İlker Pehlivan
Network and systems engineer, founder of Serçe Bilişim
I run the networks and servers that other people's work depends on. Before founding my own consultancy I administered the backbone network, firewalls and core systems of a large multi-site organisation with thousands of users. I write about the things that actually broke.
What I do
I am a network and systems engineer and the founder of Serçe Bilişim, an IT consultancy. My working days are spent in other people’s server rooms: file servers, directory services, backups, firewalls and the networks underneath all of it.
PingEverything is where I write down what those days teach me.
Where the experience comes from
I did not start in infrastructure. My first job was at an advertising agency, wearing the webmaster, developer and digital marketing hats at the same time. That is where I learned to read what analytics data is actually saying, and that a technically perfect thing nobody can find is worth nothing.
From there I moved to a company building web infrastructure for banks. Fintech has no tolerance for “it usually works”. Under engineers far more senior than I was, I learned what a real architecture looks like from the back, and what engineering discipline means when a mistake has consequences.
The job that shaped this site most came after that: a large multi-site organisation where I started on the helpdesk and ended up as the system and network administrator. Thousands of users, a backbone network, firewalls, and the kind of critical systems where an outage is not a ticket but a building full of people who cannot work.
How I look at a problem
A slow system, a dusty cabinet, a bundle of cables nobody claims: all of them have a history. Somebody made a decision, under some constraint, and the current state is the result. Systems tell you that story if you know how to listen.
That habit is where the name comes from. When something breaks, you do not guess. You check every link in the chain, one at a time, until the broken one shows itself.
It also means I rarely see an incident as one broken machine. When a network drops, I am looking at the database behind it, the tool that stopped reporting, and the person whose work is now stuck, at the same time.
How this site is written
No invented numbers, no invented experience, no rewritten vendor documentation. The full rules, how articles are adapted from Turkish originals and how the site is funded are on the About page.
Articles by this author
- Active Directory Guide: Architecture, DNS, Security
Active Directory DNS: Forwarders, Reverse Zones, Split-Brain
Configure Active Directory DNS on Windows Server: forwarders, reverse lookup zones, conditional forwarders, and the split-brain setup that broke our own site.
17 min read
- Network Monitoring and Alerts: What to Watch and Alert On
How to Install Cacti on Ubuntu to Graph SNMP Traffic
Install Cacti on Ubuntu 24.04 with apt, add a switch over SNMP, and draw your first traffic graph, plus why there's no setup wizard and how to verify the graph.
14 min read
- Active Directory Guide: Architecture, DNS, Security
How to Join a Computer to an Active Directory Domain
Join Windows PCs and servers to Active Directory: DNS, time, and hostname prerequisites, Add-Computer, OU placement with redircmp, and the most common errors.
27 min read
- Network Monitoring and Alerts: What to Watch and Alert On
How to Set Up a Syslog Server on Ubuntu with rsyslog
Build a central syslog server on Ubuntu 24.04 with rsyslog: open UDP 514, split logs per sender, connect a switch, plan disk and rotation, and add TLS on 6514.
14 min read
- Active Directory Guide: Architecture, DNS, Security
Install Active Directory Certificate Services (AD CS)
Install Active Directory Certificate Services step by step: Enterprise Root CA setup, the four irreversible decisions, AIA/CDP, backup and end-to-end verification.
30 min read
- Network Segmentation Guide: VLANs, Layers, and Access
What Is a Port? TCP vs UDP and Connection Faults
What a port number does, how TCP and UDP differ, how to check open ports, and, when a connection won't form, which side the fault is on and how to prove it.
39 min read
- Network Segmentation Guide: VLANs, Layers, and Access
What Is a VLAN? 802.1Q Tags, Access vs. Trunk Ports
A VLAN splits one switch into separate networks using a 4-byte tag. How 802.1Q works, access vs. trunk ports, and native VLAN risk, with real packet captures.
33 min read
- Network Segmentation Guide: VLANs, Layers, and Access
What Is ARP? ARP Table States, Broadcast Domains, Spoofing
ARP maps an IP address to a MAC address on the local network. Cache states, where the broadcast domain ends, and ARP spoofing, shown with real packet captures.
32 min read
- Network Segmentation Guide: VLANs, Layers, and Access
What Is DNS and How Does It Work? Records and TTL
What DNS is and how it works: the root, TLD and authoritative chain; A, CNAME, MX, TXT records; nameserver delegation, TTL and caching, and diagnosing faults with nslookup.
44 min read
- Active Directory Guide: Architecture, DNS, Security
What Is Kerberos? Tickets, KDC, SPNs, and Troubleshooting
How Kerberos authenticates without sending passwords: the KDC, TGTs and service tickets, a real packet capture, klist, SPNs, and a diagnosis order for failures.
28 min read
- Active Directory Guide: Architecture, DNS, Security
What Is LDAP? Directory Queries, Bind, and LDAPS
What LDAP is, how a query is built from base DN, scope and filter, the three bind types, and why 389 vs 636 isn't a preference, shown with captured packets.
42 min read
- Network Segmentation Guide: VLANs, Layers, and Access
What Is NAT? SNAT, DNAT, and the Translation Table
What NAT really does, how SNAT and DNAT differ, how PAT reuses one address, why double NAT and CGNAT break port forwarding, and a measured look at hairpin NAT.
34 min read
- Network Monitoring and Alerts: What to Watch and Alert On
What Is NTP? Clock Synchronization and Stratum
What NTP is, why clocks drift, how the stratum hierarchy decides who gets time from whom, what breaks when clocks disagree, and the common sync traps, with a captured exchange.
25 min read
- Network Monitoring and Alerts: What to Watch and Alert On
What Is SNMP? MIB, OID, Traps, and SNMPv3
How SNMP polls devices and receives traps, what MIBs and OIDs are, why a v2c community string is not a password, and how SNMPv3 fixes it, shown byte by byte.
21 min read
- Network Monitoring and Alerts: What to Watch and Alert On
What Is Syslog? Facility, Severity, and Port 514
What a syslog line looks like, how facility and severity share one number, and why port 514 is UDP, explained with real output captured from a lab switch.
21 min read
- Backup and Recovery
Restore Testing: Turning a Green Job Into Evidence
A backup job that reports success proves the job ran. A restore test proves the data comes back. Here is how to run one that gives an auditor real evidence.
3 min read
- Backup and Recovery
The 3-2-1 Backup Rule, and Where It Stops Being Enough
Three copies, two media types, one offsite. What each number is actually protecting you from, and why ransomware forced most teams to add a fourth condition.
3 min read