Networking tools

The Ops-toolbelt chapter for the network: small sharp instruments for seeing what packets actually do — paths, per-process traffic, DNS propagation, cluster failovers. The unifying discipline is the same as Performance engineering: don’t guess, observe — network truth (TTLs, MTUs, resolver answers, failover behavior) before folklore. Companion sections: Ops toolbelt (general utilities), OSS routers (the boxes being diagnosed).

The catalog (all captured)

• ttl (OSS) (Rust, via @tom_doerr) — “fast, modern traceroute with real-time TUI, per-hop stats, ASN/geo lookup, ECMP detection, and MPLS label parsing” — monitors network paths to detect load-balancing schemes, discover MTU limits, and identify routing instability. The traceroute finally upgraded for how paths actually work in 2026 (multiple parallel hops, MPLS tunnels, per-hop latency distributions).
• picosnitch (OSS) (C, bpf) — network traffic per executable: which binary is generating the traffic, not just which socket. The question firewalls never answer; built on eBPF.
• dnsglobe (OSS) (Rust, 514-labs) — global DNS propagation checker TUI: watch a record propagate across 34 public resolvers worldwide, on a world map in your terminal. The right shape for the “is it propagated yet?” wait after every DNS change (and the debugging tool for split-horizon/resolver-cache weirdness).
• Checkmk clustered services (clippings/docs-checkmk-com-latest-en-clustered-services-html.md) — the monitoring-side concept doc: HA clusters, nodes, cluster IP/virtual IP semantics (failover transfers the IP; clients stay oblivious) vs no-cluster-IP designs (Oracle RAC-style: client keeps the node list and must detect+switch itself). The KRZ tie: checkmk is already an inventory source in the inventory Polars ETL lane; this doc defines what “service up” even means when the service moves between hosts — the monitoring design question High Availability’s failover section asks.
• eBPF — the substrate underneath the modern entries: per-process traffic accounting (picosnitch), path enforcement (Aegis-BPF (OSS)), observability at kernel level. The 2020s answer to “the packets know, but the tools didn’t.”

The pattern

Small CLI/TUI observability tools are having a renaissance because agents and terminal-first workflows reward them (CLIs for agents): one binary, JSON or TUI out, no web console. The diagnostic ladder they complete: path (ttl) → process (picosnitch) → name (dnsglobe) → service (checkmk clustered services) → enforcement (eBPF kin, AegisBPF).

Related: Ops toolbelt · Performance engineering (observe before acting) · High Availability (what cluster monitoring means) · OSS routers · eBPF