Engineering Culture
Change Advisory Boards were built to coordinate business risk, not to validate engineering decisions. When approval becomes the primary safety mechanism, the same process that approves the outage stands between your engineers and the fix.
NetBox
I just want to see how something is physically wired. Previously, you had to drive to the datacenter and spend most of your visit stuck at the security desk, waiting for someone to find you on their screen and badge you into the room. I built net3d so I don&
I spent six months reading RFCs to build a global RSVP-TE backbone only I could safely operate. The engineers who replaced me ripped it out in a week. And they were right. We usually blame technical debt on rushing, budget pressure, poor documentation or laziness. The most dangerous debt I
The Motivation Julian Lucek and Nitin Vig from HPE/Juniper recently showed Claude Opus passing the JNCIP certification. Impressive but multiple-choice tests just prove a model memorized the BGP state machine not that it can actually build a network. I wanted to see if an agent could design and configure
In Part 1 we structurally isolated the Route Reflector onto its own compute. The brain was protected. But protecting the brain does not protect the body. That is exactly what this part is about. The natural next step is optimization: tuning Optimal Route Reflection (ORR) and maximizing RIB Sharding to
DDoS Defense
A DDoS attack almost ruined my 40th birthday. Not the party, but the infrastructure I was responsible for. Friends texted "happy birthday." Colleagues texted... differently. Even though they were kind enough to shield me that day, I couldn't stay on the sidelines. I watched our scrubbing
Network Automation
We have a massive problem in network engineering. I call it the "Safety Plateau." We reach a point where the network works. The configs are ugly. The route-maps are 3,000 lines long. The logic is spaghetti. But packets are flowing. So we stop. We don't
Network Automation
Last month I shared a screenshot of a single switch validation: 12 tests, 1.46 seconds. It was cool, but it was a toy example. Scaling that to a nearly 300-device fabric requires more than just a loop. It requires architecture. The obvious question is: "Why not just use
Segment Routing
The Challenge: When Granularity Is Your Only Option We were dealing with a legacy "beast" of a platform: a critical and systemic service running on traditional infrastructure, glued behind a single IP address. This IP hosted hundreds of distinct TCP ports, each representing different customers, protocols, and hard-wired
Segment Routing
When I think about our move from MPLS/LDP to MPLS/SR, I often compare it to switching from corned beef to wagyu - technically it's the same protein, but the experience is completely different. The Pain That Drove Us to Change I've spent years managing
Segment Routing
We love to lie to ourselves about redundancy. We configure BFD. We enable TI-LFA. We type commit. Then we sleep, assuming the network will heal itself in milliseconds. I recently spent days trying to prove myself wrong. Two years ago, I wrote about our migration to Segment Routing and our
Physical Layer
The Excavator Doesn't Care About Your Diversity We'd done everything right. Diverse and multiple fiber paths to our remote site. Different physical routes. Different carriers. Different entry points. Textbook diversity - real diversity, not just on paper. Then an improbable confluence of circumstances hit. Multiple failures,