netblame
"Is it really the network's fault?" A staged diagnosis CLI — environment, DNS (4-way comparison), TCP, TLS, HTTP, QUIC — that names the most likely culprit with evidence, plus exit codes for CI.
View on GitHub →The tool suite
Six small tools, one thesis.
Every product here targets the same underlying problem from a different layer: the story you have about your network and the reality of your network keep drifting apart. Some are shipped and public today; others are still in private beta or early prototype.
ashealth
A routing-hygiene checkup for small AS operators: cross-checks announced routes against RPKI ROAs, IRR objects, and PeeringDB, and returns a 0–100 score with prioritized fixes.
driftmap
Network diagrams rot the moment they're drawn. driftmap generates topology snapshots from real device state (LLDP, SSH) and diffs them to catch link, IP, and device drift automatically.
pathwx
A network weather station: continuous TCP-path probing with a JSONL time series and z-score-based trend detection, so gradual latency and loss degradation gets caught before someone notices.
BGP Sentinel
Real-time BGP hijack and route-leak detection fed by RIPE RIS Live, with an incident dashboard and alerting. In production for dogfooding today.
protocol-lab / Protocol in Code
RFC-grounded courses: hands-on containerlab labs for beginners, and a GitHub-based code-reading course for BGP and OSPF at the intermediate level.
Open the course →One thesis
Close the gap between "you think" and "it actually is."
Every product below answers the same question for a different part of the stack: what do you believe about your network, and how far off is that from what's really happening?
Five gaps, five tools.
We didn't start from a roadmap — we kept building small tools for the same recurring failure mode, and only afterward noticed they were all the same shape.
Diagram vs. wiring
The topology diagram you drew last quarter vs. the cabling that's actually there today → driftmap
Blame vs. cause
"It's the network's fault" as a reflex vs. the actual culprit (DNS, TLS, a proxy, the server) → netblame
Felt vs. measured
"It feels slower lately" vs. the actual latency/loss trend over time → pathwx
Intent vs. announcement
What your ROAs/IRR/PeeringDB records say you should announce vs. what you actually announce → ashealth
Legitimate vs. observed
The route that should carry your prefix vs. the route the world is actually seeing → BGP Sentinel
Try it now
netblame: a two-minute diagnosis, in plain language.
Single binary, no install beyond downloading it. Point it at a URL or host and it runs the staged diagnosis itself.
$ netblame https://example.com [1/6] environment proxy/hosts clean [2/6] dns system / local / 1.1.1.1 / 8.8.8.8 agree [3/6] tcp connect ok (18ms) [4/6] tls cert valid, no interception detected [5/6] http 200 OK [6/6] path quality loss 0.0%, jitter 1.2ms [VERDICT] No problem found. The path to this destination is healthy right now. $ netblame https://expired.badssl.com [VERDICT] TLS certificate expired 43 days ago. This is a server-side problem, not your network.
Learning track
Two separate courses: beginner hands-on, intermediate code reading.
The beginner path stays as the traditional containerlab course. The intermediate path is a fully separate Protocol in Code course, where the code lives on GitHub and the explanations live on this site.
Choose the track that matches your level.
The beginner course is for learning by running containerlab. The intermediate course is for reading protocol logic like code, with BGP as the first subject and the source files hosted in GitHub.
Beginner
containerlab と FRRouting を動かしながら BGP を学ぶ独立コース。Lab 01-03 で完結する。
Intermediate
Protocol in Code は独立した中級コース。23 トラック / 151 セッションあり、GitHub の source file を開き、neighbor の入力や best path selection の条件分岐を読む。
Roadmap
Learning Paths で 23 トラックをジャンル別・目的別ルートで見渡せる。
Intermediate course
Protocol in Code now includes BGP and OSPF, with code on GitHub.
The intermediate path reads protocol logic as code: required inputs, state changes, and decision branches. The source lives in the public `protocol-in-code` repository.
github.com/pathvector-studio/protocol-in-code BGP Session 01 session.py -> neighbor inputs Session 02 update.py -> state mutations ... Session 15 speaker.py -> toy speaker loop OSPF Session 01 hello.py -> Hello gate Session 02 neighbor.py -> adjacency state Session 03 dr_election.py -> DR / BDR election Session 04 lsa.py -> Router-LSA object Session 05 flooding.py -> LSA forwarding Session 06 lsdb.py -> versioned store Session 07 spf.py -> shortest-path tree Session 08 routing.py -> route derivation Session 09 cost.py -> winner selection Session 10 recompute.py -> topology recompute Session 11 areas.py -> area summary Session 12 speaker.py -> toy speaker loop
Public status
Small, slow, and reproducible.
Now
netblame is public (v0.5, MIT) with staged diagnosis and report sharing. ashealth, driftmap, and BGP Sentinel are running in private beta and daily dogfooding. pathwx is a working prototype (continuous probing + trend detection, not yet public).
Next
Package and publish pathwx. Prepare ashealth and driftmap for a public release once their hosted checkup story is ready. Keep hardening BGP Sentinel ahead of a public beta.
Later
Correlate pathwx degradation timestamps with BGP Sentinel route-change events. Expand the Protocol in Code format to IS-IS, DNS, TCP, TLS, HTTP, and QUIC.
Contact
Protocol notes, corrections, and references are welcome.
Send short notes, RFC pointers, or corrections to the public contact address.