Digital Plumber

netlab 26.10 adds full SRv6 support (IS-IS, layer-3 services, L3VPN) on Junos, SRv6 with IS-IS and SRv6 layer-3 services on Nokia SR Linux, and IPv4 layer-3 services with SRv6 locators exchanged over EBGP on FRRouting and Cisco IOS XR. The release includes a new `netlab install netmiko` command that installs the Netmiko and Paramiko packages needed for Netmiko-based device configuration and helps change device configuration mode for supported devices. Netmiko will become the default configuration method for several popular platforms (Arista EOS, Cisco IOS, Cisco Nexus OS, Cisco IOS XR, FRRouting virtual machines) in coming months. Other improvements include generic prefix sets for static routes and support for containerlab nodes starting in batches or waiting for other nodes to start. For network teams running labs or modeling production networks, this release directly affects how they script device configuration in parallel with Ansible playbooks.

Edwin AI provides operational intelligence by correlating signals across the IT environment using LogicMonitor's ITOps Context Graph to understand relationships, impact, root cause and recommended next steps. The A2A integration centers on two core use cases: event correlation and AI-powered investigation. Edwin AI correlates signals across the IT environment to understand the broader operational issue, then supports deeper investigation through operational metrics, root cause analysis and diagnostic guidance. Through A2A, that intelligence feeds directly into and enriches the ServiceNow incident as it unfolds, giving responders and AI-driven workflows better context for determining next steps. This is a significant architectural shift: instead of siloing observability intelligence in LogicMonitor and forcing NOC engineers to manually correlate events with ticket data, Edwin AI now acts as an agent reasoning across both platforms. For network operations teams running LogicMonitor alongside ServiceNow, this means synthetic test failures, flow data anomalies, and topology changes are automatically grouped and enriched with context before tickets are created, reducing alert noise and accelerating MTTR.

A persistent challenge for IT teams is determining whether an application problem originates in software, underlying infrastructure, or external dependencies beyond direct control. Edwin AI, LogicMonitor's agentic AIOps technology, uses operational data to correlate events, prioritize incidents and assist with root-cause analysis. LM Envision platform provides visibility across hybrid infrastructure and cloud environments, supplying telemetry needed for AI-driven operational decisions. Recent updates connect Catchpoint alert data with Edwin AI for incident correlation across infrastructure, application and synthetic monitoring domains. For NOC teams, this signals maturation of event correlation: Edwin AI can now reason across infrastructure metrics, synthetic test results, and application traces to correlate user-facing problems to true roots—whether a BGP routing change, congested interface, slow backend service, or CDN edge failure. This reduces false correlation loops where teams chase symptoms in wrong domains, accelerating incident diagnosis from hours to minutes.

OpenTelemetry's release trains previously shipped on independent schedules, forcing platform teams managing Collector fleets, multiple language SDKs and Prometheus-compatible backends to reconcile conflicting versions. Specification v1.61.0 landed September 14, Collector v0.161.0 followed September 16, with demo application, Helm chart and several SDKs released within three weeks. This coordinated window—preceded by v0.158.0 August 4, v0.159.0 August 18, v0.160.0 September 2—creates predictable upgrade cycles. The OpenTelemetry Demo 3.1.0 now includes feature flags simulating LLM latency and agent runaway scenarios, directly relevant to monitoring agentic network operations. OpAMP health reporting additions enable meta-observability of the observability infrastructure itself—critical when AIOps agents depend on reliable telemetry pipelines for autonomous decisions. For network teams instrumenting hybrid infrastructure, synchronized releases mean observability code changes can be coordinated with infrastructure updates rather than managing cascading compatibility breakages.

Micas launched a portfolio addressing AI cluster scale-out: 802.4T air-cooled Tomahawk 6 with 800G OSFP ports, liquid-cooled 1.6T variant, and Davisson co-packaged optics system—all at 102.4 Tbps switching capacity. Positioning on OCP Open Rack Version 3 avoids proprietary stacks like NVIDIA Spectrum-X. Co-packaged optics reduce per-port power relative to pluggable transceivers, critical as AI fabrics approach power-limited deployment. The emphasis on open standards signals competitive intensity in the 1.6T switching tier and operator desire to avoid single-vendor architectures. Availability specifics not announced, but OCP timing signals mature product readiness.

This piece synthesizes measurement data from DNSSEC probing infrastructure tracking which validating recursive resolvers have learned and installed KSK-2024 into their trust-anchor configuration sets. Huston notes the DNS root key is 'special' because it sits atop the DNSSEC chain of trust with no parent key validating it—every other key in DNSSEC has a parent. The analysis provides visibility into the actual state of the Internet's readiness for this planned key rollover. Around 90% of reporting resolvers have added KSK-2024 to their TA sets, but the remaining 10% represent significant risk: unmodified systems, read-only key stores, embedded appliances, and offline systems that haven't yet received the automated RFC 5011 updates. The piece emphasizes that seeing the key in a DNS response is insufficient; operators must verify the running resolver daemon has actually loaded key tag 38696 into active memory. Failures may not emerge until cached DNSKEY records expire, often 48+ hours after rollover, complicating post-mortems.

This GitHub issue describes a new feature for Packeteer, an open-source BGP route optimizer and monitoring tool, designed to address route leaks at the origin AS. The feature is scoped to optional leak-watch block (off by default) that watches Adj-RIB-Out feeds from the operator's BMP implementation and publicly available collectors (RIPE RIS Live, NLNOG RING looking glass). On detection of any route carrying the operator's community or any prefix the operator injected appearing in AS paths outside the operator's AS, Packeteer emits an event/alert and withdraws that single route—never bulk moves that could cascade. The implementation integrates RPKI validation (via optional Routinator feed) to flag injected or synthesized routes that would be RPKI-invalid if leaked, preventing scenarios like the Cloudflare January 2026 incident where automation changes led to broad export-policy overrides. Acceptance criteria include FRR lab validation with misconfigured export filters, false-positive elimination over full runs, and config rejection if synthesize is enabled without leak_watch. This addresses a concrete operational gap: most leak detection today is passive (Qrator, Jared Mauch's detectors) or manual filtering; automating per-route withdrawal at the originating AS is a departure.

This paper presented at IMC 2026 addresses a key operational challenge: route anomalies—leaks, hijacks, misconfigurations—manifest differently at different time scales and geographic vantage points. A single collection point may miss ephemeral anomalies that converge within seconds; conversely, aggregating observations across multiple RouteViews/RIS collectors requires careful correlation to avoid false positives from normal BGP churn. The multi-scale anomaly detection (MAD) approach combines longitudinal BGP signal patterns—update frequency, AS-path variance, origin AS stability, prefix size changes—with spatial vantage-point voting to separate transient convergence artifacts from genuine route leaks or hijacks. This builds on prior work differentiating ephemeral leaks (harmless convergence transients) from real incidents. For practitioners, this offers a framework for tuning alert thresholds and reduction strategies in BMP/NetFlow pipelines to catch leaks before they propagate globally while avoiding alert fatigue from normal routing behavior.

ReliaQuest's threat detection team warned on October 9 that Qilin and Settra ransomware operations are actively exploiting CVE-2026-0257, an authentication bypass in Palo Alto Networks GlobalProtect portal and gateway components. Despite being patched five months ago, the vulnerability remains a primary vector for initial access to enterprise networks. This pattern reflects a persistent gap between patch availability and actual deployment across enterprise perimeters. For network operations teams, this underscores the need to treat VPN authentication bypasses as critical search criteria in SOC playbooks and implement continuous monitoring for anomalous VPN session creation, especially from geographic anomalies or suspicious source IPs. The continued targeting by sophisticated threat groups suggests many organizations remain unpatched or lack visibility into their patch compliance status.

Itential's updated guide provides practical MCP fundamentals alongside video walkthroughs and design best practices including William Collins' six principles of MCP server design. With 56+ production MCP servers available and the network automation market projected to reach $12.38 billion by 2030, the guide positions MCP as the standard interface for connecting LLMs to infrastructure tools. For infrastructure teams, MCP offers a path to AI-enhanced operations without sacrificing reliability, security, and governance, enabling conversational interfaces for complex systems while preserving robust automation frameworks that keep production environments running. The guide emphasizes that MCP is now mature enough for production operations teams to adopt alongside existing automation and ITSM platforms.

This practitioner post from William Collins (Director of Technical Evangelism at Itential) addresses a critical tension in early MCP adoption: the temptation to expose entire API surfaces as granular tools. Ad-hoc MCP servers typically expose hundreds of tools with ambiguous selection behavior, bloated context windows, and higher failure rates, whereas product-oriented design (like the Itential MCP Server) curates tools at the intention level with predictable selection and bounded context. This distinction matters operationally: agents reason better when tool surfaces are scoped to specific workflows rather than maximally flexible. The post distills lessons from production deployments into guidance that network and infrastructure operations teams can apply when either building custom MCP servers or evaluating vendor implementations. Context window management and tool discoverability directly impact MTTR and agent reliability in incident response scenarios.

Comcast introduced fiber sensing tools using AI and edge computing to track infrastructure conditions and security in real time, addressing a key operational challenge during technology transitions. The integration of Harmonic's virtualization platform suggests AI intelligence is embedded at the edge rather than backhaul. Combined with Comcast's deployment of agentic AI to sort through alarm volumes and continuously refeed analyzed data into AI models for improving recommendations, this reflects cable operators moving from reactive to predictive operations. For NetDevOps teams, this signals that cable networks are adding continuous learning loops—models trained on real operational data—rather than static rule-based detection. The deployment marks a shift in how cable operators handle fault detection across fiber and HFC infrastructure.

The partnership combines Eminence Grey's sovereign AI platform with Lumen's programmable network and physical infrastructure, enabling organizations to run AI workloads on sensitive data while maintaining security and compliance-boundary controls. Components include Eminence Grey's AI nodes, Whitehorse orchestration, Outrider appliances, Qrypt post-quantum encryption, and Lumen's programmable network and edge footprint. This operationalizes the sovereign AI narrative—organizations gain carrier-grade SLAs, multi-region resilience, and compliance controls that cloud platforms cannot guarantee. Lumen's Alkira acquisition, highlighted at its Nasdaq debut, positions cloud-native control plane technology at the center of transforming fiber footprint into programmable connectivity. Rather than static VPNs or dedicated circuits, Lumen offers composable, on-demand connectivity orchestration. For NetDevOps teams, this signals programmable networking for AI moving from test to production, with carriers now competing directly on connectivity economics alongside cloud providers.

This paper documents real-world challenges deploying RDMA in production parameter-server-based inference and training systems at ByteDance. While RDMA can reduce communication overhead in distributed ML, naive TCP replacement fails under production workload patterns: variable message sizes require careful buffering, concurrent connections stress limited connection contexts, bursty incast patterns cause queue saturation, and transient service failures require robust recovery. ByteExpress, a software abstraction layer over RDMA hardware, addresses these gaps through intelligent message batching, connection pooling, flow control, and timeout handling. The paper provides benchmark results on real production topologies and workload traces, making it immediately relevant to network operators scaling distributed systems and AIOps teams managing high-performance datacenter infrastructure. Key architectural lesson: hardware offload alone is insufficient; software must handle operational complexity that hardware cannot see.

This tutorial addresses the theoretical and practical foundations of TSN shapers in decentralized network environments. Time-Sensitive Networking (IEEE 802.1Q) enables industrial automation and critical infrastructure by providing deterministic, low-latency packet forwarding with bounded jitter. The paper develops latency models for shaper behavior in multi-hop topologies without centralized coordination, crucial for edge deployments where central control is infeasible. Information flow analysis helps operators understand how queuing discipline, transmission schedules, and buffer management interact to deliver worst-case latency guarantees. Directly applicable to DevOps and infrastructure teams deploying TSN in factory automation, power grid management, and safety-critical systems. The tutorial format makes it accessible for practitioners new to TSN scheduling but requires mathematical rigor for production deployment planning.

SDN enables flexible, programmable control of EV charging infrastructure (EVCI), but introduces security gaps as IT and OT systems converge. This paper models low-rate DoS attacks (which evade threshold-based detection) and proposes moving target defense (MTD) using game theory to randomize network topology and routing. The game-theoretic framework allows operators to compute optimal defense strategies given attacker capabilities and resource constraints. Key contribution: quantifies the tradeoff between defense overhead (network reconfiguration cost) and attack effectiveness, enabling operators to set defense policies based on risk tolerance. Directly relevant for network teams managing hybrid IT/OT infrastructure, critical infrastructure operators, and security architects deploying SDN in safety-critical environments. Provides measurable defensive strategies rather than generic security principles.

Microsoft introduced Microsoft-Decision-1 on October 9, 2026, a specialized model optimized for one-pass decisions on fixed choice sets—routing, classification, prioritization, and verification. Unlike general-purpose LLMs that incur per-token costs, Decision-1 returns calibrated confidence scores for fixed options, reducing both cost and latency. Microsoft's internal benchmark on XBOX feedback triage showed it matched GPT-6 Sol's quality at 14x faster inference and 200x lower cost per decision. The model is available through Microsoft Foundry and OpenRouter at $0.042 per million tokens. For AIOps and SRE teams building agentic workflows, every routing decision, escalation gate, and action verification typically calls an expensive frontier LLM; Decision-1 enables those tasks to run in milliseconds at negligible cost. Practitioners should evaluate it on representative classification and routing tasks with fixed answer sets to determine fit for their orchestration workflows.

Anthropic's policy release comprises three documents: a narrative essay by Dario Amodei spanning five policy domains (safety regulation, macroeconomics, science acceleration, civil liberties, geopolitics), the Advanced AI Framework (safety and testing regime), and the Economic Policy Framework (labor disruption response). The Advanced AI Framework specifies mandatory obligations including risk assessment across cyber offense, CBRN risks, harmful manipulation and loss-of-control scenarios; model reporting with transparency before and after major deployments; security risk management through testing and protection; incident response protocols; and external expert input via independent evaluation and red-teaming. Critically, obligations apply to frontier model developers, not downstream users—meaning California, New York and Illinois state laws remain in force as a floor, creating cumulative compliance layers rather than preemption. Amodei stated Anthropic would grant independent evaluators permanent model access to verify safety commitments. This represents an explicit industry pivot away from self-governance toward government-enforced statutory frameworks, with direct implications for how organizations assess vendor compliance across overlapping federal and state regulatory regimes.