foundrynet.com/routing/checking-ai-generated-subnet-math/): Language models often get CIDR arithmetic, wildcard masks and ACL ranges subtly wrong. How to check subnet plans and access lists with tools first.
- [Peer Review for AI-Assisted Network Changes](https://foundrynet.com/routing/review-ai-assisted-network-changes/): How to review AI-generated network changes: disclose the tool, check intent before syntax, verify with analysis tools and labs, stage the rollout.
- [Archiving Dead Vendor Documentation Honestly](https://foundrynet.com/foundry-networks/archiving-vendor-documentation/): How to preserve and cite documentation for discontinued network gear: web archives, provenance notes, what may be re-hosted, and spotting invented material.

## 01 Server Load Balancing Guide
Section index: https://foundrynet.com/load-balancing/

- [Server Load Balancing: VIPs, Real Servers and Health Checks](https://foundrynet.com/load-balancing/server-load-balancing/): Server load balancing explained: virtual IPs and real servers, Layer 4 methods, health checks, NAT versus direct server return and balancer failover.
- [Global Server Load Balancing (GSLB): DNS-Based Site Selection](https://foundrynet.com/load-balancing/global-server-load-balancing/): Global server load balancing explained: the DNS proxy model, site selection metrics, TTL trade-offs, DNS caching, anycast and how GSLB sits above local SLB.
- [Session Persistence on a Load Balancer: Sticky Session Methods](https://foundrynet.com/load-balancing/session-persistence/): Session persistence on a load balancer: source IP, cookie insert, passive and hash, SSL session ID and why TLS 1.3 broke it, URL parameters and testing.
- [Layer 4 vs Layer 7 Load Balancing: What Each Layer Sees](https://foundrynet.com/load-balancing/layer-4-vs-layer-7-load-balancing/): Layer 4 vs Layer 7 load balancing compared: what each layer sees, URL switching, TLS termination cost, latency, X-Forwarded-For and a decision table.

## 02 Ethernet Switching Guide
Section index: https://foundrynet.com/switching/

- [VLANs: Broadcast Domains, 802.1Q Tagging and Trunk Ports](https://foundrynet.com/switching/vlans/): VLANs explained: broadcast domains, 802.1Q tags and 4094 usable IDs, access versus trunk ports, native VLAN, inter-VLAN routing and the port-based model.
- [Link Aggregation and LACP: Bundling Ethernet Links](https://foundrynet.com/switching/link-aggregation/): Link aggregation explained: static bundles versus LACP (802.3ad, now 802.1AX), per-flow hashing limits, member rules, MLAG and Foundry trunk and lag syntax.
- [Spanning Tree Protocol: STP, RSTP and MSTP Explained](https://foundrynet.com/switching/spanning-tree-protocol/): Spanning tree protocol explained: loops and broadcast storms, root bridge election, port roles, RSTP and MSTP convergence, BPDU guard and alternatives.
- [802.1X Port Authentication: Supplicant, Authenticator, RADIUS](https://foundrynet.com/switching/802-1x-port-authentication/): 802.1X explained: supplicant, authenticator and RADIUS roles, EAP methods, MAC authentication bypass, dynamic VLANs, host modes and monitor-first rollout.
- [Layer 2 vs Layer 3 Switch: Where Each Belongs](https://foundrynet.com/switching/layer-2-vs-layer-3-switch/): Layer 2 versus Layer 3 switch: MAC forwarding against hardware routing, closet versus distribution and core roles, when a switch replaces a router.
- [Power over Ethernet: 802.3af, 802.3at and 802.3bt Budgets](https://foundrynet.com/switching/power-over-ethernet/): Power over Ethernet explained: 802.3af, PoE+ and 802.3bt wattage, PD classes, Alternative A and B pairs, switch power budget math, voice VLAN and QoS.

## 03 Network Routing Guide
Section index: https://foundrynet.com/routing/

- [VRRP and VSRP: First-Hop Redundancy Explained](https://foundrynet.com/routing/vrrp-and-vsrp/): VRRP explained: virtual router, priority and preemption, timers, virtual MAC 00-00-5E-00-01-xx, tracking, VRRP versus HSRP and GLBP, Foundry VRRP-E and VSRP.
- [MPLS VPN: Labels, LSPs, Layer 3 and Layer 2 VPNs](https://foundrynet.com/routing/mpls-vpn/): MPLS VPN explained: labels and LSPs, LDP versus RSVP-TE versus static, RFC 4364 Layer 3 VPNs with VRFs and route targets, VPLS and VLL, PE/P/CE roles.
- [IPv6 Transition: Dual Stack, Tunnels, Translation and Planning](https://foundrynet.com/routing/ipv6-transition/): IPv6 transition explained: IPv4 exhaustion, dual stack, 6in4 and 6rd tunnels, NAT64, DNS64 and 464XLAT, address planning, SLAAC versus DHCPv6, security.
- [Core Router: Role, Architecture and Design Rules](https://foundrynet.com/routing/core-router/): Core router explained: core versus edge and aggregation, forwarding and control planes, line-rate chassis design, redundancy, route scale and collapsed core.

## 04 Network Monitoring Guide
Section index: https://foundrynet.com/network-monitoring/

- [sFlow: Packet Sampling and Counter Polling for Switch Monitoring](https://foundrynet.com/network-monitoring/sflow/): sFlow explained: RFC 3176 packet sampling and counter polling, sampling math, the agent and collector model on UDP 6343, sFlow vs NetFlow and switch setup.
- [SNMP MIBs: OIDs, MIB-II Objects and Enterprise Trees](https://foundrynet.com/network-monitoring/snmp-mibs/): SNMP MIB guide: v1, v2c and v3, OIDs and the MIB tree, MIB-II objects such as ifTable, enterprise MIBs including the Foundry 1991 branch, counter wrap, traps.
- [Port Mirroring: How to Configure a SPAN Port and Capture Traffic](https://foundrynet.com/network-monitoring/port-mirroring/): Port mirroring how-to: what a SPAN port does, ingress and egress, oversubscription mirroring 10G to 1G, remote mirroring, TAP versus mirror and verification.

## 05 Foundry Networks Product Archive
Section index: https://foundrynet.com/foundry-networks/

- [Foundry Networks: Company History, 1996 to 2008](https://foundrynet.com/foundry-networks/company-history/): Foundry Networks history, 1996 to 2008: founding by Bobby Johnson, the Iron product lines, the 1999 IPO, JetCore, 10 Gigabit Ethernet and the Brocade deal.
- [Brocade Foundry Acquisition: Timeline, Renames and Successors](https://foundrynet.com/foundry-networks/brocade-acquisition/): Brocade Foundry acquisition explained: the converged data centre thesis, the 2008 timeline and price cut, product renames and where each Foundry line went.
- [Foundry Networks Security Advisories Archive (bugTraq)](https://foundrynet.com/foundry-networks/security-advisories/): Foundry security advisories archive: the bugTraq.html page, the 2002 SNMP, 2003 OpenSSH and 2004 TCP reset advisories, and hardening legacy IronWare today.
- [Foundry IronWare CLI Command Reference and Cheat Sheet](https://foundrynet.com/foundry-networks/cli-command-reference/): Foundry CLI commands for IronWare: modes, show commands, saving, VLANs and trunks, ServerIron basics, and where the original documentation went after 2008.
- [Foundry Switch Default IP, Console Access and Password Recovery](https://foundrynet.com/foundry-networks/default-ip-and-password-recovery/): Foundry switch default IP: there is none. Console settings (9600 8N1), first management address, boot monitor password recovery and chassis power connectors.
- [IronView Network Manager: Foundry SNMP Management Platform](https://foundrynet.com/foundry-networks/ironview-network-manager/): IronView Network Manager (INM): the Java, SNMP-based Foundry element manager for discovery, config deploy, traps and sFlow, and managing IronWare gear today.
- [Foundry ServerIron: Layer 4-7 Switch and Load Balancer Family](https://foundrynet.com/foundry-networks/serveriron/): Foundry ServerIron profile: web switch generations from the XL to the Brocade ADX, SLB, GSLB and firewall load balancing roles, the CLI model and lab notes.
- [Foundry BigIron: Layer 3 Backbone Switch Family](https://foundrynet.com/foundry-networks/bigiron/): Foundry BigIron profile: chassis Layer 3 switches from the 4000, 8000 and 15000 to the MG8 and Terathon-based RX, JetCore, deployments and lab notes.
- [Foundry FastIron: Layer 2/3 Edge and Wiring Closet Switches](https://foundrynet.com/foundry-networks/fastiron/): Foundry FastIron profile: Workgroup, II, Edge, Edge X, SuperX, GS and LS switches, PoE and 802.1X, and the lineage into Brocade and Ruckus ICX.
- [Foundry NetIron: Core and Service Provider Router Family](https://foundrynet.com/foundry-networks/netiron/): Foundry NetIron profile: the 400 and 800 core routers, the IMR 640 MPLS router, XMR and MLX chassis and the CES edge, who ran them and where it ended.
- [Foundry EdgeIron: Entry-Level Managed Edge Switches](https://foundrynet.com/foundry-networks/edgeiron/): Foundry EdgeIron profile: the value line of managed Layer 2 edge switches from 2002, the 24G, 2402CF and 4802CF, its separate CLI and lab notes.
- [Foundry SecureIron: Security Switch and Firewall Load Balancer](https://foundrynet.com/foundry-networks/secureiron/): Foundry SecureIron profile: the mid-2000s security switch with line-rate access control, DoS protection and firewall load balancing, and why it ended.
- [Foundry IronPoint: Enterprise Wi-Fi Access Points and Wireless Solutions](https://foundrynet.com/foundry-networks/ironpoint-wireless/): Foundry IronPoint profile: the IronPoint 200 access point of 2004, FastIron Edge wireless management, Foundry's WLAN position and why the radios are obsolete.
- [Foundry AccessIron: Access Routers for Branch and WAN Edge](https://foundrynet.com/foundry-networks/accessiron/): Foundry AccessIron profile: the 2004 branch and WAN edge routers with T1/E1 and serial ports, why the line ended and its long-lived command reference.

## 06 Provenance on the Wire: Authenticity at the Network Layer
Section index: https://foundrynet.com/provenance/


## About
- [Editor: Ray Castellano](https://foundrynet.com/about/editor/)
- [About the site](https://foundrynet.com/about/): Who edits FoundryNet, why the Foundry Networks domain relaunched as a network engineering reference in 2026, what it covers and how to send corrections.
- [Contact](https://foundrynet.com/contact/)
- [Privacy](https://foundrynet.com/privacy/) and [Terms](https://foundrynet.com/terms/)