The Safest First Use of AI in Networking

What I'll say is probably going to end up being the most important thing that's going to come out of this, because the one thing that AI is really good at is documentation. And we started this conversation saying like the junior guy came in and comes in, maps the network for a little bit and then gets too busy to do it. AI just does it. That alone would have saved so many networks that I've seen have major problems.

And there's so much value there, Chris, because one, it's a very low risk exercise. We're talking about read-only activities, right? This is day one stuff. Give the agent read-only, don't let it touch.

It has no access to configuration. All it has is read-only capability to run show commands and gather information and then turn that into really valuable assets. And it can run constantly. And then you have these sort of offshoots of ideas and say, well, now it's doing it every four hours.

When there's a problem, I wonder if it could tell us the difference between the last window, right? What changed? Why this is failing suddenly. And now you've got mean time to innocence, mean time to detection, mean time to remediation, all from a project that was just having an agent do documentation for you, right?

If it's in Git and you're doing a diff on Git, oh, right there, that route got lost between this four-hour window and now something in the last four hours has caused this issue, right? Amazing, amazing. It augments your human staff, right? You could have the AI build a beautiful dashboard and portal system and use the AI to build the front end for it.

Use AI to build the backend for it. Store all this in a Postgres database or store it in a Git repo. The agents are going to be there to help us, augment us in ways we never really considered. I mean, just in the last couple of minutes, we've given the world an idea, right?

Why can't I build an agent to fully document my network. On that topic, I wrote a mind map MCP server built on markmap.js.org.

I do the full, because I didn't write it. The author of markmap is not me. I wrote the MCP for that standard. So you can literally say, go get the routing table using PyETS and give me a mind map of that routing table.

And it's an interactive mind map of all the routes, the interfaces that are going out, the next hop. It's all beautiful. It's all interactive. It's just markdown, but you can visualize it.

Really exciting period of time. And when was the last time we said it was an exciting time to be a network engineer? It been a long time Unless you were saying I in the cloud or I doing security or I doing application right Network is sort of the oh okay So you work in technology. What do you do?

Are you in the cloud? Are you doing security? I do networking. Oh, okay.

All right. You know, like sort of the- So you unclog the toilets there. Yeah, the plumber, right? You know, you don't do any decision making.

You're just there to wire things and give things IP addresses. It's been so like long, probably since the dot-com fever, when getting like a CCIE and being able to implement BGP in those early days and configure a PIX firewall in those early days. Oh, God. Really was exciting stuff at the time because it was bleeding edge human technology.

It invented the Internet, right? Well, and then you got to see how BGP actually works in the public networks. And you went, oh, my God, really? It can go that bad that quickly and I can just do that?

You know, I have an ASN and I can just, I can start routing stuff in weird ways and start grabbing routes and doing things. And that's why all my traffic's going through China right now. I mean, like, what? I know.

I know. It's the more you learn about it, the scarier it becomes, right? What are some of the other big ways that AI can, you know, be utilized in networking? Yeah, so I don't want anyone to conflate, similar like with network automation, people conflate that with configuration management.

They think one means the other. And there are a lot of other things you can do with automation. I wouldn't say it rhymes, that AI rhymes with that, but even to a more powerful degree. I've been giving this a lot of thought because we have customers that want to do it and I'm trying to be a partner and a guiding light and explaining how they can start with human in the loop or on the loop approaches with read-only activities, but that have value, right?

So I think testing. I think testing is a really big one. I asked a forum at the network on AutoCon in Texas, a room full of about 500 people, all of them some of the best and brightest in the industry. Who here knows if every interface on the network is clean, right?

Meaning error-free. Not one single person put their hand up, right? So there's an opportunity for us to just start with testing. It's read-only, run a show command, show IPBGP, whatever, show IPOSPF, whatever, and then have the AI test it, really test it.

I think compliance, Sources of truth populating say Netbox or Notobot or Infograph with your inventory using AI to do that That used to take weeks of human effort We talked about documentation quite a bit Testing documentation compliance Here another good one I think is a really powerful approach is triage And when tickets come in, let's say if you're a ServiceNow customer or user, and you could train your staff to say, when you submit a ServiceNow ticket, there's a dropdown option that says agentic solution.

something like this. Keep the human in the loop. So the human decides, is this something an agent might be able to figure out? And when that ticket goes in, it gets routed to an agent, and the agent does as much triage as possible.

And it's only read-only. We don't let it fix anything. It's just a triaging agent to come back and say, based on all of my accents and all of my tools and my reasoning and the tests I ran, here's why I think Wi-Fi is slow in Dallas, or whatever the ticket is, right? That ticket then could be routed to more appropriate humans to say, oh, I got this ticket from the agent.

The agent believes that I need to turn power down on the wireless access point in whatever room to adjust for the problem this user opened. I think that then moves into fully agentic. Why can't an agent just turn the power down on that AP, right? And let the agent completely close the loop on these tickets.

It gives the enterprise management the ability to turn on that switch. Right now, we're going to run, say, three months in a Gentic with human in the loop, and we'll evaluate how well we're doing. And then maybe we can flick the switch and let the agents actually have access to configuration management to self-heal and to resolve problems automatically. It's a little bit like, you know, the idea of intrusion detection versus intrusion prevention systems.

That's a really good analogy. Yeah, I like that. And unfortunately, I don't think we really got to the intrusion prevention as much as the detection side of it, because it got very scary to run intrusion prevention because it had a tendency to, you know, unceremoniously shut your network down at times. But IDS IPS, you know, was very deterministic in that sense.

It wasn't able to figure its way out of a gray area, which made it really hard to tune because you had to get it right. Otherwise it was just a blast of noise. And now we've got kind of an agent that's actually almost like a network engineer employee kind of wandering through here. I, you know what, I think that is a brilliant IDS IPS.

And with the prevention to your point about determinism you may have had a prevention system that is only looking for let say the slammer worm If you see traffic on this port with this signature kill it Kill that traffic, right? And that's it. That's the only thing you've spent, a couple hundred thousand dollars for the capability, and you're just looking for worms with specific signatures, and you're killing those flows, right? And in the meantime, you get 500,000 false positives, too.

All the false positives. But to that point, with an AI agent, you may say, listen, if the remediation is to shut an interface and that interface is on this classification of device in this location, you can go ahead and shut the interface and no shut the interface. Let's say bouncing a wireless access point or a PoE device or something, right? Maybe that's something we can accept the risk.

Now, what if it shuts all 50 interfaces down and Wi-Fi is gone or all your POE and now you don't have point of sales? There's a lot to consider here and architect around and maybe still keep humans in the loop. Listen, if you're going to shut a POE port and the description says attached to point of sales, don't shut it. Get a human involved and let the human know that that point of sales needs to be bounced or whatever, right?

There's always an answer. Yes, we could come up with a million problems with agents, but I think if we really work through those problems together and just discuss them, they're going to come down to having a solution, right? I don't think there's going to be any insurmountable problem around agents doing some of these activities. Well, we keep talking about sort of determinism being kind of a curse of networking.

It is kind of on the from the AI side of it. It is kind of a positive thing because it is it is such a well-known entity and it has such well understood behaviors that when there's odd patterns or deviations from that, that's exactly a great tool. AI is the great thing to throw at that type of challenge, right? That's right.

Throw away all the good metrics and all the good signals and focus on the anomalies. And the anomalies are pretty easy to spot. And with some human ingenuity, like those tests that I described could be connectivity tests. Can point A reach point B in a given topology, given their IP addresses, right?

That would be something to have an agent just testing. and then letting you know, hey, by the way, John, this segment of the network can no longer reach this other segment of the network. That's very insightful. It's read-only, it's safe.

It's just a ping sweep or a ping test that you have the AI analyze the results from, right? So there's a lot of uses here.