SD-WAN Address Planner
A planner for SD-WAN IPv4 addressing, from 8 sites to 10,000. You describe your site types, segments, hubs, regions, cloud networks and growth, plus any ranges you already use, and choose static tunnels or Fortinet ADVPN. It sizes every block, packs them into your parent range on natural boundaries, warns about clashes, and produces a subnet for every site. Exports a plan CSV, a per-site list, JSON, or a shareable link. The web version runs entirely in your browser. The GitHub repository is a Python command line and library version with no dependencies, tested for identical results against the web engine.
SD-WAN Address Planner: Plan IPv4 Addressing for 8 to 10,000 Sites →
fmg-api-from-scratch
A careful command-line tool for pushing, staging and installing CLI scripts to one FortiManager-managed device at a time, built up over a nine-part series with one tagged commit per part. Writes are off unless you pass --apply, rendered CLI is never printed, the audit trail holds hashes rather than content, install only sends the diff you previewed, and untested FortiManager versions are refused. The test suite exists to fail when a safety is removed.
FMG API From Scratch, Part 1: Why FortiManager and Not Straight to FortiOS →
tor-checks
Two small checks for Tor exit and relay trust. exitscan.py compares SSH host key and TLS certificate fingerprints seen through random or named exits against a direct connection, and confirms any mismatch on a second circuit. relaycheck.py compares what Onionoo publishes about a relay with the role you intended, and flags BadExit or MiddleOnly. Both have exit codes suited to cron and systemd timers, and the repo includes 27 tests.
Tor Deep Dive, Part 7: Finding Bad Exit Relays with a Python Scanner →
ciscocmd1
A small, deliberately simple network automation tool: take a list of commands from a text file and a list of devices from JSON, run them over Netmiko, and dump per-device output. The starting point referenced throughout the Python for Network Engineers and Ansible Deep Dive series — the "before" picture for what comes next as a script grows up.
Netmiko in Practice: From a Show-Command Script to a Repeatable Audit Tool →
web-traffic-generator
A polite round-robin GET request generator against ten public sites, used to produce a constant, predictable stream of background web traffic — handy for testing SDWAN application-aware routing, QoS shaping, and SLA measurement without waiting for real users to show up.
fgt-config-diff
A CLI and Flask web UI that parses FortiGate's config/edit/set/next/end syntax into a tree and produces a clean added/removed/modified diff between two configs — in text, JSON, or HTML — the way an admin actually reads a config, not the way a generic text-diff tool sees it.
Diffing FortiGate Configs the Way an Admin Reads Them: fgt-config-diff →
pmtud-sweeper
A per-hop Path MTU Discovery sweeper. Binary-searches the largest DF-set IP packet each hop along a path will pass, and names the constraining router from its RFC 1191 Fragmentation-Needed replies. Four probe modes — ICMP echo, UDP, TCP-SYN, and full end-to-end TCP MSS handshake — with Rich-table or JSON output and CI-gate-friendly exit codes.
rst-forensics
A TCP RST origin classifier — server, mid-path firewall, or client — built on six independent scorers (TTL, IP-ID, window, options, sequence, timing) that vote with weights to produce a verdict with confidence and evidence. Pure Python core with optional scapy-backed pcap, passive, and active capture adapters.
Who Sent That RST? Forensic Classification of TCP Resets with rst-forensics →