BalticNOG 2025

Sep 24, 2025, 8:00 AM → Sep 25, 2025, 6:30 PM Europe/Vilnius

LITEXPO

BalticNOG 2025

The first BalticNOG 2025 will take place at LITEXPO Vilnius, Lithuania, from September 24 to 25, 2025.

BalticNOG 2025 will bring together around 400 network professionals, engineers, and decision-makers from across the Baltic States, Scandinavia, and Central Europe. This is a unique opportunity to connect with peers from industries including telecommunications, data centers, cloud providers, enterprise networking, academia, and cybersecurity.

Join us for two days of insightful discussions, technical workshops, and industry networking aimed at strengthening regional and global Internet infrastructure. Whether you’re an operator, researcher, or policymaker, BalticNOG 2025 is the place to be!

Wed, September 24

9:00 AM → 10:00 AM Registration & Welcome Coffee

10:00 AM → 10:10 AM Opening Remark: Room A

10:00 AM Opening Remark

Speaker: Vincentas Grinius (President of BalticNOG)

Vincentas Slides.pdf

10:10 AM → 11:30 AM Day 1: Session 1: Room A

10:10 AM Networking in the Dark

“Networking in the Dark”

Networks have a unique ability to determine who is communicating with whom, and even the topic of the communication. In using the network we are trusting the network not to betray us and leak this information to others. A decade ago it becme apparent that this trust had been betrayed. The reaction from the protocol and application folk in the IETF was to view all forms of network monitoriong as an attack on users’ privacy, and took steps to apply encryption to as much of the protocol space ass they could. A decade later what does this look like? Have the application space succeeded in their objective to withhold all information from the network, and strip networks down to an undistinguished commodity carrier role?

Speaker: Geoff Huston

2025-09-24-darknetworking.pdf

2025-09-24-darknetworking.pptx

10:35 AM Monitoring Root DNS prefixes

Speaker: Lefteris Manassakis

Monitoring Root DNS prefixes.pptx

11:00 AM Go Long! Weird signals with optics

Computer network operators depend on optical transmission everywhere as it is what glues together our interconnected world. But most of the industry is running the same kinds of signals down the optical transceivers.

As part of my need to "Trust, but verify" I wanted to check my assumptions on how the business end of modern optical modules worked, so join me in a adventure of sending weird signals many kilometres, and maybe set some records for the most wasteful bandwidth utilisation of optical spectrum in 2024!

Computer network operators depend on optical stuff everywhere as it is what glues together our interconnected world. But most of the industry is running the same kinds of signals down the optical transceivers.

As part of my need to "Trust, but verify" I wanted to check my assumptions on how the business end of modern optical modules worked, so join me in a adventure of sending weird signals many kilometres, and maybe set some records for the most wasteful bandwidth utilisation of optical spectrum in 2024!

In this talk we will cover the basis of optical networks, how it fits in with networking, some of the weird things pluggable optics do, the perhaps odd industry defacto standards, and bending the intended use cases of existing tech to make signals that would would deeply probably confuse a modest signals intelligence agency

Speaker: Ben Cartwright-Cox (bgp.tools)

Go Long! Sending weird signals long distances over existing optical infrastructure - APRICOT 2025.pdf

11:30 AM → 12:00 PM Coffee Break #1

12:00 PM → 1:30 PM Day 1: Session 2: Room A

12:00 PM Analyzing network reliability up to 800G - Impact of SNR thresholds on BER for Coherent (16QAM) and Non-Coherent (PAM4) high speed transceivers under environmental variations

This presentation investigates the proximity to a low Signal-to-Noise Ratio (SNR) threshold that can still maintain a tolerable Bit Error Rate (BER) in 100G / 400G / 800G network links. Additionally, we account for factors such as temperature and cable length to predict the duration for which a reliable network connection can be sustained between transceivers. The analysis, based on data retrieved using a Flexbox, focuses on comparing the reliability of coherent (16QAM) and non-coherent (PAM4) transceivers, with a detailed discussion on the implications of these technologies on network performance.
Made by FLEXOPTIX Research - Gerhard and Thomas.

Speaker: Thomas Weible (FLEXOPTIX)

Flexoptix - Network Reliability Analysis Coherent Non-Coherent.pdf

12:30 PM FRRouting: BGP Features You Haven’t Used (= Heard), Yet?

Discover powerful but lesser-known BGP features in FRRouting that can simplify operations, improve control, and boost performance. Whether you're an operator or developer, you'll walk away with practical tools and ideas you likely haven’t explored yet.

Speaker: Donatas Abraitis

BalticNOG2025-FRRouting.pdf

1:00 PM The Curious Case of IPv4: Sustaining the Internet Until IPv6 Arrives

The Internet has officially run out of IPv4 addresses, yet the world still runs largely on IPv4. Despite 25 years of work, IPv6 adoption remains below 40% of users in 2025, and projections suggest a full transition may not complete until the mid-2040s. So how has the Internet kept growing? NATs, CDNs, and creative address sharing have stretched IPv4 far beyond its intended limits — but these solutions come with challenges.
This keynote explores the paradox of IPv4 scarcity and sustainability. It looks at why the IPv6 transition has slowed, how market forces stabilized IPv4 prices, and why leasing has emerged as a pragmatic solution. Leasing re-circulates idle IPv4 space, provides revenue for holders, and offers affordable access for operators — effectively turning IPv4 into a renewable resource.
The session connects technology, economics, and policy to show how IPv4 leasing is bridging the gap between scarcity and the sustainable, long-term adoption of IPv6.

Speaker: Paulius Judickas (IPXO)

Paulius Judickas - IPXO - Finalized.pptx

12:00 PM → 1:30 PM Day 1: Session 2: Room B

12:00 PM Future-Proofing Global Connectivity: Trends, Threats, and Tactics for a Resilient Network

In an era of geopolitical tension, climate disruption, and rapidly increasing bandwidth demands, network resilience is no longer optional—it's critical infrastructure. This session examines how Europe is digitally connected to the world: the submarine cables and terrestrial routes that form its backbone, the hidden vulnerabilities exposed by recent incidents, and the strategic steps needed to secure global connectivity for the future. From the Red Sea cable disruptions to new risks driven by climate change and supply chain constraints, we’ll explore what’s going wrong—and what can be done better. Attendees will gain practical insights and leave with a renewed focus on smarter, more collaborative infrastructure planning.

Session Topics:

How Europe connects to the world

• Key submarine cable systems and terrestrial routes
• Interdependencies and single points of failure

Lessons from recent disruptions (2024–2025)

• Red Sea cable cuts and their underestimated impact on Europe-Asia traffic
• Baltic Sea cable cuts and lessons learned
• Other real-world failures

Emerging risk factors shaping network resilience

• Climate change and extreme weather events

• Geopolitical instability and regulatory fragmentation

• Post-pandemic supply chain pressures and
  infrastructure constraints

What operators can do to improve resilience

• Rethinking route planning: move beyond redundancy to true diversification

• Key questions to assess supplier resilience and route transparency

• Exploring terrestrial alternatives and investing in underdeveloped regions

Speaker: Timur Pertenava (RETN Networks)

BalticNOG_Pertenava_v5_compressed.pptx

12:30 PM The Network Automation Blueprint

As networks grow in complexity and scale, manual operations are no longer sustainable. Yet, many organizations struggle to go beyond isolated Command Line Interface (CLI), Graphical User Interface (GUI), or siloed tooling. This talk presents The Network Automation Blueprint, a structured, vendor-neutral approach to designing and executing scalable network automation.

We begin by addressing the foundational questions: Why automate your network? and What can you automate? Highlighting real-world examples that demonstrate how even small automation efforts can yield big wins in efficiency, reliability, and agility. From automating routine configurations to streamlining change validation and compliance, the scope of what’s possible is broader than many realize.

However, before automation can be effective, certain pre-requisites must be in place. These include both technical and organizational factors. Technical prerequisites include patternization, standardization, and well-defined processes. Organizational prerequisites include leadership buy-in and support, skill development, and adaptable processes. We explore the critical role of process maturity, showing how defined standards and change control mechanisms act as enablers of safe automation.

A common challenge in network automation efforts is the dilemma between ad-hoc "just do it" automation and intentional, design-driven architecture. This talk contrasts both approaches and provides a balanced view: how to encourage grassroots innovation while converging on a maintainable system.

The blueprint outlines the key areas where network automation can be applied to drive improvement, including config generation and deployment, IP, BGP, VLAN allocations, fault remediation, etc.

Attendees will leave with a clear mental model of how to structure their automation journey to tackle network automation adoption challenges. It offers clear guidance for those just starting out, while providing equally valuable insights for experienced practitioners looking to refine or scale their efforts.

Speaker: Basem Al-Sabri

The-Network-Automation-Blueprint-v1.6.pptx

1:00 PM The Myth around AI Networks & AI for Networks

Artificial Intelligence (AI) set new demands on current data center infrastructure as it is undergoing a paradigm shift to be able to cope with the new demands possessed by AI clusters to support various use cases. AI clusters can be built in various sizes based on specific needs and workloads. This presentation will explore the data center network infrastructure evolution around the CLOS IP Fabric with the new requirements posed for building infrastructure for AI data center clusters and various types of workloads that these would host. The basic infrastructure needed for such are highspeed AI data center network, storage, and compute. Building Large Language Models (LLMs) requires centralized data, with demand for large bandwidth, while Inferencing is becoming more commonplace, which is driving a transition to a more distributed computing environment where traffic moves device-to-device and edge-to-core-to-cloud

Speaker: Mikael Holmberg (Extreme Networks)

Myth-Around-AI-Networks_v2.0 (2).pptx

1:30 PM → 2:30 PM Lunch break

2:30 PM → 4:00 PM Day 1: Session 3: Room A - Panel

2:30 PM Network Resilience Panel

Dmytro Kohmanyuk (Hostmaster.UA) leads panels of experts discussing resiliency, both logical and physical, based on the real world experience.

Speakers: Aleksi Suhonen (TREX Regional Exchanges Oy), Mx Dmytro Kohmanyuk, Kaj Kjellgren (KajTech), Olena Kushnir (NOGUA / WEB PRO LLC), Tarko Tikan

2:30 PM → 4:00 PM Day 1: Session 3: Room B

2:30 PM BGP Flow Spec for DDoS mitigation: practical aspects

In this presentation Pavel will share practical real field aspects of using BGP Flow Spec for DDoS mitigation. I will talk about level of vendor support level and known implementation issues.

Speaker: Pavel Odintsov (FastNetMon)

BGP Flow Spec updated 29 August 2025.pdf

3:00 PM What’s new on PeeringDB?

What’s new on PeeringDB?

Speaker: Dr Livio Morina (Airbeam SRL | PeeringDB)

20250924_BALTICNOG1_Morina_Livio_rev2.pptx

3:30 PM The Future of IP Resource Management: AI, Edge Cloud, and Next-Gen Processors

As networks evolve with the adoption of edge cloud computing, artificial intelligence, and specialized processors such as Data Processing Units (DPUs), IP resource management must keep pace with technological advancements. Traditional approaches to managing IP addresses and network configurations are increasingly inadequate in dynamic, high-performance environments where automation and scalability are key.

In this presentation, Juha Holkkola, Co-Founder and Chief Technologist at FusionLayer will explore how emerging technologies are reshaping IP resource management. The talk will provide insights into:

• the role of AI in automating IP address allocation and optimizing network efficiency
• how edge cloud computing is redefining network architectures and IP resource planning
• the impact of DPUs and other new processor types on networking performance and security
• the role of Secure Zero Touch Provisioning (sZTP) as defined in RFC 8572 in automating and securing large-scale network deployments

This session will provide network engineers and decision-makers with actionable strategies to future-proof their IP management frameworks in a rapidly advancing digital ecosystem by leveraging real-world case studies and industry trends.

Speaker Bio:
Juha Holkkola is a recognized expert in network infrastructure automation and IP resource management. As the co-founder of FusionLayer, he has spent over two decades helping enterprises, service providers, and internet operators optimize their network architectures. Juha has spoken at numerous industry events, including RIPE, NANOG, and various regional NOGs, where he shares insights on emerging networking, automation, and cybersecurity trends.

Speaker: Juha Holkkola (FusionLayer inc Co-Founder and Chief Technologist)

FusionLayer_Presentation_BalticNOG.pdf

4:00 PM → 4:30 PM Coffee Break #2

4:30 PM → 6:00 PM Day 1: Session 4: Room A

4:30 PM Internet during wartime in Ukraine | The resilience of Ukrainian ISPs | Ukrainian Network Community and NOGUA foundation

The main challenges ISPs in Ukraine face every day and what to do.

Speakers: Olena Kushnir (Co-founder of NOGUA), Viktoriia Opanasiuk (Co-founder of NOGUA)

Baltic NOG Internet during wartime - Viktoriia Opanasiuk.pdf

Olena Kushnir for BalticNOG.pptx

5:10 PM When Tomorrow Becomes Today: Lessons of Resilience from Ukrainian Telecom

Speaker: Mrs Valeriia Yuryma (DeepNet UA)

When tomorrow becomes today.pdf

5:30 PM WHEREIS: IP Address Registration Geo-Consistency

The five Regional Internet Registries (RIRs) provide the critical function of IP address resource delegation and registration. The accuracy of registration data directly impacts Internet operation, management, security, and optimization. In addition, the scarcity of IP addresses has brought into focus conflicts between RIR policy and IP registration ownership and use.

In this presentation we present WHEREIS, a measurement-based approach to geolocate delegated IPv4 and IPv6 prefixes at an RIR-region granularity and systematically study where addresses are used post-allocation and the extent to which registration information is accurate. We define a taxonomy of registration "geo-consistency" that compares a prefix's measured geolocation to the allocating RIR's coverage region as well as the registered organization's location. While in aggregate over 98% of the prefixes we examine are consistent with our geolocation inferences, there is substantial variation across RIRs and we focus on AFRINIC as a case study. IPv6 registrations are no more consistent than IPv4, suggesting that structural, rather than technical, issues play an important role in allocations. We solicit additional information on inconsistent prefixes from network operators, IP leasing providers, and collaborate with three RIRs to obtain validation. We further show that the inconsistencies we discover manifest in three commercial geolocation databases. By improving the transparency around post-allocation prefix use, we hope to improve applications that use IP registration data and inform ongoing discussions over in-region address use and policy.

Speaker: Oliver Gasser (IPinfo)

BalticNOG-2025-split.pdf

4:30 PM → 6:00 PM Day 1: Session 4: Room B

4:30 PM Virtual Network Operation Center enabled by the nmaas platform

Nmaas is an open-source, multi-tenant cloud platform designed for easy, on-demand deployment of applications across distributed Kubernetes clusters (https://docs.nmaas.eu). Built around an extensible catalogue of applications, nmaas allows users to deploy software tools with minimal effort, supporting network operations through process automation.

Originally focused on network management applications, nmaas now serves a broad range of real use cases across academic, research and network operator communities. Users can deploy and customize application instances via a self-service web portal, either on the GÉANT-managed instance or a self-hosted nmaas installation.
nmaas for Virtual Network Operations Center (vNOC) is meant for teams tasked with network or service monitoring responsibility that have limited resources to develop and/or maintain their own NMS or plan to migrate their existing monitoring tools to the cloud. With nmaas, open-source software tools are deployed on a cloud infrastructure, potentially distributed across multiple locations. Using a multi-tenant approach and software-based VPNs, each team has private access to their isolated network management toolset without the burden of underlying IT infrastructure maintenance. Using a single nmaas instance users can deploy applications across multiple remote Kubernetes clusters. This architecture is particularly valuable for managing distributed setups, such as edge nodes or regional clusters. All of the application data never leaves the environment where the application has been deployed, thus ensuring complete data sovereignty. nmaas’ architecture also allows it to take advantage of hardware accelerators such as GPUs, thus enabling the deployment of AI-driven network analysis and monitoring tools.

The nmaas platform is actively used for infrastructure management and monitoring as part of multiple research projects, including production environments in Poland. This presentation will offer an in-depth look at nmaas, highlighting key features and use cases, and will include a demo of core functionalities such as GitOps-based configuration of representative applications.

Speakers: Lukasz Lopatowski (PCSS), Vojdan Kjorveziroski (UKIM)

nmaas BalticNOG 2025 - final.pptx

5:00 PM Performance measurement goes Flow

Do you have probes installed to monitor your network border? Ever struggled to estimate the fallout-perimeter of a probe alerting quality-deterioration? We show an example how to firmly map probes to interconnect points and secondly, how to identify which other traffic is likely affected by the same problem.

Speaker: Peter Gyoergy (BENOCS)

20250624 Performance goes flow.pptx

20250820_ Performance goes flow.pdf

5:30 PM Securing the Backbone: Defending Peering Networks Against DDoS, Blackholing Risks, and VPN Threats

In today’s interconnected digital landscape, peering networks form the critical backbone enabling fast and efficient data exchange. However, this connectivity also exposes networks to significant security threats such as Distributed Denial of Service (DDoS) attacks, misconfigured or aggressive blackholing, and vulnerabilities in VPN encryption. This presentation dives into the real-world risks and impacts these threats pose to both network integrity and business continuity. Through compelling case studies—including the Dyn DNS attack and the Colonial Pipeline breach—we’ll explore advanced mitigation strategies and best practices for securing peering environments. Attendees will gain actionable insights on safeguarding their networks, minimizing collateral damage, and ensuring resilient, trusted peering relationships in an increasingly hostile cyber landscape.

Speaker: Yolandi Cloete (DE-CIX)

Securing the Backbone 2025 (Y Cloete).pptx

7:00 PM → 11:00 PM Day 1: Social Event: Social Event

7:00 PM Social Event

Thu, September 25

9:00 AM → 10:00 AM Opening time

10:00 AM → 11:30 AM Day 2: Session 1: Room A

10:00 AM Team Cymru - Network Community Tools Overview

Team Cymru offers a full suite of free tools and services to the network and netsec communities. I will cover each one at a high level and answer questions regarding each tool.

Speaker: Scott Fisher (Team Cymru)

TC Community Services - BalticNOG - FINAL.pptx

10:30 AM Automation to Fight Piracy: The Italian Experience

Piracy Shield from an operator PoV

Speaker: Mr Livio Morina (Airbeam SRL | PeeringDB)

BalticNOG1-PS_r20250920.pptx

11:00 AM Improve your life with kindness

DNS has evolved from its humble beginnings to a complex system. We believe some best practices can make the life of operators easier and the DNS more secure and resilient at the same time.

Speaker: Ulrich Wisser (ICANN)

20250924 - BalticNOG - KINDNS.pdf

20250924 - BalticNOG - KINDNS.pptx

10:00 AM → 11:30 AM Day 2: Session 1: Room B

10:00 AM Design-Driven Network Automation

The network automation community, for the most part, agrees that to automate the network and higher-level services, we need structured data, ideally stored in a centralized location, often referred to as the Source of Truth (SoT).

We have seen increased advocacy for a better way of governing the data in and their relationships using a design-driven approach. The goal is to move away from managing individual data objects in the SoT towards grouping related data together as a single abstracted entity used for configuring or verifying the network state.

To help explain this approach, we want to present an implementation of the idea that provides a full lifecycle of the design-driven approach. The idea is simple: to offer the network engineers (or consumers, in general) an entry point with minimal input data that is expanded according to the design. The design implementation can then be deployed to the network, updated with different input data, adjusted for the new design revision, and, finally, decommissioned. All of this takes into account data interdependencies (i.e., you can’t change the data that a design owns, or decommission a design that another design depends on).

Speaker: Przemek Rogala (Network to Code)

Network Automation Architecture and Design Driven Automation - final.pdf

10:30 AM Building Trustworthy Network Automation, From Principles to Practice

Trust is essential for successful network automation adoption.

When automation platforms exhibit predictable behaviors and transparent processes, teams can confidently delegate critical network operations. Building trustworthy automation doesn't happen by itself, it needs to be baked into the design of every workflows. This technical session examines core principles that build trust, including idempotency, declarative workflows, and robust version control. Using practical examples from production environments, we'll analyze how specific technical decisions affect automation reliability and team confidence. The presentation covers key implementation patterns like state verification, diff-based changes, and failure handling. Attendees will learn concrete approaches for building automation platforms that network teams can trust and rely on daily.

Speaker: Damien Garros (OpsMill)

BalticNOG - Building Trustworthy Network Automation, From Principles to Practice.pptx

11:00 AM ISP Blueprint: Best Practices for ISP Core Network

This presentation outlines the essential pillars for successfully launching and scaling an Internet Service Provider (ISP). We begin by defining the core technical infrastructure—network architecture, routing protocols, bandwidth provisioning, peering arrangements, and redundancy strategies—to ensure high availability and optimal performance. Next, we address security imperatives and compliance with data protection regulations to safeguard both network integrity and customer privacy. We then examine financial considerations, from capital expenditures, switching and routing equipment to operational costs such as power, cooling, and staffing. Regulatory compliance is also touched including interconnection agreements, and evolving net neutrality frameworks. Monitoring and management practices are highlighted, detailing real‑time network telemetry, quality‑of‑service tracking, automated alerting, and capacity planning to preempt congestion and outages. Additional focus areas include customer support and service‑level agreements (SLAs)—as well as partnerships with content delivery networks (CDNs), cloud providers. Finally, we try balancing quick wins with long‑term scalability, to guide entrepreneurs and technical leaders in building a resilient, competitive, and compliant ISP.

Speaker: Alfredo Giordano

2025_Best Pratices for ISP Core Network.pdf

11:30 AM → 12:00 PM Coffee break #1

12:00 PM → 1:30 PM Day 2: Session 2: Room A

12:00 PM Datacenter network at Vinted

I would like to tell about how newtork is managed at Vinted:
- configuration as code and automatic tests
- basic network functionality to improve HA and throughput
- service integaration into network (kubernetes, NAT, etc)
- hardware and NOS overview

Speaker: Rytis Lebedys

Datacenter network at vinted-4.pdf

12:20 PM Securing your AS-set

While RPKI ROAs have gone a long way in securing your BGP announcements, they far from cover all potential BGP hijack scenarios.
In many cases, what stands between you and a potential BGP hijack is still what is recorded in public IRR DB (e.g. the RIPE DB) particularly your AS-set.

In this talk, I will look at what an AS-set is, what different "types" exist, how they're used to keep you safe from BGP abuse, and how you can help tighten your security by properly maintaining your AS-set.

This is a follow-up talk to the one I presented in spring at DKNOG, Netnod and Nog.FI.

Speaker: Lasse Jarlskov (Telia Company)

Securing your AS-Set-BalticNOG.pptx

12:50 PM Redundant National Distribution of Time and Frequency

Recent geopolitical developments have led to severe disruption for crucial systems that society relies on, even for countries that are not part of any ongoing conflict. This includes intentional sabotage of infrastructure or denial of access to critical support systems. Global Navigation Satellite System is one of those systems that society depends on, both in terms of positioning but also for time and frequency . Time and frequency from a GNSS receiver are widely utilized, as receivers are inexpensive and easy to install. A number of the systems that are crucial for society are GNSS dependent in terms of correct and traceable time and frequency. These systems include those critical for the function of energy, communication, security systems as well as health systems for entire countries.

National time is based on the national time scale of each country and can be distributed via various different routes to end users. The main issue with time and frequency is that while it is a key part of critical infrastructure, with society dependent on its correct functioning, the market is not willing to cover the current costs for delivering correct traceable time. Another issue is that the publicly funded National Metrology Institutes (NMIs) that realize the national timescales have limited resources, which results in end users not having access to correct traceable time and frequency, and instead relying on GNSS without redundancy.

To meet current and future needs, research and development must be carried out regarding TF distribution in existing fibre infrastructure, as well as coexistence with communication methods.

Here we present the latest work on traceable national distribution of time and frequency from the Swedish national time scale. The distribution takes place from a number of different locations in Sweden, each location having redundant time scales based on atomic clocks.

Speaker: Dr Sven-Christian F Ebenhag (NETNOD AB)

Redundant National Distribution of Time and Frequncy final.pptx

12:00 PM → 1:30 PM Day 2: Session 2: Room B

12:00 PM Defending the Realm with Deepfield Defender

The DDoS landscape is continuously evolving. Join this session to uncover the three essentials to look for in any anti-DDoS tool.

Speaker: Jose Alberto Nistal Iglesias (NOKIA)

20250925 BalticNOG-Defending the Realm with Deepfield Defender.pdf

12:30 PM Automated Network Asset Discovery: Eliminating Human Error Through Intelligent System Integration

Modern network infrastructure management faces a critical challenge: up to 95% of network changes are performed manually, resulting in operational costs 2-3 times higher than network hardware costs. This presentation demonstrates how automated asset discovery platforms eliminate costly human errors while creating seamless integration workflows between monitoring, security, and management systems.

The Human Error Crisis: Manual device configuration accounts for the majority of unplanned outages, with router misconfigurations being the primary cause. Organizations without automation face severe consequences: security misconfigurations lead to data breaches, financial losses, operational disruptions, and regulatory penalties. A single misconfigured firewall rule or outdated system can expose entire networks to sophisticated attacks.

Automated Discovery Architecture: This session showcases passive traffic monitoring through NetFlow, sFlow, and IPFIX protocols for real-time asset identification without network overhead. Unlike active scanning approaches requiring infrastructure modifications, passive monitoring provides comprehensive visibility across hybrid environments including on-premises, cloud, and distributed networks.

Intelligent System Integration: Demonstrations illustrate automated workflows connecting Asset Discovery platforms with monitoring systems like Zabbix, Configuration Management Databases (CMDB), and Security Information Event Management (SIEM) solutions. Automated CMDBs can scan networks in near-real-time, providing comprehensive, accurate views of network devices and their dependencies.

Practical Implementation Examples: Automated security policy enforcement, intelligent change management with impact analysis, and cloud-hybrid visibility chains. These scenarios demonstrate how automation reduces mean time to detect threats from 34 days to real-time detection, while ensuring continuous compliance monitoring.

Measurable Business Impact: Organizations implementing automated asset discovery report dramatic improvements: incident response times reduced from hours to minutes, configuration errors eliminated by 90%, and security policy violations detected instantly rather than weeks later. The presentation concludes with actionable implementation strategies for immediate deployment in production environments.

Speaker: Marcin Kaźmierczak

Sycope - BalticNOG - Automated Network Asset Discovery Eliminating Human Error Through Intelligent System Integration_External.pptx

1:00 PM Datacenter Networking Best Practices – A High-Level Overview of Modern DC Network Architecture

A technical overview of modern inter and intra data center routing architectures.

Speaker: Korhan Kayhan (NOKIA)

DC Network Best Practices.pptx

1:30 PM → 2:30 PM Lunch Break

2:30 PM → 4:00 PM Day 2: Session 3: Room A

2:30 PM IPv6 Panel: From Hype to Reality

For more than two decades, IPv6 has been promoted as the future of the Internet, but how far have we really come? This panel takes a look at the journey from bold promises to today’s reality. Expect myths to be busted, adoption challenges explored, and surprising success stories shared.

Our panelists will reflect on what worked, what didn’t, and what still needs to change, from technical barriers to regional differences and government incentives. We’ll also zoom in on what IPv6 means for the Baltic region and the practical steps companies can take now.

Speakers: Marco Schmidt (RIPE NCC), Ondřej Caletka (RIPE NCC), Veronika McKillop (UK IPv6 Council), Wilhelm Boeddinghaus (Route 128 GmbH)

3:30 PM Can We Be the Regulation-Compliant, Cyber-Secure Backbone of European Advancement

As Europe’s digital future becomes increasingly shaped by regulation, cybersecurity, and sovereignty concerns, infrastructure providers are no longer just carriers of data — they are custodians of trust. This keynote explores how the Baltic region, with its strong track record in digital governance, GDPR readiness, and cyber resilience, can position itself as a strategic backbone for Europe’s network and data ecosystem.

Drawing on case studies such as Estonia’s X-Road, cross-border e-governance, and Europe’s GAIA-X cloud federation, the session will highlight how compliance and security can be turned into competitive advantages. It will also address the balance regulators must strike: protecting fundamental rights while leaving space for flexibility and innovation.

Speaker: Miglė Petkevičiene (Infobalt)

BalticNOG_Migle Petkeviciene_v2.pdf

2:30 PM → 4:00 PM Day 2: Session 3: Room B

2:30 PM Generating an optimal segment list for SR-TE

Segment Routing has replaced legacy MPLS control plane (LDP/RSVP) in ISP networks. Traffic Engineering in SR is achieved by headend router pushing a set of segments (MPLS labels or IPv6 extension headers) on the packet that instruct the network how to steer this packet.

The talk is about algorithms used to generate the segment list, I want to share my experience gained during developing an SR-TE controller.

Speaker: Dmytro Shypovalov (Vegvisir Systems)

SR-TE Segment List optimizations_v3 (1).pdf

3:00 PM Secure SD-WAN Network Designs

SD-WAN network designs - one size fits all
SD-WAN in MPLS networks - yes or no ?
AI for SD-WAN deployment and maintenance - short demo with AI agent helping with NOC opperations for SD-WAN network troubleshooting and deployment

The presentation will also include a 5 min Demo

Speaker: Mindaugas Ruginis (Fortinet)

For_event_Fortinet_Secure_SD-WAN.pptx

public_Fortinet_Secure_SD-WAN.pdf

3:30 PM Modular, Standards-Based Network Orchestration with AI-Accelerated Development

Designing reliable, adaptable network services at scale demands more than just automation scripts. It can be achieved with orchestration systems that are modular by design, aligned with industry standards, and capable of evolving across domains. This principle shaped the development of a production-grade orchestration stack for network service provisioning, delivered for the Polish NREN, PIONIER, under the GÉANT GN5-2 project. Built on TM Forum compliant models, dynamic inventory, and workflow automation, the system integrates seamlessly from service design to device configuration, thus demonstrating how structured orchestration can move from architecture to deployment with clarity and control.

The experience has shown that as network orchestration becomes increasingly complex, traditional coding approaches struggle to keep pace with the demand for rapid, yet standards-aligned service design. Thus, our aims extended to exploring the use of Large Language Models (LLMs) as active copilots in the architecture, design, and implementation of full-stack orchestration solutions. Rooted in the idea of vibe coding, we guide the LLM to code every piece such as workflow task, operators for the Source of Truth, as well as schema-compliant payloads and retry-aware logic.

The talk shares insights from both phases: the architectural choices behind the working system, and the experimental use of AI to reproduce or extend parts of it. We discuss practical prompt strategies for generating modular logic, enforcing standards such as the use of TM Forum Open APIs, and guiding newcomers through complex orchestration patterns.

Findings show that while human careful guiding remains critical, prompt-driven workflows can reduce time-to-design and deploy, support maintainability, and offer a viable onboarding path for teams new to network automation. Combined with open APIs and reusable building blocks, this approach enables orchestration that is not only functional, but also teachable, transferable, and ready for broader adoption.

Speakers: Roman Łapacz (PSNC), Sonja Filiposka (Ss. Cyril and Methodius University in Skopje)

BalticNOG-NetOrchAI-v0.3.pptx

4:00 PM → 4:30 PM Coffee Break #2

4:30 PM → 6:10 PM Day 2: Session 4: Room A

4:30 PM IXP ≠ IP Transit: Understanding the True Role of Internet Exchange Points

Despite the growing adoption of Internet Exchange Points (IXPs) across the globe, many stakeholders—including network engineers, enterprise IT teams, and even decision-makers—often harbor misconceptions about the actual role of an IXP within the internet ecosystem. One of the most common misunderstandings is equating IXPs with IP transit providers.

This presentation provides a comprehensive clarification of the fundamental purpose of IXPs. It will elaborate on how IXPs function as neutral Layer 2 platforms that facilitate direct interconnection between Autonomous Systems (AS), enabling efficient traffic exchange through bilateral or multilateral peering relationships. The presentation will emphasize the architectural distinctions between IXPs and transit services, the requirements for participating in an IXP, and the operational implications of peering.

By addressing prevalent myths and illustrating practical use cases—including traffic optimization and cost reduction—this session aims to reinforce best practices in network interconnection. Attendees will leave with a clearer understanding of how to leverage IXPs effectively to enhance network performance, resilience, and scalability, particularly within local and regional contexts.

Speaker: Michael Takeuchi (RAPID Networks)

BalticNOG - Michael Takeuchi (final rev).pdf

4:50 PM IPv6 Only IXPs Are Coming?

RFC5549/RFC8950 specifies a way of announcing IPv4 routes using IPv6 next-hops, allowing networks and IXPs to remove IPv4 link addressing, and reuse that address space more productively. There is a working group at Euro-IX that has tested the interoperability of RFC8950 implementations and lays out the basics of its usage in an IXP environment. A handful of IXPs have already deployed RFC8950 route servers.

Speaker: Aleksi Suhonen (TREX Regional Exchanges Oy)

ipv6-only-ixps.pdf

5:10 PM Every ISP Needs To Use A QoE Middle-Box On Their Network

Every Internet Service Provider on the face of the Earth needs to use a Quality of Experience middle-box on their network. A middle-box gives you visibility into your network: latency, jitter and bufferbloat only become apparent when you look. Spot congestion and latency spikes at every level of the network. A middle-box gives you proactive monitoring: identify the customers who are having problems before they call you. And most importantly, a middle-box gets rid of support calls. By actively managing bufferbloat, enhancing perceived latency and proactively pacing packets you can immediately improve your customers’ quality of experience. In our experience, this massively reduces the volume of support calls-and costs to service them. A Quality of Experience middle-box allows also for more aggressive but safer over-subscription rate. PS: Bandwidth is a lie.

Speaker: Frank (Frantisek) Borsik (LibreQoS)

LibreQoS at BalticNOG_Final update.pptx

5:40 PM → 6:05 PM Closing remark

5:40 PM Closing Remark

Speaker: Paulius Judickas (Chairman of BalticNOG board)