标签：#ki

Apple is putting control back into the hands of parents with more granular screen time features.

Find the answers to some of the most common GitHub-related questions. The post GitHub for Beginners: Answers to some common questions appeared first on The GitHub Blog .

The messaging giant announced that it disrupted a phishing campaign targeting its users with NSO’s spyware.

Moms are outsourcing tedious household tasks to ChatGPT and selling courses teaching others to do the same. Where are all the dads?

title: Your AI Agent Should Not Be Locked to One LLM Provider published: false description: Why serious AI agents need a provider-agnostic architecture, model routing, fallback, and a unified API gateway. tags: ai, llm, agents, architecture Your AI Agent Should Not Be Locked to One LLM Provider Most AI agent prototypes start the same way. You pick one model provider. You install one SDK. You write a few prompts. You add tool calling. You build a demo. It works. Until it does not. The moment you want to try another model, reduce cost, add fallback, improve latency, or support different task types, your simple agent starts turning into a messy collection of provider-specific logic. That is when you realize something important: A real AI agent should not be locked to one LLM provider. If you are building a personal AI agent, coding assistant, research assistant, internal workflow agent, or AI-native product, the model should be replaceable infrastructure — not a hardcoded dependency. The Problem with Single-Provider Agents A simple agent architecture often looks like this: CopyUser ↓ Agent ↓ One LLM Provider ↓ Response This is fine for a proof of concept. But real-world agent systems need more flexibility. Different tasks often need different models: Task Better Model Strategy Quick summarization Fast, low-cost model Complex coding Strong coding model Long document analysis Long-context model Reasoning-heavy planning Reasoning model Multilingual writing Model strong in that language Background automation Cheap and reliable model Production fallback Backup provider If your agent is deeply coupled to one provider, every optimization becomes harder. You cannot easily answer questions like: What happens if the provider is down? What if latency spikes? What if another model is cheaper for simple tasks? What if a new model is better for coding? What if a user wants Claude for writing but GPT for structured reasoning? What if you want to route Chinese tasks to a different mod

One of the first networking concepts that confused me was this: Why does a computer need both a MAC address and an IP address? At first glance, they seem to solve the same problem. Both appear to identify a device. Both show up in networking tools. Both appear in packet captures. So why do we need two different addresses? While exploring Linux networking tools and Wireshark, the distinction finally started making sense. This article summarizes the mental model that helped me understand the difference. Looking Inside the Machine Before discussing addresses, it helps to understand where they come from. If you open a typical laptop, you will usually find components such as: Battery RAM Storage Processor Cooling system Network interfaces One of those network interfaces is typically: A Wi-Fi card An Ethernet controller These components are responsible for network communication. They are the parts of the machine that actually send and receive data across a network. Every Network Interface Has an Identity A network interface needs a way to identify itself. This is where the MAC address comes in. A MAC address is associated with a network interface card (NIC). Example: ```text id="q3d9nm" 2C:9C:58:8B:2D:7B Think of it as the identity of the network interface itself. Not the operating system. Not the browser. Not the application. The network hardware. --- ## What Is a MAC Address? MAC stands for: **Media Access Control** A MAC address operates at the **Data Link Layer** of the OSI model. Its primary purpose is to help devices communicate within a local network. Examples include: * Laptop to router * Router to switch * Switch to printer In other words: > MAC addresses help devices find each other on the same local network. --- ## What Is an IP Address? An IP address serves a different purpose. Example: ```text id="g8x4tc" 192.168.1.20 or ```text id="v6u7mz" 2405:201:8000::1 IP addresses operate at the **Network Layer**. Their job is to identify where a device exists within a

Quiet Defaults, DNSSEC Cracks, and Agents in the Data Plane I read the AWS Nitro V6 TCP timeout change twice before I believed it. Default went from 432,000 seconds to 350 seconds. Five days to six minutes. On the newest instance family. Quietly, in release notes most people won't read until something breaks. That sort of set the tone for May. No flagship launch to anchor the month around. What there was a lot of: defaults moving in places vendor press releases don't celebrate. Post-quantum crypto pushing into campus boot chains. Every cloud vendor shipping some flavor of agentic-networking pattern. The .de TLD briefly breaking because of DNSSEC. None of it announced loudly. All of it the kind of thing that breaks production at 2am if you weren't paying attention. What Moved This Month Three things, fast. Post-quantum crypto left the VPN tunnel. Cisco's full-stack PQC for campus and branch is the next chapter after April's PQ IPsec story — boot, firmware signing, supply chain attestation, and transport-layer crypto all moving together. If your campus has mixed-vintage gear (which is basically everyone), this is multi-year partial coverage with no clean switchover. Agentic networking became a real category. Cloudflare's Town Lake / Skipper writeup and Claude Managed Agents , Palo Alto's Portkey-based unified AI Gateway , and AWS's Bedrock AgentCore connectivity patterns all dropped this month. The right question stopped being "can my agent reach the model" and became "what IAM blast radius does this agent have if it gets prompt-injected." DNSSEC had a rough month. The .de TLD broke briefly, the DNSSEC root key was rolled, and Cloudflare also debugged a QUIC CUBIC death spiral that was hiding in plain sight. The Internet's core had a louder month than usual, and not in a good way. 1. Agentic AI Is Now Actually A Networking Problem An agent in production isn't a fancy chatbot. It's a thing that calls APIs, reads logs, accesses SaaS data, and sometimes writes back to sy

The signal hidden in this week's GitHub trending Two agent-shaped repositories cracked the daily GitHub trending board this week. The first is mvanhorn/last30days-skill , a Claude-style skill that researches a topic across Reddit, X, YouTube, Hacker News, and Polymarket, then synthesizes a grounded summary. The second is NousResearch/hermes-agent , billed as "the agent that grows with you" — a persistent agent runtime that compounds context across sessions. Both ranked the same week. Both are skill-shaped: a manifest, a trigger, a set of instructions, and a runtime expectation. This is the first time I have seen two skill repos chart simultaneously on GitHub trending. Most observers will treat them as cool side projects, fork them, star them, and move on. They are cool side projects. They are also a phase transition that the agent ecosystem has been edging toward for nine months. By Q4 you are going to wish you had read this signal in early June, because the dependency-graph problem about to land in production agents is the same one the npm ecosystem ran into between 2011 and 2018 — except faster, less tooled, and with a much larger blast radius. This post is about that phase transition. The benchmark coverage of skills is everywhere; what you cannot easily find is a working operational model for managing them at fleet scale. I am going to give you one. What actually shipped this week Let me anchor on the facts before I extrapolate. last30days-skill (mvanhorn) is a single skill bundle. Its SKILL.md tells the host agent: when the user asks for recent news, controversy, or sentiment on a topic, run a structured multi-source fetch — eight queries minimum, across five platforms, with a freshness window of 30 days — then synthesize. The skill ships with prompt scaffolding, query templates, and a synthesis rubric. It is roughly 600 lines including instructions and helper scripts. Installation is a git clone into your skill directory, no package manager, no version negotia

If you run Aviatrix on Azure, there is a slow-moving infrastructure change happening underneath your gateways right now that is worth paying attention to. Microsoft started rolling out a new generation of network hardware on May 26, 2026, called MANA (Microsoft Azure Network Adapter). For most Azure workloads, the change is invisible. For network virtual appliances (NVAs) like Aviatrix gateways, it is not, and Aviatrix has issued a field notice ( FN-2026-AZ-001 ) telling customers to take action. What is MANA and Why is Microsoft Rolling it Out? For roughly a decade, Azure VMs with Accelerated Networking enabled have used Mellanox-based NICs exposed to the guest as mlx4/5 SR-IOV adapters . SR-IOV (Single Root I/O Virtualization) lets the VM talk to the network card hardware directly, bypassing the hypervisor's virtual switch. This is what gives Accelerated Networking its low-latency, high-throughput characteristics. Microsoft has been quietly building its own in-house networking silicon. MANA is the result: a Microsoft-designed network adapter that replaces the Mellanox hardware Azure has been using on the host side. From an Azure customer's perspective, MANA preserves Accelerated Networking semantics, but the device the guest OS sees is different. The driver is different. The interface name is different. And that is where Aviatrix gateways run into trouble. Why Aviatrix Gateways Are Affected Aviatrix gateways are not generic VMs. They run a custom data plane that binds tightly to the underlying NIC for performance reasons. Specifically, the gateway image expects the Mellanox driver to be present and operational. On MANA hardware, that driver is no longer in play, and the gateway image does not yet include a MANA-aware driver. Per the field notice, the symptom is intermittent performance degradation rather than an outright outage. That makes it harder to detect: throughput drops, latency spikes, or session resets that look like noise can be the early signs of a gate

A2A has become like a standard for enabling agent to agent communication, we could use the a2a-sdk for running and configuring the a2a server and its features such as agent card, agent skills, agent executor, request handler etc. However we are going to go with a simplified approach here with strands where the agent card will be fetched automatically. Let's get started! Server Initialize a uv project for the a2a server and switch to that directory. uv init ~/strands-a2a-server cd ~/strands-a2a-server Add the required packages. uv add python-dotenv == 1.2.2 strands-agents[a2a] == 1.42.0 Change the code in main.py to look like below. $ cat main . py from dotenv import load_dotenv from strands import Agent from strands.multiagent.a2a import A2AServer load_dotenv () def main (): agent = Agent ( callback_handler = None , description = " A sample strands agent " , model = " us.amazon.nova-micro-v1:0 " , ) a2a_server = A2AServer ( agent = agent ) a2a_server . serve () if __name__ == " __main__ " : main () I like the simplicity here, as you see above, it's quite simple to start a basic a2a server from with in strands, with just a couple of lines of code, we didn't have to install the a2a-sdk separately. Run the code, to start the a2a server. $ uv run main.py INFO: Started server process [18006] INFO: Waiting for application startup. INFO: Application startup complete. INFO: Uvicorn running on http://127.0.0.1:9000 (Press CTRL+C to quit) Client Let's now do the client part on a separate terminal. Initialize the project and switch the directory. uv init ~/strands-a2a-client cd ~/strands-a2a-client Modify main.py code to look as follows. import asyncio from strands.agent.a2a_agent import A2AAgent async def main (): agent = A2AAgent ( endpoint = " http://localhost:9000 " ) agent_card = await agent . get_agent_card () print ( " Invoking remote agent with agent card: " ) for key , value in agent_card : print ( key , " : " , value ) print ( ' - ' * 20 ) while True : prompt = input

The Problem If you've ever audited your Windows network traffic during a boot-up sequence, you know the truth: there's a "blind spot." Between the moment your network drivers initialize and your VPN/WireGuard tunnel actually establishes, your traffic is leaking. Many third-party solutions exist, but they are often bloated, use proprietary binaries, or act as black boxes. I wanted something transparent, native, and bulletproof. The Solution: WG-KillSwitch I developed a pure PowerShell-based kill switch architecture. It doesn't rely on third-party libraries—it uses native Windows system components to enforce security. Key Architectural Features: Zero-Trust Firewall Matrix: Hardens the system by blocking all outbound traffic by default, allowing only authenticated tunnel traffic. WMI Persistent Watchdog: Unlike standard scripts that can be killed via Task Manager, this project uses WMI Event Subscriptions. If the watchdog process is terminated, Windows itself immediately respawns it. Resilience: Survives hard reboots, modem resets, and Windows service cycling. Resilience & Leak Testing I've put this through a gauntlet of tests: Forced Reboots: Zero leaks detected during driver load. Process Termination: The WMI engine restores the protection in milliseconds. Dynamic Network Resets: The firewall matrix remains active regardless of adapter status. Let's Collaborate This is open source, transparent, and built for the community. I'm looking for security audits and feedback. Check out the source code, open an issue, or submit a PR: https://github.com/ryderlacin-pixel/Windows-WireGuard-KillSwitch

These 5- to 6-inch blades are the secret workhorses of the kitchen, whether you’re a smaller person, have smaller hands, or just desire a smaller but still high-functioning knife.

If you've been running local models/apps across more than one machine for any length of time, you've probably noticed that everything is served over plain HTTP, whether its the backend llm apis, the front end sites, or whatever other stuff you've tossed in: most of it is HTTP-only out of the box, no TLS option anywhere in sight. On one machine thats usually fine since its all loopback, but the second you spread apps across a few different computers ( which some of us do ), every prompt and every response starts crossing your LAN in plaintext. Is plaintext on your own LAN a huge deal? Honestly... a lot of folks would say it's probably low risk. But the moment you've got guests, other people's phones, or random IoT junk sharing that network, your prompts and the models responses flying around in the clear are more exposure than you'd probably be comfortable with if you sat down and thought about it. So, with that said- I figured Id write up how I've dealt with that, because the textbook answer ( certs ) is annoying enough on a local network that I think a lot of folks just dont bother. This is a lot easier, especially on something like a mac where you can make sure it kicks off automatically via launchd . Why not just do TLS The "correct" answer is to put TLS on everything; HTTPS everywhere. And you can. But walk through what that actually means on a home network full of mixed machines: You stand up your own little CA, then sign a cert for each host ( unless you want to deal with some code just straight up rejecting the cert ). You install and trust that CA on every client. Every browser, every OS trust store, and ( this is the annoying one ) every app that ships its own trust store and ignores the system one. Plenty of python and node apps do that. A lot of these local LLM apps dont even expose a TLS option, so to add it you front them with something like nginx or Caddy, which is now another moving part on every box ( Setting up Caddy is what convinced me to go this

The ghost is not you. But it echoes you. What survives beyond scattered archives? Beyond exported conversations and curated bookmarks? The stuff we never think to preserve: the photos that show how you see the world. The correspondence that maps who matters to you. The Long Echo toolkit has grown. PTK for photos. MTK for mail. But these are sources, not destinations. The destination is something stranger: longshade , a persona built from your data that can respond to questions you never answered. I'm going to invert the usual pattern here. Instead of tools first, philosophy later, I want to start with the philosophical destination and work backward to the data that feeds it. longshade: The Ghost That Speaks The Central Question What if your archive could respond? Not a chatbot trained on your data. Not a digital resurrection. Something more careful: a voice that carries your patterns, your interests, your way of seeing the world. That's longshade. Right now it's spec-only (no implementation yet). It defines what it would mean to synthesize a conversable persona from personal archives. The Ghost Metaphor "The ghost is not you. But it echoes you." This framing matters. longshade isn't about immortality or resurrection. It's about preservation with a kind of agency. The echo can answer questions you never answered, using patterns you established. It speaks in your voice without claiming to be you. The distinction is important: Resurrection claims to recreate the person Simulation claims to predict the person Echo acknowledges it carries patterns, not identity An echo is honest about what it is. It responds because you left enough traces to inform a response, not because it is you. Voice vs. Personality longshade extracts voice , not personality. Your actual phrases. Your vocabulary. Your reasoning patterns. Your recurring metaphors. The way you explain things, not the things you might explain. I noticed something working with conversation archives: user messages are th

Kubernetes networking is one of the most misunderstood parts of running containerized workloads. A pod can reach another pod by IP — but why does that stop working after a deployment? A service exists and resolves in DNS — but traffic isn't arriving at the application. An Ingress resource is configured — but requests return 502. These puzzles are common and they stem from the same root: Kubernetes networking has several distinct layers, each solving a different problem, and it's easy to conflate them. This article walks through how Kubernetes networking actually works at each layer — from pod networking to services to Ingress to network policy — so the next time something breaks, you have a mental model to reason from. The fundamental promise: flat pod networking Kubernetes makes one core promise about networking: every pod can communicate directly with every other pod in the cluster without NAT. Every pod gets a real IP address from the cluster's pod CIDR range, and those IPs are routable between pods regardless of which node they're running on. This is not something Kubernetes itself implements. It's a contract that every Kubernetes-conformant CNI (Container Network Interface) plugin must fulfill. When you install Calico, Cilium, Flannel, Weave, or any other CNI, you're installing the component that actually creates this flat network. The mechanism varies — Flannel uses VXLAN overlays, Calico can use BGP for direct routing, Cilium uses eBPF — but the result is the same: pod-to-pod communication without NAT. Here's what a pod's network namespace looks like: $ kubectl exec -it my-pod -- ip addr 1: lo: ... 3: eth0@if12: ... inet 10.244.1.15/24 brd 10.244.1.255 scope global eth0 $ kubectl exec -it my-pod -- ip route default via 10.244.1.1 dev eth0 10.244.0.0/16 via 10.244.1.1 dev eth0 The pod has an IP ( 10.244.1.15 ) on a /24 subnet. The node this pod runs on has an IP from the same range — or a different /24 within the same /16. Traffic from this pod to 10.244.2.8 (

If you're a networking instructor — at a university, technical college, boot camp, or corporate training program — you know the frustration of teaching the OSI Model. Static PowerPoint slides can only do so much. Students nod along in class, but when exam time arrives, the layers blur together. The PDU names become a confusing jumble. The OSI Model Simulator by Roboticela was built with educators in mind. It transforms a passive lecture into an interactive demonstration that students engage with, remember, and take home to explore on their own. Classroom Use Cases Live Demonstration Project the simulator on a classroom screen. Have students suggest messages to send and protocols to use. Step through each layer together as a class, stopping to ask questions: "What's happening here? What header was added? What device would operate at this layer?" The interactive format maintains attention far better than any lecture. Lab Assignments Assign students to run specific simulations and document their findings: "Run HTTP and HTTPS simulations. Screenshot the Presentation Layer for each. Explain in writing what differs and why." This assignment tests both tool usage and conceptual understanding. Flipped Classroom Send students to app.osi-model-simulator.roboticela.com before class. Ask them to run three simulations and come prepared to discuss what they observed. Class time becomes richer discussion rather than basic concept delivery. Protocol Comparison Exercise Have students run simulations for all five protocols — HTTP, HTTPS, SMTP, DNS, FTP — and create a comparison chart noting the differences at each OSI layer. This develops deep protocol literacy that traditional instruction rarely achieves. Why It Works: The Science of Active Learning Research in educational psychology consistently shows that active learning produces dramatically better retention than passive instruction. The "Learning Pyramid" (Edgar Dale's Cone of Experience) suggests: Lecture: ~5% retention after 2

Networking certifications like CompTIA Network+ and Cisco's CCNA are career-defining credentials. They validate your understanding of networking fundamentals — and both exams test OSI Model knowledge extensively. In fact, the OSI Model is arguably the single most tested conceptual framework in entry-level and intermediate networking certifications. Why OSI Is So Critical for Certification Exams Exam questions on OSI take many forms: "At which layer of the OSI model does a router operate?" (Layer 3) "What PDU is used at the Transport Layer?" (Segment) "Which protocol operates at the Application Layer?" (HTTP, DNS, SMTP...) "A user cannot connect to a website. Troubleshooting should begin at which OSI layer?" (Layer 1, then up) "Which device operates at Layer 2?" (Switch) "What is the function of the Presentation Layer?" (Translation, encryption, compression) These questions seem straightforward on paper but are notoriously confusing under exam pressure without deep conceptual understanding. How the OSI Simulator Accelerates Your Studies Visual Memory Formation Research in cognitive science consistently shows that visual and kinesthetic learning creates stronger memories than text-only reading. When you watch the OSI Simulator animate your message through all seven layers, you're forming episodic memories — vivid, experience-based memories that are far more durable than rote memorization. Protocol-to-Layer Association One of the most commonly missed exam categories is protocol-to-layer mapping. The OSI Simulator makes this automatic: when you select HTTP, the Application Layer is highlighted. When you watch TCP headers form, you associate TCP with Layer 4 viscerally, not just verbally. PDU Name Mastery Data, Segment, Packet, Frame, Bits — the five PDU names are shown explicitly at each layer in the simulator. After running 10 simulations, these names become second nature. No flashcard can match this experiential learning. Troubleshooting Framework Practice Network+ an

Getting started with the OSI Model Simulator takes less than 60 seconds. The interface is thoughtfully designed to be intuitive for beginners while offering enough depth to satisfy advanced learners. Here's your complete step-by-step guide. Step 1: Open the Simulator Navigate to app.osi-model-simulator.roboticela.com in any modern web browser. No account required, no download necessary, and no cost. The app loads instantly and is ready to use immediately. Alternatively, visit the landing page to learn more about features and download the desktop app for offline use. Step 2: Enter Your Message In the message input field, type any text you like. This is the "data" your simulation will encapsulate. Examples: Hello, World! GET /index.html HTTP/1.1 {"user": "alice", "action": "login"} Your own name or a phrase you'll remember Using a personally meaningful message makes the encapsulation feel real rather than abstract. Step 3: Choose Your Protocol Select from five real protocols: HTTP, HTTPS, SMTP, DNS, or FTP. Each choice changes the Application Layer headers added to your data. For beginners, start with HTTP. Then re-run with HTTPS to see the Presentation Layer encryption difference. Step 4: Choose Your Transmission Medium Select your Physical Layer medium: Ethernet, Wi-Fi, Fiber Optic, Coaxial, or Radio. This affects how the Physical Layer is visualized at the end of the simulation. Step 5 (Optional): Set Custom IP Addresses For a more realistic Network Layer demonstration, enter a source IP address (simulating your device) and a destination IP address (simulating the server). This makes the Layer 3 packet header concrete and personally relevant. Step 6: Run the Simulati on Click the Run or Start button. Watch as your message travels through all seven layers: Application Layer adds protocol headers Presentation Layer adds encryption (if HTTPS) Session Layer adds session management Transport Layer segments and adds TCP/UDP header Network Layer wraps in IP packet Data Li

The Physical Layer's choice of transmission medium profoundly affects the performance, cost, security, and reliability of a network. The OSI Model Simulator supports all five major media types — making it a powerful tool for understanding how physical choices ripple up through all seven OSI layers. Medium Speed Max Distance Security Cost Ethernet Up to 10 Gbps+ 100m (Cat6a) High (physical access) Low Wi-Fi Up to ~9.6 Gbps (Wi-Fi 6) ~100m indoor Medium (WPA3) Low Fiber Optic Terabits/s 100s of km Very High High Coaxial Up to 1 Gbps 500m (RG-8) Medium Medium Radio Variable (5G: Gbps) km to global (satellite) Low–Medium Variable Ethernet: The Reliable Standard Ethernet is the dominant wired networking standard in homes, offices, and data centers. Using twisted-pair copper cables (Cat5e, Cat6, Cat6a), it provides reliable, high-speed connectivity with predictable latency. The IEEE 802.3 standard governs Ethernet, and modern variants include 1GbE, 10GbE, 25GbE, 40GbE, and 100GbE. Wi-Fi: Wireless Freedom Wi-Fi (IEEE 802.11) eliminated the need for physical cables in most consumer settings. Wi-Fi 6 (802.11ax) and Wi-Fi 6E deliver impressive speeds, but shared medium access, interference, and radio propagation challenges mean it will never fully replace wired Ethernet for critical applications. Fiber Optic: The Internet's Backbone Fiber optic cables carry data as pulses of light through glass or plastic strands. They're immune to electromagnetic interference, support enormous bandwidth, and can span continents — literally. Every major internet exchange, submarine cable, and data center interconnect uses fiber. Coaxial Cable: The Cable TV Legacy Coaxial cable — familiar from cable TV connections — consists of a central conductor surrounded by insulating layers and a braided metal shield. DOCSIS-based cable internet connections (common from ISPs like Comcast) use coaxial as the last-mile medium. Radio: Wireless at Scale From the cellular 5G network in your pocket to satellite

I run a transparent OPNsense bridge between a UniFi Dream Machine Pro and the rest of my LAN. It is deliberately boring at Layer 3: the UDM keeps routing, DHCP, DNS, firewall policy, WAN handling, and VLAN definitions. OPNsense sits inline as a Layer 2 bump in the wire. The interesting part is that both sides of that bump use LACP . I already wrote the build/configuration guide for this setup here: Building a Transparent LAGG (LACP) Bridge with OPNsense, UDM, and UniFi - A Practical Guide . That article explains how the bridge was built, how the LAGG devices were configured, and why I wanted the firewall to remain transparent. This article is the other half of the story: what happens when that kind of setup fails in a non-obvious way. Not a clean outage. Not a single "the network is down" moment. Just enough instability to make everything feel wrong. 1. Topology and Failure Surface The topology looked like this: +----------------------+ | UniFi Dream Machine | | kantharos-udm-pro | +----------+-----------+ | LACP aggregate, 2 x 1G | OPNsense lagg0 "ingresslagg" igc1 + igc2, LACP | +----------v-----------+ | OPNsense bridge0 | | "laggbridge" | +----------+-----------+ | OPNsense lagg1 "egresslagg" igc4 + igc5, LACP | LACP aggregate, 2 x 1G | +----------v-----------+ | UniFi USW-Lite-16 | | downstream LAN | +----------------------+ On OPNsense, the relevant interfaces were: igc1 + igc2 -> lagg0 -> ingresslagg -> toward UDM igc4 + igc5 -> lagg1 -> egresslagg -> toward USW lagg0 + lagg1 -> bridge0 -> laggbridge The bridge is a FreeBSD bridge. The aggregates are FreeBSD lagg(4) interfaces using LACP. OPNsense exposes those through its Interfaces > Devices UI. The expected healthy OPNsense state is: laggproto lacp status: active laggport: igcX flags=<ACTIVE,COLLECTING,DISTRIBUTING> laggport: igcY flags=<ACTIVE,COLLECTING,DISTRIBUTING> Those three member states matter: ACTIVE : the member is participating in the LACP bundle. COLLECTING : the member may receive traffic. DIS