Network Automation Scripts
Ready-to-run Python and Bash scripts for network engineers. Copy, edit your device list, and run.
ACL / Policy Security Analyzer
python · Security
Finds overly permissive and unreachable rules in ACLs and firewall policies across a mixed-vendor fleet. Checks whether each ACL is actually bound to an interface or VTY line, so a permissive rule that is live is rated HIGH while the same rule in an unused ACL is MEDIUM — the difference between an open door and latent risk. Also detects rules that can never match because an earlier rule already covers them, which is where stale permissions hide. Covers Cisco IOS/IOS-XE/IOS-XR/NX-OS, Juniper Junos filters, Arista EOS, FortiOS policies, and PAN-OS security rules.
Active Directory Security Auditor
python · Security
Connects to Active Directory via LDAP and audits for the most critical security misconfigurations: Kerberoastable service accounts (SPNs with user accounts), AS-REP Roastable accounts (no pre-auth), stale/inactive accounts with elevated privileges, users with Password Never Expires, AdminSDHolder misconfigurations, privileged group membership (Domain Admins, Enterprise Admins), accounts with reversible password encryption, and dangerous ACLs (GenericAll/WriteDACL on high-value objects). For authorized security assessments only.
BGP Community Tagger
python · Config Management
Generates BGP community tagging policy for IOS/IOS-XE, IOS-XR, NX-OS, Arista EOS and Junos from one set of prefix rules, and optionally pushes it with verification and automatic rollback. Gives each rule its own prefix-list so communities are not cross-applied, emits the trailing permit that stops a route-map silently dropping every unmatched prefix, and validates every prefix and community string before generating anything. Dry-run by default; pushes use commit-confirmed on IOS-XR and Junos.
BGP Neighbor State Monitor
python · Monitoring
Tracks BGP session state, flaps and prefix counts per peer and per VRF across all eight platforms. Counts flaps over a rolling time window rather than a lifetime total, so a peer that flapped twice last year reads as healthy while twice in the last hour is flagged unstable. Distinguishes a peer that is down from one that has never come up since monitoring began, and a down session from one Established with zero prefixes. Persists history atomically, supports webhook and syslog alerting, and returns a non-zero exit code for cron.
BGP Prefix Count Monitor & Leak Detector
python · Monitoring
Tracks prefix counts per BGP peer and per VRF, learns a baseline automatically, and alerts on route leaks and mass withdrawals. The baseline deliberately refuses to absorb an anomalous sample — otherwise a leak becomes the new normal within a few polls and the alert stops firing, which is exactly when you need it. Distinguishes a session that is down from one advertising zero prefixes, writes baselines atomically so a crash cannot corrupt them, and supports per-device min/max thresholds. Full VRF awareness across all eight platforms.
BGP Route & Path Selection Analyzer
python · Troubleshooting
Explains which BGP path wins for a prefix and exactly which step of the decision process chose it. Walks all ten steps in order — weight, local-pref, AS-path length, origin, MED, eBGP over iBGP, IGP metric, router-id, neighbor address — and names the step that actually narrowed the field to one, rather than the first attribute that happened to differ. Queries several routers at once and reports when they disagree on the best exit, which is the answer to why traffic from one site takes a different path than another.
Bulk Interface Configuration
python · Automation
Applies an interface profile to many ports across many switches with blast-radius control. Discovers live interface state, selects ports by name, description, VLAN or operational status, and automatically excludes trunks, port-channel members and uplink-named ports unless you opt in. Refuses to run when the selection exceeds a configurable cap, writes a per-device undo fragment reconstructed from the prior config, and verifies every port reached the intended state before saving.
Bulk Route Injection with Blast-Radius Guards
python · Automation
Injects or withdraws static routes, BGP network statements, and redistribution across many routers with the guards that stop a routing change becoming an outage. Refuses default routes and over-broad prefixes, detects martians, analyses overlap against the live routing table to show what each route would shadow, verifies next-hop reachability so a route cannot silently black-hole, caps how many routes one run may add, and captures BGP peer count before and after — automatically reverting the whole change if a session drops. Full VRF awareness on every platform.
Bulk VLAN Deployment with Consistency Verification
python · Automation
Deploys VLANs across a switching domain and proves the result is consistent. Audits the current VLAN database and trunk allowed-lists first, reports name mismatches and partial presence before changing anything, then creates VLANs with optional SVIs and HSRP/VRRP/anycast gateways. Extends trunk allowed-lists using 'add' so the existing list is never replaced — the mistake that makes a VLAN exist everywhere and work nowhere. Re-audits afterward and fails loudly if the domain is still inconsistent.
Cloud Security Posture Auditor
python · Security
Multi-cloud security posture assessment for AWS, Azure, and GCP. Checks for the most critical cloud misconfigurations: public S3/Blob/GCS buckets, overpermissive IAM roles (admin everywhere), MFA not enforced, CloudTrail/logging disabled, security groups allowing 0.0.0.0/0 on sensitive ports, unencrypted EBS/RDS volumes, publicly exposed databases, unused access keys older than 90 days, root account usage, and publicly exposed cloud functions. Maps findings to CIS Cloud Benchmark and AWS/Azure/GCP security best practices.
Network Device Config Backup
python · Config Management
Connects to every device in your inventory, downloads its running configuration, and saves each to a timestamped file. Rejects truncated output that would look like a valid backup but could not restore a device, strips volatile lines so unchanged configs produce identical files, and can skip writing when nothing changed. Devices come from a devices.yaml inventory; credentials from environment variables, never the file. Supports Cisco IOS/IOS-XE/IOS-XR/NX-OS, Juniper Junos, Arista EOS, Palo Alto PAN-OS, and Fortinet FortiOS.
Config Compliance & Golden-Config Drift Checker
python · Security
Audits running configuration against a declarative policy and reports what is non-compliant, why it matters, and the exact remediation. Ships with 38 CIS-aligned rules across all eight platforms covering AAA, management plane, insecure services, SNMP, logging, NTP, and routing protocol authentication. Also diffs against per-role golden templates to catch drift. Generates ready-to-push remediation fragments that feed straight into config-validator and config-rollback.
Running vs Startup Config Diff
python · Config Management
Finds configuration that is running but was never saved — changes that silently disappear on the next reload. Also compares against the newest file from config-backup to detect drift since that backup. Strips timestamps and other volatile lines so the diff shows real change only. Correctly reports that IOS-XR, Junos and FortiOS have no unsaved state rather than producing a meaningless diff. Returns a non-zero exit code so it works as a cron or CI check.
Network Config Redactor
python · Security
Masks passwords, keys, SNMP communities, PSKs and tokens in network configs and logs, and remaps addresses consistently so the topology stays readable. Offline, standard library only, with a verify pass that re-reads its own output looking for what it missed.
Safe Config Push with Automatic Rollback
python · Config Management
Push configuration with a guaranteed way back. Uses each platform's native rollback mechanism — IOS-XR and JunOS commit confirmed, EOS commit timer, NX-OS checkpoints, IOS-XE configure replace, FortiOS revisions — so the device self-reverts if the script dies mid-change. Runs pre/post assertions and rolls back automatically when a check fails. Dry-run by default. Supports Cisco IOS/IOS-XE/IOS-XR/NX-OS, Juniper JunOS, Arista EOS, Palo Alto PAN-OS, and Fortinet FortiOS.
Pre-Flight Config Validator
python · Config Management
Catches bad configuration before it reaches production. Three layers: offline static analysis (dangerous commands, invalid IP/mask, subnet overlaps, forward references, orphaned sub-commands, per-OS syntax shape), semantic checks against live device state (unknown interfaces, port-channel members, existing VLANs), and device-side validation using each platform's own parser without committing — JunOS commit check, EOS session diffs, IOS-XR show configuration failed. Exit codes suit CI gating.
Container & Kubernetes Security Scanner
python · Security
Security audit for Docker images and Kubernetes clusters. For Docker: scans image layers for CVEs via Trivy subprocess, detects secrets baked into image layers (AWS keys, private keys, passwords), identifies containers running as root or with privileged flags, and validates Dockerfile best practices. For Kubernetes: audits RBAC (ServiceAccounts with cluster-admin, wildcard verbs, Secrets access), PodSecurityContext misconfigurations, containers without resource limits, privileged pods, hostPath mounts to Docker socket, missing NetworkPolicies, and externally-exposed services including the Kubernetes Dashboard.
Crypto Policy Checker
python · Security
Checks TLS, SSH, X.509 certificates and IPsec against a cryptographic policy you write yourself in a declarative YAML file - allowed and forbidden algorithms, minimum key sizes, acceptable curves, protocol versions and certificate lifetime. Nothing is built in, so the tool enforces YOUR standard rather than someone else's. TLS and SSH are probed from outside with no credentials; IPsec is read from a managed YAML inventory over SSH. A check it could not determine is reported as UNVERIFIED with the reason, never as a pass and never as a finding - because "I could not tell" and "I verified this is wrong" are different facts. For fixed NIST SP 800-131A / RFC 8247 IPsec rules, use vpn-crypto-audit instead.
DMVPN Health Check
python · Troubleshooting
Checks all three DMVPN layers and tells you which one broke. GRE tunnel state, NHRP registration and resolution, and the IPsec crypto session fail independently and need completely different fixes, so every finding is tagged with its layer and carries the specific remediation. Reads the DMVPN session state directly — UP, NHRP or IKE — which names the failing layer without inference, and checks encap/decap counters to catch tunnels that are up but passing traffic one way only.
DNS Security Analyzer
python · Security
Comprehensive DNS security analysis covering: zone transfer testing (AXFR — if successful, attacker gets complete DNS map of your network), DNSSEC validation, SPF/DKIM/DMARC email authentication records, CAA record checks, detection of DNS tunneling patterns in query logs (high-entropy subdomains, TXT record exfiltration), subdomain enumeration via certificate transparency logs, wildcard DNS detection, and dangling DNS records pointing to decommissioned cloud resources (subdomain takeover risk). Also tests whether nameservers act as open resolvers that can be abused for DDoS amplification.
F5 Certificate Expiry Audit
python · Config Management
Which certificates expire when, and exactly what breaks: the chain from certificate to client-SSL profile to virtual server, sorted by urgency. Read-only.
F5 iRule Linter
python · Security
Static analysis for F5 iRules. Reads a .tcl file and flags the things that are invisible in the editor: a missing HTTP::release that hangs connections, shared state that demotes the virtual server out of CMP with no error logged, commands used in an event where they are not available, and regex or logging on the data path.
F5 Pool Member Drain
python · Config Management
Disable an F5 pool member, wait for its connections to actually reach zero, and report when it is safe to touch the server. Never resets a connection unless you ask for it.
F5 UCS Backup
python · Config Management
Create a UCS archive on each BIG-IP and download it off the device, with retention. A UCS that only exists on the box it came from is not a backup.
FMC Unused Object Finder
python · Security
Finds objects in Cisco Secure Firewall Management Center that no policy references, exports them to CSV, and cross-checks its answer against FMC's own unusedOnly filter. Exports what the GUI will not, covers the classes the native filter does not, and flags the dangerous case where FMC calls an object unused but a policy still references it.
FortiManager Unused Object Finder
python · Security
Finds objects in FortiManager ADOMs that no policy references and exports them to CSV. Resolves every reference against the ADOM that made it and against global, walks policy packages inside folders, and refuses to call a global object unused unless every ADOM was analysed.
GETVPN Key Server Monitor
python · Monitoring
Monitors GETVPN key servers and group members, and detects the failure mode that gives no warning: when every key server stops serving, the group members keep encrypting on the TEK they already hold, every tunnel looks healthy, and then the TEK expires and the entire group drops at the same instant. Correlates KS and GM state to catch that precursor, flags members the key server does not list, and reports TEK lifetime spread across the group — the signal that rekey is not reaching everyone.
Host Vulnerability Scanner
python · Security
Agentless vulnerability scanner that connects via SSH (Linux) to enumerate installed packages, OS/kernel version, and running services. Matches against a CVE database and checks CIS Benchmark controls: SSH hardening (PermitRootLogin, PasswordAuthentication, X11Forwarding), world-writable files, unexpected SUID binaries, and EOL OS detection. Produces risk-scored findings (CRITICAL/HIGH/MEDIUM/LOW) with patch remediation steps. Optionally queries the NVD API for live CVSS scores.
IKE SA Analyzer
python · Security
Deep inspection of IKE Phase 1 and Phase 2 security associations across Cisco IOS/IOS-XE/IOS-XR, Juniper Junos, Palo Alto PAN-OS and Fortinet FortiOS. Flags deprecated DH groups and weak ciphers against RFC 8247, SAs that are READY but passing traffic one way only, and — when both ends of a tunnel are in the inventory — compares them against each other to find proposal asymmetry and duplicate SAs, the classic cause of a tunnel that works intermittently while both devices report themselves healthy.
Infoblox Bulk DNS Record Creator
python · Automation
Creates A, PTR, CNAME and host records on an Infoblox NIOS grid from a CSV, over WAPI v2.x. Dry run by default: it prints the whole plan with the count per operation before anything is written, validates the entire CSV offline so it cannot fail on row 3000 with 2999 records already created, refuses a plan over 500 objects unless confirmed, and writes a rollback file of every _ref it created.
Infoblox VLAN / Network Provisioner
python · Automation
Provisions a new VLAN on an Infoblox NIOS grid as the five objects it really is -- the network, the DHCP range, the DHCP options, the reverse zone and the gateway records -- from one YAML template plus a list of VLANs, over WAPI v2.x. Creates them in topological order, because a range cannot exist before its network and a PTR cannot exist before its reverse zone, and reports what DID get created when a step fails. Refuses a DHCP pool that would hand out the gateway, computes the one reverse zone a /24 needs and the two a /23 needs, and detects the /25 case it cannot create at all because RFC 2317 delegation has to come from the parent. Dry run by default; writes only with --apply.
Infoblox Stale DNS Record Finder
python · Diagnostics
Finds DNS technical debt on an Infoblox NIOS grid over WAPI v2.x: A records with no PTR, orphaned PTRs, dangling CNAMEs and names nobody has queried in months. Keeps 'could not verify' in a separate list from the findings, because a host that ignores a probe is not a dead record. Read-only, never deletes, exports CSV, and replays offline from saved responses.
Infoblox Unused IP Space Finder
python · Diagnostics
Walks every network, DHCP range and fixed address on an Infoblox NIOS grid over WAPI v2.x and sorts them into verifiably free, free with a caveat, and could-not-verify. Read-only, never deletes, exports CSV, and replays offline from saved responses.
Interface Utilization Report
python · Monitoring
Measures real interface throughput by sampling counters twice and computing the delta. Reads each interface's negotiated speed from the device so utilisation is a true percentage — a saturated 100M port is reported at 100%, not 10%. Detects 32-bit counter wraps and resets instead of silently reporting a bogus rate, and surfaces input/output errors and drops alongside the rate, because a link at 40% with rising errors is the real problem. All devices are sampled concurrently, so a fleet-wide run takes one interval, not one interval per device.
IOC Extractor
python · Security
Pulls indicators of compromise out of unstructured text: logs, emails, threat advisories, incident notes or pasted output. Extracts IPv4/IPv6, domains, URLs, email addresses, MD5/SHA1/SHA256 hashes, CVEs, Bitcoin addresses, Windows file paths and registry keys. Refangs defanged notation on the way in (evil[.]com, hxxp://, user[at]domain) and defangs on the way out so results are safe to paste into a ticket. Filters the noise that makes raw regex extraction unusable: private and documentation IP ranges, filenames that look like domains, and the vendor domains present in every corporate log. Groups domains by registrable name to surface DGA-style subdomain sprawl. Stdlib only, no dependencies.
IPv6 Security Audit
python · Security
Finds the IPv6 holes in a device configuration: the interface filtered on IPv4 and open on IPv6, access ports without RA Guard, the RA Guard that is bypassable because nothing drops ND fragments, ACLs that break ICMPv6, and the /64 on a point-to-point link. Read-only, multi-vendor, and runs against saved configs with no device access.
Lateral Movement Detector
python · Security
Analyzes Windows Security Event Logs (EVTX) and Linux auth logs to detect lateral movement patterns: Pass-the-Hash (NTLM Type 3 rapid multi-host logons), Pass-the-Ticket, RDP hopping chains, SMB/auth spraying, admin share access (C$, ADMIN$, IPC$), and new service installation as persistence. Builds authentication graphs and maps attacker movement across hosts. Critical for incident response and threat hunting.
Log Timeline Builder
python · Security
Merges logs from multiple sources into one timeline normalised to UTC. Reads syslog, Linux auth.log, Windows event exports, Apache/Nginx access logs, firewall logs, JSON lines and CSV, detecting the format from the content. Built around one rule: a timestamp with no timezone is never silently assumed to be UTC — it is marked UNZONED, reported in a warning block, and the script exits 1. Silently guessing produces a timeline that is internally consistent and wrong by hours, which is the most common error in incident log analysis. Per-source timezones, gap markers, regex filtering, time-range narrowing, and CSV/JSON export for the timeline table of an incident report. Stdlib only.
Network Path Analyzer
python · Troubleshooting
A traceroute shows you less than half the path. Layer 2 switches never appear in one because they do not decrement TTL, and a firewall that happily forwards your probe can still be dropping the port you care about -- the probe is ICMP or UDP and matches a different rule. This walks the real path for one flow, from the source's own gateway so the path is the one that traffic takes, enters every device on it, and names the hop that hurts: the saturated uplink, the access port throwing CRCs, the link that flapped at 3am, or the rule that denies the traffic, by name. Counters are read by cause rather than listed -- CRC is the cable, late collisions are a duplex mismatch, output drops are not an error at all -- and the age of those counters is printed beside them, because a total is not a rate. Pivots to the HSRP or VRRP active member on its own, and a field it could not read prints as a dash, never as a zero.
NHRP Cache Inspector
python · Troubleshooting
Inspects the NHRP cache on DMVPN hubs and spokes and explains what each failure means. Detects INCOMPLETE entries (resolution requested and never answered), spokes that never registered, NHS unreachable from a spoke, and the signature of broken spoke-to-spoke tunnels — resolution requests sent with zero replies received. Cross-checks each hub's view against the spokes that actually answered, so a spoke that thinks it registered but does not appear in any hub cache is reported directly.
OSPF Neighbor State Checker
python · Monitoring
Checks OSPF adjacencies across your fleet and explains what each stuck state means. Detects neighbors in EXSTART, EXCHANGE, INIT and other faulty states, and — by declaring expected_neighbors per device — also detects adjacencies that disappeared entirely, which a state check alone cannot see. Accepts 2WAY as normal between DR-OTHER routers unless you ask otherwise. VRF-aware on IOS-XR, NX-OS, EOS and Junos. Returns a non-zero exit code so it works as a cron or monitoring check.
Panorama Unused Object Finder
python · Security
Finds network objects in Palo Alto Panorama that no policy references and exports them to CSV, honouring device-group inheritance, nested groups and overrides. Separates verified unused from transitively dead from could-not-verify, never deletes anything, and states in every report which reference classes it did not read.
Path MTU Analyzer
python · Troubleshooting
A ping is 100 bytes and the query result is 9000, so every diagnostic anyone reaches for first is the wrong size to find the problem. This measures the largest packet a path actually passes -- DF-bit binary search, hop by hop -- and compares it against what the devices believe. The gap between the two is an encapsulation nobody told you about. It also detects the PMTUD black hole, where ICMP fragmentation-needed is filtered and TCP opens a session it cannot use.
PCAP Flow Summary
python · Troubleshooting
Turns a packet capture into the short list of flows worth opening in Wireshark. Ranks conversations by severity and then by volume, and separates the findings an expert separates: a receiver advertising zero window (the application is not reading, the network is innocent) from retransmissions on the path, and a SYN that was never answered (look at the far end) from a SYN-ACK the client never completed (look at the client). Declares what the capture itself cannot prove - snaplen truncation, one-directional flows, flows that began before the capture did - instead of giving a verdict it has not earned. A field that could not be read prints as a dash, never as zero. Reads pcap and pcapng in either byte order, offline, stdlib only: the capture never leaves the machine.
Phishing Email Analyzer
python · Security
Forensic analysis of suspicious emails (.eml / .msg files). Parses email headers to trace the true origin (Received headers chain), validates SPF, DKIM, and DMARC authentication records, extracts and checks URLs against threat intelligence (VirusTotal, URLhaus), analyzes attachments (SHA256 hash, file type detection, macro/OLE detection in Office files), detects display name spoofing and lookalike domains, and generates a full threat report. Essential for SOC tier-1 triage and incident response.
Return Path Verifier
python · Troubleshooting
Every routing table you look at is the path OUT. Traffic has to come back, and nothing says it comes back the same way -- when it does not, a stateful firewall sees a SYN and never a SYN-ACK and drops a flow that routing says should work. This walks both directions, marks where they part company, and then reads two clocks at that point: how old the route is and how old the adjacency under it is. A route much younger than its adjacency means nothing failed -- somebody changed a policy.
Secrets & Credential Scanner
python · Security
Scans source code repositories, configuration files, and directory trees for accidentally exposed secrets: API keys, passwords, tokens, private keys, AWS credentials, database connection strings, and JWT secrets. Checks git commit history (not just current files). Supports 50+ secret patterns including AWS, GCP, Azure, GitHub, Stripe, Slack, Twilio, SendGrid, and more. Essential for pre-commit CI/CD security gates and periodic audits.
Sigma Rule Validator
python · Security
Validates Sigma detection rules offline and catches the defects that make a rule silently dead: a condition referencing a selection that does not exist, a mistyped logsource category, a field name with the wrong case, an invalid modifier. Each of those converts cleanly to SPL or KQL and then matches nothing forever — no tool errors, no alert fires, and the coverage matrix still shows green. Also flags quality problems a syntax checker passes: exclusions built on a bare path an attacker can write to, falsepositives left as Unknown, unused selection blocks, aggregations with no timeframe, and duplicate UUIDs across a library. Findings are split ERROR / WARNING / INFO and exit 2 on an error, so it can gate a detection-as-code pipeline.
Multi-Device SSH Command Runner
python · Automation
Runs a read-only show command across your whole fleet at once and collects the output. Read-only by design: any command that could enter config mode or change state is refused before a single session opens. Supports a different command per OS in the same job, VRF-scoped queries, regex filtering of the output, and saving everything to files. Devices come from a devices.yaml inventory; credentials from environment variables, never the file. Supports Cisco IOS/IOS-XE/IOS-XR/NX-OS, Juniper Junos, Arista EOS, Palo Alto PAN-OS, and Fortinet FortiOS.
SSL/TLS Certificate Checker
python · Security
Checks TLS certificate expiry, trust, hostname match and crypto strength across any number of hosts. Fetches the certificate without verification first, so it reports the expiry date even when the certificate is expired or untrusted - and distinguishes expired from self-signed, untrusted CA and hostname mismatch instead of collapsing them into one error.
Subnet Forensic Scanner
python · Security
Deep forensic subnet scanner for network security assessments. Performs ICMP host discovery, TCP scan across 1000 common ports, OS fingerprinting via TTL analysis, service banner grabbing (SSH/HTTP/FTP/SMTP), SMB signing check, RDP/Telnet detection, SNMP default community probing, TLS certificate inspection, and per-host risk scoring (HIGH/MEDIUM/LOW). Exports findings to JSON and CSV. For authorized testing only.
Threat Intelligence Lookup
python · Security
Multi-source threat intelligence lookup for IPs, domains, file hashes (MD5/SHA1/SHA256), and URLs. Queries VirusTotal v3, AbuseIPDB v2, MalwareBazaar, and ip-api.com geolocation. Checks Tor exit node status. Produces per-IOC verdict (MALICIOUS/SUSPICIOUS/CLEAN/UNKNOWN) with remediation actions. Ideal for SOC analysts and incident response.
VLAN Table Auditor
python · Diagnostics
Pulls VLAN tables from a mixed-vendor fleet and reports what is inconsistent ACROSS switches — the same VLAN ID carrying two different names, a VLAN present on four of six switches, a gateway SVI in an unexpected place, or VLANs suspended on some members only. These are the conditions that cause intermittent, hard-to-trace failures. Also finds VLANs defined with no ports assigned. Exports the full table to CSV and returns a non-zero exit code when the domain is inconsistent.
VPN Crypto Audit
python · Security
Audits IPsec/IKE cryptographic configuration against NIST SP 800-131A and RFC 8247 across Cisco IOS/IOS-XE/IOS-XR, Juniper Junos, Palo Alto PAN-OS and Fortinet FortiOS. Flags DES/3DES/RC4/NULL encryption, MD5 and SHA-1 integrity, DH groups 1/2/5/22/23/24, IKEv1, and missing Perfect Forward Secrecy — each with the reason it is weak and the specific fix. Devices it cannot parse, or whose commands returned nothing, are reported as UNAUDITED rather than clean: an audit that silently passes a device it never inspected is worse than no audit.
VPN Tunnel Monitor
python · Monitoring
Monitors IPsec/IKE tunnel state across Cisco IOS/IOS-XE/IOS-XR/NX-OS, Juniper Junos, Palo Alto PAN-OS and Fortinet FortiOS. Reads encap and decap counters, not just tunnel state, so it catches the failure a state check calls healthy: a tunnel that is UP with packets going out and none coming back. Also warns on SAs about to rekey and reports an expected peer that has no SA at all, which is different from a peer whose tunnel is down.
VXLAN VTEP & EVPN Fabric Monitor
python · Monitoring
Monitors VXLAN fabric health across Cisco NX-OS, IOS-XE, Arista EOS and Juniper Junos. Beyond per-device VTEP, VNI and BGP EVPN state, it compares leaves against each other and reports the asymmetries no single device can see: a leaf that sees a peer which does not see it back, a VNI configured on three leaves and missing from a fourth, or a node with fewer tunnels than the rest of the fabric. Correctly reads the vPC anycast VTEP secondary address on NX-OS, so a healthy vPC pair is not reported as broken.
Web Application Security Scanner
python · Security
OWASP Top 10 automated scanner for web applications. Detects SQLi, reflected XSS, directory traversal, open redirects, sensitive file exposure (.env, .git, backups), missing security headers (HSTS/CSP/X-Frame), insecure cookie flags, server version CVEs, and CORS misconfigurations. Produces risk-scored findings with remediation steps. For authorized testing only.