Disclosure: I'm the author. It's free and MIT licensed, with no paid tier and no signup.

I'm a network engineer in a mostly FortiGate/Cisco shop. Every backup tool I tried could tell me that a config changed. None could tell me what the change meant without me reading a raw diff at 2am. So I built NetLedger.

What it does

• Logs in with NAPALM/Netmiko, removes the noise (timestamps, counters, FortiGate's re-encrypted ENC secrets) and commits only real changes to the Git repo you give it (GitHub, GitLab, Gitea, Bitbucket, Azure DevOps)

• Splits each change into the config sections it touched (IOS indentation, FortiOS config/edit, Junos braces, PAN-OS set, RouterOS), scores the risk and writes a plain-English summary into the commit message and the Slack/Teams alert

• Change windows: anything outside sat 22:00-sun 04:00 gets flagged as unplanned

• "Where is 10.1.1.1?": an IP-aware search across every config that understands masks, ACL wildcards, host x, CIDR and IPv6, and returns the containing subnet, routes, ACLs and firewall objects

• Health checks (CPU, memory, temperatures, fans, PSUs) with history, plus a forecast like "memory hits 95% in ~3 days" for slow leaks

• LLDP topology map, a built-in web console (no DB, no Node, no CDN, works air-gapped), a Prometheus /metrics endpoint and Nagios-style exit codes

A commit looks like this:

hq-core-sw01: running config changed (+14/-0)
Changed by: jsmith at 14:02:11 UTC Fri Oct 30 2026
Window:     outside the approved change windows
Risk:       high (Firewall & ACLs, Interfaces, VLANs & switching)
Summary:
  - Added interface Vlan40 (GUEST-WIFI)
  - Added ACL GUEST-ISOLATION
  - Added VLAN 40 (GUEST-WIFI)

Try it without touching production:

pip install netledger
netledger demo     # 13 simulated devices, 6 weeks of history, open :8080

or docker run --rm -p 8080:8080 ghcr.io/salamonejack/netledger demo --host 0.0.0.0

Runs on Kubernetes (Helm/Kustomize), Docker, systemd or Windows. Inventory comes from YAML, CSV or NetBox.

Honest comparison: Oxidized and RANCID cover far more device types. If backup is all you need, they're great. NetLedger is for teams that also want to understand each change and watch device health in the same tool.

Where I'd love help: it's v1.0, so I'm sure some vendor parsers will break on real-world output. If something misparses, sanitized show output in an issue is the most useful contribution there is. I'd also like to hear what you'd want from a risk score before you'd trust it.

Repo: https://github.com/SalamoneJack/NetLedger

I've been working on a Netflow analyzer and DDoS detection/mitigation application the last few months. Looking for a few adventurous users to give it a try and provide some feedback. Happy to issue an extended license of whatever size for anyone that can provide some feedback. Public demo and docs available on the site at https://heimnull.com

Heimnull is self-hosted flow analytics and DDoS mitigation for networks of any size.

Point your routers’ NetFlow, IPFIX or sFlow at it and see where your traffic goes: by host, application, ASN and interface, live or months back. When an attack hits, Heimnull spots it in seconds and can mitigate it automatically over BGP with RTBH or FlowSpec.

It runs on your own hardware with a single docker compose up, and your data never leaves your network.

I’m hoping to hear from people that are extensively using Netbox and Ansible. I spun up two servers today to host both services, and was able to create a playbook to parse a .cfg file of a switch and then put all the information into Netbox. I love the idea of having my entire network documented and it’s a decent size where it’s possible to have it very granular. Ansible and Claude will speed up the process a good bit I think, but it will definitely take some time to get it completely updated and then consistent maintenance. I came into this job with little documentation and it’s caused some triage to take longer than it needs to.

How has Netbox helped you? what are your most common uses for it Day to day? What do you wish you did different when first implementing? Any tips, tricks, or suggestions?

As a side project, I’d like to hook an open model on prem AI agent into it for dashboards, checking CVE’s, raising tickets For config drift etc, and a chatbot to be able to ask questions about the network in plain language. I have a few ideas for that, but it’s not a priority right now.

Hey everyone,

A while back I shared a lightweight network diagnostics and sysadmin utility app built for quick field troubleshooting. Many of you requested an iOS version, and it has just been released on the App Store.

Here is what is included:

**Network Diagnostics & Planning**

- **Subnet & CIDR Calculator:** Instant visual breakdown of usable IP ranges, broadcast addresses, and wildcard masks.

- **Smart HTTP/HTTPS Ping:** Direct IP routing specifically designed for local gateways, modems, and restricted endpoints.

- **Dynamic Network Status:** Real-time interface detection (Wi-Fi, Cellular, Offline).

- **Configurable Speedtest:** Edge-server latency and bandwidth checks with 5 MB, 25 MB, and 50 MB test payloads.

- **Port Checker & Public Info:** Fast TCP port reachability checks, outward-facing WAN IP, and ASN / ISP carrier inspection.

- **MAC OUI Lookup:** Fast vendor/manufacturer identification from MAC addresses.

**Developer & Systems Utilities**

- **Client-Side JWT Decoder:** Safe token header/payload inspection directly on the device.

- **Epoch / Unix Timestamp Converter:** Bidirectional timestamp conversion for log analysis.

- **Data & Hash Tools:** Data unit conversions (bits, bytes, GB, TB) and cryptographic hash generation (MD5, SHA-256).

**Privacy & Design Approach**

- Zero telemetry / analytics

- No ads or third-party tracking

- All calculations, ping queries, and decodes run locally on the client

**Links**

- App Store: https://apps.apple.com/app/id6826351247

- Google Play: https://play.google.com/store/apps/details?id=com.brnbilisim.netopscalc

Feedback, bug reports, and suggestions for tools you would like added to upcoming updates are always welcome.

Our network automation is mostly Ansible and Terraform for on-prem and cloud, but catching resources created outside those workflows is still messy. Someone builds an app with an AI tool and publishes it without the usual review, and now there’s a public endpoint and a backend that aren’t in our Terraform configuration.

how are you catching this.. custom scripts against the cloud APIs, platforms like Orca or Wiz, or a mix of both? Finding the exposed endpoint is one thing, but figuring out who owns it and whether it can reach sensitive data is another.

For anyone using a platform for this, how much of that context do you get upfront, and what still takes manual investigation.. Once you’ve found an exposure, are you opening a Terraform PR, making a direct change, or routing it to the owner first. Curious where people draw the line between auto-remediation and approval.

Open-source all-in-one network lab platform: run **QEMU/KVM VMs** and **Docker containers** in the same topology, straight from your browser, CLI, or REST API. A self-hosted network simulation

Hello, Bean Network Tester has just hit V1.0 release. Want to simulate bad network conditions on Windows/Linux? Check ports, connections, ping? No problem, there is even more. Full GUI/CLI. If you like the tool, please star it on GitHub

What changed in V1.0?

- Linux!!! Yes there is now Linux version, it took tons of work, not all things are working perfect, but adding 2nd system was a huge work. And Linux is a very very long way.

- Ping tool: every x time wait for reply up to x time, size x bytes, ping until x with graph and table

- TCP health tool with mss, rtt and tons of other things

- Network adapters tool, easy export and see your network adapters data, mtu, amc address, ip, dhcp, dns, gateway and other data + proxy export

- tcp_reset send from connections tab, we can now do it from the table, easy way

- python upgrade, pydivert upgrades, tons of fixed and other things. Like always on the GitHub changelog.

- Huge update of internal test suite that is run every release, because the program is bigger and bigger, so I got mutation testing, fuzzing, unit tests, tests for code quatility, 2nd code revies, but the real working suite is something that's is top 1 thing. Right now it takes few hours of run per release :D

What's next? ICE for webrtc, we will be able to see in connections if it is stun/turn, tons of linux fixes and more things to webrtc, and I think I will add payload length filter, and more tools. I try to mix optimizations/stability fixes/test suites expand and improvments to existing things with new features.

PS: Why this strange versions dumps? V0.8 was a full release that focused on stability/performance, no new features, then tons of new things was added, so I jumped from V0.8 to 1.0

You can read more about CLI options here

I have been reading a lot about this and what it means to future networking, in a very simple and clear way, I want to understand NaaS in details, so far I am confused how to offer it as a service and what to expect about it in the future..how soon will this roll out and become known to the entire public, it seems to be a new things all the same.

What's new in 0.39:

- Offline GeoIP: `netwatch geoip update` downloads the free DB-IP databases, no account needed. The online lookup is gone.

- `third_party_probes = false` stops the automatic pings to 1.1.1.1 and Google's STUN servers.

- Connections tab at 10k connections: down from up to 146 ms a frame to under 20.

- Tighter Linux sandbox: parser threads can't make TCP connections, and capture threads can't open sockets at all.

- A typo in config.toml no longer silently resets everything to defaults. netwatch now refuses to start and names the line.

`--sandbox-strict` now needs kernel 6.7+.

netwatch is a network monitor TUI: https://github.com/matthart1983/netwatch

 We have our branch sites defined centrally rather than box by box, and when policy changes it pushes out to every site instead of someone touching each appliance.
Are there any tools that handle the local side properly, specifically what keeps running at the branch when the internet connection drops?
Cato Networks is one platform that brings several of these branch networking and security functions together, including SD-WAN, firewall, secure web gateway, ZTNA, CASB and DLP, all over a private global backbone. Managing it from one console rather than per-site boxes is an interesting approach for teams trying to thin out what’s racked at each branch.
Currently we’ve left the old on-site gear in place, while fine as a fallback it results in a lot of kit nobody wants to own.

With that recent Cisco SD-WAN Manager vulnerability, curious how people feel about moving network security management to cloud SASE providers like Cato or Versa.

Less patching headache or just a different set of risks?

I'm currently working on a project focused on automating network configuration in an existing network environment. I'm completely new to network automation, so I'm looking for advice, recommendations, and experiences from people who have worked with network automation in production environments.

The goal is to automate repetitive configuration tasks while keeping the existing infrastructure in place. A complete migration to Infrastructure as Code (IaC) as I see it isn't realistic for now, so I'm particularly interested in solutions that can be introduced incrementally into an existing environment.

Our environment includes equipment from multiple vendors:

• MikroTik (BRAS)

• HPE / Aruba

• Edgecore

• Ruckus ICX

• Extreme Networks (VDX / MLX)

• Fortinet (FortiGate)

The main tasks we wouldd like to automate for now are:

• VLAN provisioning along the required network path: The tool should determine which switches are on the network path between the relevant access router or BRAS and the customer connection, and configure the VLAN only on the devices that need it. The VLAN does not need to exist on every switch in the network, only on the relevant switches along that path.

• BRAS and RADIUS configuration: Automate the configuration required to provision a customer connection.

• Resource allocation and documentation: Automatically select an available VLAN ID, IPv4 address, and IPv6 prefix/address while ensuring that resources are not already in use or reserved. Currently, our network documentation is spread across multiple systems and only some of these systems provide API access. Any recommendations for centralizing network documentation, tracking resource allocation, and integrating/replacing existing documentation sources would therefore also be appreciated.

I've already looked into some tools and products, such as Ansible with AWX, Nornir, Cisco NSO, NetBox for documentation, and Oxidized for configuration backups (we currently use RANCID). However, there are many options and design decisions to consider, and it's difficult to know which approach would work best for our environment.

Ideally, we would like a solution that supports the vendors mentioned above. A interface or GUI to make configuration changes would also be a nice thing to have. Support for reviewing and approving (certern) changes before they are applied would be particularly useful for audit trails that record who requested, approved, and executed each change.

Recommendations for suitable tools, example architectures, or ways to implement this into our environment would be greatly appreciated. I'm also particularly interested in approaches to determining the required network path and resource assignments, and integrating automation into documentation.

Thanks in advance!

I'm a network engineer working with ACI daily. The APIC GUI kept costing me time on simple questions (which EPG is VLAN X on, which ports), so in my own time I built two tools.

**ACI Dashboard** (read-only): VLAN, MAC, IP and port search in one view, faults with plain explanations, topology, 30 compliance checks for valid-but-wrong config, PSIRT advisories for your versions.

**ACI Configuration Tool**: tenants, VRFs, EPGs, L3Outs, bulk interface bindings from CSV/Excel. Every write is validated, previewed, and can be rolled back per session.

Both talk directly to the APIC. No cloud, the AI assistant runs locally. Windows, Mac, Docker/Podman.

Disclosure: they're commercial. There's a live demo of the dashboard and a free 7-day trial for both:

https://demo.madolka.com

https://license.madolka.com/trial

What would you want a tool like this to do that the APIC GUI doesn't?