Networking

Calculate IPv4 ACL wildcard masks from CIDR and dotted entries, then audit generated lines for address coverage and dangerous overlaps.

Check a public page for ad-network signatures and ads.txt seller alignment with confidence bands, fetch warnings, and focused follow-ups.

Look up an ASN or public IP to compare current routing prefixes and neighbours with registry contacts and optional PeeringDB context.

Audit pasted BGP route paths for policy conflicts and trace each pass, watch or reject verdict before changing production router filters.

Turn IPv4 and IPv6 CIDR rows into platform-specific prefix-list syntax, with normalized networks and ordered-policy warnings.

Estimate BGP route-state memory and update pressure from prefix and peer counts, retained paths and route bytes, with budget guardrails.

Calculate bandwidth-delay product and per-stream TCP window targets from path rate and RTT, then compare current buffers and stream counts.

Check CIDR allowlists for risky address breadth and service exposure, then review ownership, expiry dates and overlapping rules before approval.

Check an exact TLS certificate fingerprint against public CT data and compare hostname coverage, issuer evidence and provider revocation flags.

Generate Cisco ACL commands from IPv4 flow rows for IOS, NX-OS, and ASA with platform-aware address conversion and safety checks before use.

Generate Cisco interface commands for routed, access, or trunk ports with profile-aware syntax plus normalized VLAN lists and review warnings.

Build cloud-init version 2 YAML for a static VM interface, with CIDR and route validation plus warnings for risky boot assumptions.

Size an IPv4 DHCP scope from real pool ranges and peak demand, then test policy choices against growth and target headroom before deployment.

Estimate DNS resolver cache memory from insert churn and TTL, then compare budget headroom with upstream QPS and hit-versus-miss latency.

Audit a domain's public DNS for authority, address and mail-policy gaps while comparing TTL horizons and resolver-visible evidence across common records.

Trace a public hostname through DNS delegation and aliases, compare resolver views, and inspect DNSSEC or negative-cache clues.

Investigate NXDOMAIN or NODATA using recursive resolver evidence plus NSEC or NSEC3 coverage, DNSSEC clues and negative-cache retry timing.

Check DNS glue and delegation for a public zone, compare resolver views, and identify missing NS addresses, aliases, or DS evidence.

Check DNS propagation across public resolvers, compare the intended record set, and identify cache holdouts with TTL and failure evidence.

Enumerate public DNS records for a domain or IP through Cloudflare or Google, compare query coverage, and flag mail or DNSSEC gaps.

Look up DNS records for a domain, URL or IP through Google or Cloudflare with response codes, returned TTL evidence and DNSSEC flags.

Plan a DNS TTL cutover window from cache-drain and observation timing, including negative-cache checks and resolver refresh pressure.

Test DNS wildcard behavior with random public resolver probes and distinguish broad matches, branch boundaries, mixed views, and cached negatives.

Draft a BIND or provider-ready DNS zone file with normalized records, SOA and TTL checks, plus mail and DNSSEC review warnings.

Validate a domain's DNSSEC trust evidence from parent DS through DNSKEY signatures and resolver AD signals with a focused 15-check report.

Convert data transfer rates across bit and byte units in SI or IEC notation, with overhead modeling, payload timing and delivery-window capacity.

Build an exact DNS-over-HTTPS query packet, inspect its wire fields and EDNS options, then replay it with GET or POST against a resolver.

Estimate ECMP route capacity from healthy paths and hash efficiency, then test reserve headroom plus member-failure and single-flow limits.

Compare DNS answers with and without an EDNS Client Subnet hint, then inspect answer steering, echoed scope, TTL drift, and privacy clues.

Inspect EDNS OPT responses from public DNS-over-HTTPS resolvers, compare requested and returned options, and keep replay evidence.

Estimate ephemeral port pressure for a hot destination from connection churn, held time and source inventory with reserve and capacity thresholds.

Calculate Ethernet payload efficiency and goodput from frame size plus VLAN and wire-time overhead, then check whether a target rate fits.

Calculate fiber link loss and receive power from datasheet and route values, then check operating margin plus reserve, reach and overload risk.

Estimate file transfer time from size and sustained bandwidth while accounting for TCP limits, overhead, compression and a required finish window.

Analyze firewall deny logs into ranked traffic paths using format-aware parsing, CIDR direction checks and transparent priority scores.

Build a reviewable firewall rule matrix from flow rows with least-privilege findings, deterministic risk cues, and platform handoff guidance.

Review firewall rules for stale use and broad exposure while scoring expiry, ownership and privileged-service evidence into a cleanup queue.

Find full and partial firewall rule shadows in ordered IPv4 policy exports, with precedence-aware evidence and safer cleanup priorities.

Estimate free-space path loss and received signal strength with link reserve, signal-to-noise ratio and Fresnel clearance for RF planning.

Check HA peer snapshots for ownership drift, standby readiness, stale synchronization and heartbeat failures with service and priority evidence.

Build an HAProxy backend block from server rows with health checks and TLS trust choices, then review capacity limits and deployment warnings.

Analyze NGINX, Apache, or ALB access logs locally for endpoint P95 and 5xx rates with clear parse-gap evidence and SLA findings.

Trace a public HTTP redirect chain hop by hop to identify loops and HTTPS downgrades, compare timing and generate a replayable cURL command.

Convert one IPv4 value across dotted, integer and bit-oriented forms with special-range labels plus optional signed and byte-order checks.

Check IPv4 CIDRs and ranges for exact duplicates, containment, partial overlap, host-bit corrections, and duplicate address coverage.

Calculate a safe IPsec inner MTU and TCP MSS from the ESP profile and path budget, including NAT-T, padding and optional reserve bytes.

Allocate IPv4 subnets in an ordered parent CIDR, with exact usable ranges and checks for VLSM fit, alignment gaps and remaining space.

Build dependency-ordered IPv4 renumbering waves with CIDR and DNS/DHCP timing checks, window-fit rules and rollback-ready runbooks.

Size and place IPv4 child subnets from host demand, with growth headroom and reservation rules that expose gaps, overflow and usable ranges.

Summarize IPv4 CIDR blocks as one cover route or an exact aggregate set, with normalization and clear warnings for addresses exposed by gaps.

Normalize one IPv6 literal into canonical compressed and expanded forms with preserved prefix and zone context plus binary and reverse-DNS views.

Calculate an IPv6 network from an address and prefix, then review canonical boundaries, child-prefix capacity and reverse DNS or EUI-64 guidance.

Plan site and LAN prefixes from an assigned IPv6 CIDR, check demand against bit capacity, and build a normalized allocation ledger.

Check network interface descriptions for endpoint evidence and policy gaps, then prioritize duplicates or length issues before cleanup and change review.

Check a public IP, hostname or URL for approximate location and network-owner clues with optional reverse DNS and clear evidence limits.

Calculate an IPv4 subnet boundary from CIDR or a dotted mask, then check usable hosts, special-purpose ranges and reserve-adjusted capacity.

Split an IPv4 parent block into equal CIDR children and check usable hosts, gateway placement and capacity fit across the complete subnet plan.

Estimate how jumbo frames reduce packet rate and repeated Ethernet overhead for eligible traffic, with path-risk and optional CPU relief checks.

Generate a Keepalived VRRP configuration for one node with validated peer settings, health tracking, and an estimated failover interval.

Build Kubernetes NetworkPolicy YAML from pod labels and allow rules with selector checks, rollout guidance, and security review warnings.

Calculate usable LACP bundle capacity after failed links, reserve, and hash-efficiency discounts while checking aggregate and single-flow headroom.

Estimate user-visible load balancer failover time across health checks, routing changes, DNS cache exposure, and an RTO target.

Estimate weighted load balancer pool capacity from measured backend RPS and routing weights, with bottleneck and N+ failure-reserve checks.

Inspect a MAC or EUI address with normalized forms and first-octet flags plus special-use checks and optional vendor assignment evidence.

Generate repeatable MAC address batches for labs and fixtures with prefix control and address-class flags, plus notation and duplicate checks.

Calculate a TCP MSS clamp from path MTU and encapsulation overhead, with IPv4 or IPv6 header budgets, floor checks and probe guidance.

Inspect a domain's MX route and compare public DNS answers while catching Null MX conflicts, unresolved exchanges, and alias targets.

Size a NAT or SNAT public address pool from client sessions, planning reserve and hot-destination demand with headroom and failure checks.

Generate NTP configuration for Linux daemons or Cisco devices with source compatibility checks and warnings for unsafe fallback settings.

Review NTP or chrony peer evidence for clock offset and uncertainty with configurable gates for stratum, reach, and source selection.

Check a domain’s resolver-visible nameserver set and verify address coverage, SOA presence, and cross-resolver drift before a DNS cutover.

Rank NetFlow or IPFIX rows to find dominant endpoints and services while comparing byte, packet and flow patterns with local processing.

Build shell-quoted Netcat or Ncat commands for authorized socket tasks with variant compatibility checks and warnings for risky options.

Build Netplan YAML for Ubuntu static interfaces with CIDR addresses, DNS, routes, and warnings for gateway or priority mistakes.

Turn network audit findings into a ranked remediation register with escalation counts, due-state checks, owner gaps, and browser-local reporting.

Build a network change plan with readiness gates and ordered cutover steps, then review rollback evidence and residual-risk guidance.

Build a logical or physical network diagram from device and link records, flag missing or isolated endpoints, and prepare a reviewed handoff.

Simulate Edmonds-Karp or Dinic on an editable capacity network and verify the maximum flow with residual traces and a minimum-cut certificate.

Estimate useful network throughput and transfer time from link capacity and RTT with TCP window, loss and packet-rate bottleneck checks.

Calculate OSPF interface cost from reference and link bandwidth, compare a manual override, and reveal fast links that collapse to cost 1.

Generate an OpenVPN client profile with matched routing, TLS, cipher, and credential choices plus import and security review warnings.

Estimate packet capture storage from traffic rate and duration with snapshot limits, file overhead, compression and capacity reserve checks.

Analyze saved ping output for packet loss and unstable round-trip times, then compare sequence gaps and jitter with your own limits.

Plan a PoE switch from endpoint demand and cable loss, then check reserve capacity against powered ports, startup surge and shedding priority.

Turn firewall, scanner, or cloud-rule port rows into a local exposure review that prioritizes risky public listeners and missing ownership.

Normalize mixed TCP and UDP port lists into compact ranges and target strings with IANA bands, duplicate checks and service exposure cues.

Review pasted or current-request proxy headers, trace the trusted edge from the right, and flag spoofable client-IP evidence and disclosure clues.

Allocate a QoS parent rate across traffic classes and check reserved bandwidth, best-effort headroom, burst ceilings and priority pressure.

Calculate queueing delay from buffer depth and bottleneck rate, then compare occupancy and target buffer size with optional BDP context.

Build FreeRADIUS client stanzas from NAS rows with device-specific secret checks, address-scope warnings, and hardened security settings.

Estimate RADIUS request load from access, accounting, retries, and bursts, then check per-server budgets and N-1 failover headroom.

Estimate replication backlog catch-up time from sustained write rate, outage volume, usable throughput, apply limits and recovery targets.

Compare public DNS answers across open and filtered profiles to separate policy splits from cache or DNSSEC drift with repeatable evidence.

Check PTR records for an IP or hostname, verify forward-confirmed reverse DNS, and compare expected names or public resolver views.

Generate an IPv4 reverse DNS zone with PTR records and SOA validation plus RFC 2317 classless delegation and parent-zone CNAME guidance.

Find the IPv4 or IPv6 route that wins for a destination using longest-prefix lookup, selectable tie-break rules, and CIDR cleanup warnings.

Estimate SNMP polling pressure from devices and OIDs with interval and packing effects plus security, MTU and per-poller capacity checks.

Trace SIP/SIPS, XMPP, or LDAP discovery through NAPTR and SRV to terminal addresses with optional public resolver comparison.

Check a live TLS host or pasted PEM chain for broken issuer links, hostname and expiry problems, then build a root-aware install bundle.

Check a public hostname across SSL Labs endpoints for weak protocols and trust gaps, then prioritize certificate renewal and TLS fixes.

Check a live TLS listener for certificate expiry and SAN coverage, then verify renewal timing plus the served serial number and fingerprints.

Check a public TLS host or pasted certificate for OCSP status and responder timing with freshness warnings and independent-verification evidence.

Generate reviewed static-route commands across host and network CLIs with CIDR normalization plus priority checks and rollback-ready delete output.

Plan IPv4 child subnets from a parent CIDR, compare post-reserve host capacity, and pack ordered VLSM demands into valid boundaries.

Build access or trunk switchport CLI for IOS, NX-OS, and Arista EOS with normalized VLAN lists plus platform-aware syntax and paste-safety checks.

Calculate a restaurant tip from the right receipt base, include tax or service charges, and split the final total with visible rounding checks.

Trace every visible CNAME hop for a public hostname and compare resolver views before verifying the terminal DNS answer and provider suffix.

Parse traceroute, tracert or MTR output locally and compare hop delays with no-reply or downstream-loss patterns before escalating a route issue.

Plan VLAN ID capacity across reserved and existing ranges, then test allocation runway and IPv4 host fit for each new segment.

Compare switch VLAN evidence with intended trunk and native rules plus database, reserved-VLAN, and VLAN 1 policy before a change.

Turn pasted port moves into timed VLAN migration waves with risk and native-VLAN checks, validation gates and an explicit rollback plan.

Plan a VM migration window from memory and disk payloads, using dirty-page churn and usable bandwidth to estimate total time and downtime.

Estimate practical VPN concurrent-user capacity from tunnel rate and packet overhead with gateway limits, busy-hour demand, and MTU risk checks.

Split an IPv4 parent block into visual CIDR leaves, rejoin aligned siblings and verify each range, usable count and complete address coverage.

Estimate WAN round-trip latency from route distance and path overhead to compare target headroom, dominant delays and serial application wait.

Check domain registration data through RDAP with WHOIS fallback, then review expiry timing, nameservers and evidence coverage for follow-up.

Size a WebSocket node pool from peak connections and measured per-node limits with bottleneck, N+ reserve and scale-out checks.

Test an authorized WebSocket endpoint from your browser with bounded traffic and inspect timing, close codes, the selected subprotocol and optional payload previews.

Estimate a preliminary Wi-Fi access point count from coverage and busy-hour capacity with growth reserve, driver comparison and survey warnings.

Build a first-pass Wi-Fi channel plan across 2.4, 5 and 6 GHz access points with DFS filtering, PSC primaries and reuse warnings.

Generate WireGuard server and client configurations with CIDR validation, route-scope warnings, and explicit placeholders for safer key handling.

Generate a dnsmasq IPv4 DHCP scope with CIDR and pool checks plus reservations, client options and optional PXE lines for a review-ready config.

Build bounded iptables or ip6tables commands for a packet path with explicit CIDR and port matches, persistence choices, and production-safety checks.