I operate the network and build the software that runs it.

Point it at a seed device and it crawls the network over SSH and SNMP, reading CDP/LLDP neighbors, fingerprinting each device, and emitting a normalized topology map. Downstream, that map becomes Draw.io and GraphML diagrams and a security-posture audit — but the map is written once and consumed at import time, with no runtime coupling between discovery and its consumers.

The architecture is deliberately layered so the hard parts are reusable on their own: a Paramiko SSH client hardened for legacy gear (invoke-shell only, old ciphers and KEX, ANSI filtering, prompt detection), an encrypted credential vault (PBKDF2-HMAC-SHA256 key derivation, Fernet at rest), a resolver that finds working credentials per device, and a parsing engine that selects its own templates — FIG.02.

Conventional TextFSM makes you pick the right template up front. Guess wrong and you get silent garbage, and every new command or vendor means another hand-wired selection branch. tfsm-fire inverts that: hand it raw CLI output and a loose hint, and it runs every candidate template, scoring each parse on a 100-point rubric — record count, field richness, population rate, and consistency — then returns the best match. There is no selection logic to maintain.

A traceroute probes from the outside with ICMP and sees hop IPs. It's blind to RIB-versus-FIB divergence, incomplete ARP, and any ECMP path it didn't happen to hash into. fibtrace goes inside-out: it SSHes into each device and reads that device's own forwarding tables, asking four questions at every hop — is there a route, is it in the FIB, is the next-hop resolved, is the link healthy — and identifies devices by CLI-prompt hostname rather than IP, because in real networks the management address rarely matches the forwarding plane.

The result is a directed graph of every path a packet can take from source to destination — ECMP fan-out, convergence points, and terminal nodes included. No agents, no controllers; just SSH and a browser.