Explain what changed between two network device config snapshots, in plain English. EdgeOS, MikroTik RouterOS, OPNsense config.xml (per-rule stories, save-stamp noise filtered), EdgeSwitch and Cisco IOS-style configs: volatile lines stripped, changes grouped by config section, each tagged with a risk level and why it matters. Deterministic — no model call, nothing leaves the machine.

Run a CIS/PCI starter pack over one device config: cleartext management, SSH, default SNMP communities, centralised AAA, remote logging, NTP, hashed credentials, default credentials, management exposed to any source, login banner. Ten deterministic checks, each with a framework reference and a one-line remediation. Cisco, MikroTik, EdgeOS, OPNsense.

Diagnose a port that will not authenticate. Paste any of: the RADIUS/ISE authentication log, the switchport interface config, the supplicant (Windows wired AutoConfig) log. Names the root cause — EAP method mismatch, unknown CA, shared-secret/NAD mismatch, missing dynamic VLAN, CoA NAK on the wrong port, invalid dACL — decodes ISE failure codes, and gives the fix on the switch AND in ISE. Read-only, rule-based.

Decode a Cisco ISE / RADIUS failure or step code (5400, 5411, 5440, 11007, 11036, 11514, 12321, 12508, 12514, 15039, 22056): what it means, the usual cause, and the fix.

Find every certificate embedded in a device config and check it: expiry (with severity buckets), weak RSA keys, MD5/SHA-1 signatures, self-signed leaves, CA certificates about to expire. Reads inline PEM blocks (Cisco crypto pki chains, EdgeOS, RouterOS exports, anything) and OPNsense config.xml blobs — the certificates web monitors never see because they are inside the config, not on a port.

Connect to a public host:port, read the certificate it actually serves, and run the same findings as find_certs_in_config on it (expiry, weak key, weak signature, self-signed, hostname not in SANs, CA expiry). Any port. Refuses hosts that resolve to private or reserved addresses.

Pull the facts out of a device config: hostname, inferred role, every IPv4 address with its subnet, the subnets it sits on, and its VLANs. EdgeOS config.boot, MikroTik export, OPNsense config.xml, EdgeSwitch/FastPath, and Cisco IOS-style text.

Given several device configs, work out which devices share subnets or VLANs and draw the segments as a Mermaid diagram (graph LR). Shared-subnet inference: two devices with an interface on the same network are adjacent. A subnet contained in a broader declared one is merged into it. Prefixes shorter than /16 are ignored as too broad to mean a segment.

Explain a change between two OPNsense config.xml captures rule by rule: which rules were added, removed, edited or moved (keyed by uuid, so an edit is not mistaken for delete-plus-add), what each rule does in plain English, a risk rating with its stated grounds (any-source to a management port, any-source to the firewall itself, any/any/any pass), shadowed-rule notes, and which API call made the change. Save-stamp noise is recognised and set aside.

Before you push a change: diff the proposed config against the current one, risk-tag every change, list compliance checks that would regress, and — if you pass the configs of the other devices you manage — compute the blast radius (who shares the affected subnets and VLANs). Returns a gate verdict: BLOCK, REVIEW REQUIRED, PROCEED WITH CARE, or NO CHANGE. Read-only; nothing is applied.

Scrub a config before it goes anywhere: passwords, secrets, RADIUS/TACACS keys, IPsec PSKs, SNMP communities, MD5 digests, Wi-Fi PSKs, key/certificate blocks and hashes are redacted; IPv4 addresses are mapped consistently to RFC 5737 documentation ranges (same address, same placeholder, so the logic still reads), IPv6 to 2001:db8::, MACs to the RFC 7042 range, hostnames to ROUTER-n, domains and emails to example.com. Subnet and wildcard masks are preserved. Returns the clean text and a count per category.

The most recent This Week in NetOps episodes — what changed in networking, cloud and automation this week and what to do about it. The only tool here that touches the network besides check_tls_endpoint; it reads a public RSS feed.