athnode.com
Bo Sam Ath · IP network engineer · Cambodia

ath·node

Not replacing the network engineer with AI. Making one engineer count for more.

8 years building and operating service-provider core networks. I rebuild each technology in a lab, phase by phase, until I can explain why every route wins, and I use AI agents as a working tool to get there faster.

athnode# show version
Engineer    : Bo Sam Ath
Role        : IP network engineer, SP core
Uptime      : 8 years in service-provider networks
Core        : IS-IS · MPLS · SR-MPLS · SRv6 · TI-LFA
Services    : L3VPN · L2VPN · EVPN-VPWS
Edge        : BGP · route reflectors · RPKI
Datacenter  : VXLAN EVPN · vPC · HSRP
Security    : FortiGate HA · FortiADC
Automation  : Python · Netmiko · NAPALM · Ansible
AI          : Claude Code, daily  ! a tool, not a buzzword
Lab         : EVE-NG · IOS XRv9000 · Nexus 9000v

athnode#
8years in service-provider networks
2SP-core labs, every phase verified
16phases verified with real show output (SR-MPLS and MPLS-TE)
<50 msfailover measured with TI-LFA and RSVP-TE FRR

athnode# traceroute ai-powered-network-engineer

Where I'm heading

Carrier-scale networking first, then automation on top of it, then AI agents on top of that. Each hop needs the one before it.

1

Core routing depth

BGP, IS-IS, Segment Routing, MPLS-TE: the why, not just the config.

reached
2

Linux and network automation

Python, Netmiko and NAPALM, then the same jobs done declaratively with Ansible.

in progress
3

AI agents on network operations

Fault analysis, config generation and monitoring: agents that read network state and help the engineer decide.

next hop
∞

AI-assisted daily work

Documentation, troubleshooting analysis, runbooks and lab design, on every hop above.

always on

athnode# show ip route labs

Labs

Only labs with every phase verified against real show output are listed here. Each phase ends with the same question: can I explain it?

service-provider core · Cisco IOS XRv9000 · EVE-NG

7 phasesverified

SR-MPLS & SRv6

A service-provider core built from scratch with no LDP and no RSVP-TE: prefix-SIDs, TI-LFA fast reroute under 50 ms, SR-TE steering, L3VPN over SR-MPLS and SRv6, then EVPN-VPWS over SRv6.

TI-LFASR-TEuDT4 · uDX2
9 phasesverified

MPLS Traffic Engineering

The generation before Segment Routing, built the classic way: LDP, RSVP-TE explicit paths, CSPF and autoroute, FRR, L3VPN over the tunnels, then affinity steering, auto-bandwidth and preemption. You appreciate SR after feeling RSVP-TE's state.

RSVP-TEFRR <50 msauto-bandwidth

More labs (BGP, IGP, VXLAN EVPN, automation, telemetry) are on GitHub and join this page once every phase is verified.

athnode# show ai-agents detail

AI is in the toolbox, not in charge

I use AI coding agents every day, the way I use a lab: to go deeper and faster, while the understanding stays mine. The agent drafts and explains; I verify on the CLI.

  • lab designtopologies, addressing plans and phase-by-phase build guides
  • studyexplaining a protocol behaviour until I can explain it back
  • troubleshootingreading show output and narrowing down the cause
  • documentationrunbooks and READMEs like the ones in these labs
  • toolingPython and automation scripts, reviewed before they run

Case study: AI agents that never touch the routers

design · lab build next

An architecture for letting several AI coding agents build network tooling at full speed while the routers stay out of their reach. The engineer collects device output; the agents work only on those saved files; one audited login path is the only way to the gear, and it belongs to the engineer.

Architecture: coding agents on the laptop, one engineer-driven path to the routers Three AI coding agents read and write a toolkit and a capture database on the laptop. A standing rule, and a guard hook where the agent supports one, stand between them and the routers. Only the engineer, through an audited login path, reaches the network, and the output comes back into the database as files. THE LAPTOP · OFFLINE THE ROUTERS coding agent 1 coding agent 2 coding agent 3 own git worktree each toolkit + capture DB parsers → SQLite each capture a new snapshot offline test suite shared notes ✕ agent → router: not allowed rule + guard hook audited login path routers read-only commands one login attempt the engineer output saved as files
One way inDevice logins go through a small, audited login layer instead of each tool connecting on its own, so the safety rules live in one place: read-only commands, one login attempt, no credential reuse.
A guard, not only a promiseEvery agent works under a written rule; where the agent supports hooks, a hook also checks each command and blocks anything that could reach a router. Tested with stubs that log and refuse, not just by reading the code.
Offline by constructionThe tools read saved output, so the test suite runs without a network, and the agents never need one.

athnode# show running-config | section principles

How I work

principles
rule 10 never automate a task you haven't done by hand first
rule 20 a working config is the easy part; explain why each route wins
rule 30 verify every phase with real show output before moving on
rule 40 build the old way first: RSVP-TE before SR, SNMP before gNMI
rule 50 AI drafts and explains; the engineer verifies on the CLI
deny any config I can't explain ! no exceptions

athnode# show interface Loopback0

The interface that never goes down

On a router, Loopback0 is its permanent identity, whichever physical link happens to be up. This domain is mine in the same way.

email
ath@athnode.com
linkedin
in/bosamath
github
bosamart
state
up/up