Craig Leres

Craig Leres, a hardware, operating systems, and networking engineer in the Berkeley Lab Computing Sciences Area’s Scientific Data Division and the Lab’s Cyber Security Group, is retiring this July after 40-plus years at the Lab.

As with many Berkeley Lab retirees, however, Leres doesn’t expect to stray too far from the Lab and the many networking and cybersecurity projects he’s pioneered and shepherded over four decades. Even an abbreviated list of his accomplishments is impressive:

• As part of the Network Research Group (NRG), he was one of the original developers of several fundamental network tools still used today, including tcpdump, libpcap, and traceroute.
• As a volunteer in the Computer Systems Research Group, his contributions to the Berkeley Software Distribution (BSD) operating system included system tools, network device drivers, and the kernel networking stack. BSD was an important operating system in the evolution of Unix, and its descendants – including FreeBSD, OpenBSD, NetBSD, and DragonFly BSD – remain in wide use.
• He is responsible for installing and managing a number of servers at Berkeley Lab to enable critical networking tools, including DHCP (Dynamic Host Configuration Protocol), DNS (Domain Name System), and NTP (Network Time Protocol).
• He modified the machines that provide the DNS, NTP/time, DHCP, and Nagios network monitor services so they could use IPv6, which was introduced in the late 1990s to remove addressing restrictions imposed by IPv4. He also modified the web and FTP servers used to share NRG tools, data, and software with researchers, developers, and other IPv6 internet users.
• He built and operated many of the Lab’s Network Operations servers and services that run on them and is often consulted when there are questions about how certain key servers and services work, how FreeBSD system administration tasks are performed, and general programming techniques.

“It wasn’t until a few years ago that I realized there are dozens of software packages I wrote that people now use all the time,” he said. “It’s kind of fun sometimes when I talk to tech support and tell them that yeah, I worked on tcpdump and traceroute.”

A Family Legacy

Berkeley Lab was part of Leres’ life even before he became part of Berkeley Lab. When he was growing up in the 1970s, his father Richard was a member of the Lab’s Engineering Division, and Craig was intrigued early on by the scope of what the Lab did and his father’s contributions to it.

“In the summer of 1978, I was going to Skyline High School in the morning and then taking the bus to the Lab and working with the engineering group in the afternoon,” he said. Computers didn’t have clocks back in those days, and his dad had designed a circuit to allow data that was being collected to be time-stamped. “So I built some module prototypes, and the shops at the Lab built a couple more.”

His efforts that summer led to a student intern position the following year, where he was involved with the Real Time Systems group helping to support the Lab’s Digital Equipment Corp. (DEC) computers and, later, the Sun Microsystem computers.

“I’d go out on calls with the technicians when they would try to get some of the big DEC machines running again,” Leres said. “It was very important to ensure the uptime on systems like the PDP 11/45 to keep the particle accelerators running.”

In the early 1980s, he joined the NRG, working closely with computer networking pioneer Van Jacobson. Among other things, Jacobson introduced him to the inner workings of the Berkeley Unix operating system and the Unix kernel network stack, which led to his involvement in the development of the TCP/IP protocol and multiple NRG networking tools. Shortly after that, he earned a degree in Computer Science from California State University Hayward.

Over the years, Leres has built a wide-ranging reputation as a networking and cybersecurity expert across Berkeley Lab and beyond. In the 1990s, his contributions to network packet capture and packet distribution were instrumental to the development of the Bro network security monitor (now known as Zeek) by Vern Paxson at Berkeley Lab. Leres’ leadership and expert technical knowledge fostered Berkeley Lab Cyber Security’s Bro/Zeek cluster, which divides network traffic and delivers it to multiple Bro instances. This was a critical architecture innovation that enabled Bro to monitor the high-bandwidth connections required for scientific data applications, and today Bro is broadly used outside Berkeley Lab, including across the Department of Energy.

In 2010, Leres created the internal onestop.lbl.gov resource to provide cybersecurity analysts and help desk personnel at the Lab an easier and faster way to consult multiple online resources as part of their normal workflow. Previously this information was scattered across a number of network operations and cybersecurity systems. Now, using onestop.lbl.gov, they can quickly obtain a single report for a specific IP address, with details such as DHCP lease status, cybersecurity address block status, and IP address contacts and location.

“I’ve always been kind of a conduit between network operations and cybersecurity,” he said.

“Craig has impacted the way Berkeley Lab engages in open science in a fundamental way,” said Deb Agarwal, who recently retired from her position as SciData Division director. “He has created a number of technologies that facilitate the high level of excellence provided by the networking and cybersecurity groups. The resulting innovative network architecture with dynamic network blocking provides an environment that promotes the kind of open science collaboration that maintains Berkeley Lab as one of the top science laboratories.”

Multiple Mentors, Next Steps

In addition to Jacobson and Paxon, Leres credits several other people who have influenced his career, including Sally Floyd and Steve McCanne of the NRG; Jay Krous, who leads the Lab’s Cyber Security team; and Bill Johnston, former ESnet director who retired in 2008.

“Around 1999, when everyone left the NRG except me, they kind of merged me into the Distributed Systems Department that Bill was running, and I have to say he is easily the best boss I’ve ever had,” Leres said. “You could discuss a problem with him and he might have a preconception or a solution he favored, but if you presented a strong technical argument you might completely flip his position.”

Looking ahead, Leres plans to continue his affiliation with the Lab and work on multiple open-source projects, including FreeBSD (he’s been a contributor and ports committer for years), various ports he maintains or helps support, and even the Open Vehicles project that is working to help users access data about their car – such as location and fuel or battery charge status – from their phones.

In the meantime, while he’s looking forward to having more time for vacation and travel, he already misses interacting with co-workers on a regular basis.

“Prior to the pandemic, we would usually have 90 minutes of cyber meetings on Tuesday mornings, then it was common practice for us to go downtown and get lunch. That was a lot of fun,” he said. “Maybe I’m not the most adventurous with food, so I appreciated having people open me up to restaurants and types of food that maybe I wouldn’t have gone after myself.”

“I really have enjoyed working with a lot of smart people who know things I don’t know,” he added. “There’s this culture I’ve only really experienced at the Lab: if someone asks a question, if there is something that somebody doesn’t know, there is always time to take a minute to answer them.”