Network control plane · DDoS response
Rerouter turns interface and flow telemetry into controlled mitigation workflows for Cisco IOS edge networks. It was designed for the uncomfortable gap between “we see an attack” and “we can change routing without creating a second incident.”
The operator problem
During volumetric attacks, the hard part is not only detecting a threshold. Operators need current device inventory, a bounded target, a reviewed command set, a reversible action, and a record of what actually happened.
The engineering response
Rerouter keeps the decision, command rendering, execution state, verification and rollback in one controller. Every dangerous transition remains explicit, permissioned and attributable.
Capabilities
The project combines network engineering, safety-critical backend design, a usable operations interface, and production deployment discipline—exactly the mix required for high-impact infrastructure automation.
SNMP rate derivation, BGP state, NetFlow v9 and sFlow v5 buckets, with stale-data handling and exporter confidence.
Thresholds, duration, consecutive samples, cooldowns and flow selectors avoid firing on a single noisy measurement.
Typed parameters render bounded Cisco IOS actions for RTBH, BGP peers, route maps and controlled interface workflows.
TOTP, RBAC, manual-only action classes, one-use previews and explicit arming keep execution behind visible gates.
Separate read-only SSH verification, persisted action state and uncertain-state locks make failures diagnosable and recoverable.
Email and Teams delivery, audit views, device health and exact would-run plans give operators usable incident context.
System shape
The browser never reaches routers. The Rust controller is the only writer, MariaDB is the system of record, and network actions travel through a narrow, verified device-CLI seam.
What this proves
Rerouter is evidence of how Cloud Craft approaches high-risk automation: model the failure states first, keep the operating surface legible, and make every transition observable.
More projects
Routing infrastructure, public network visibility, and broadcast transport—different domains, the same production-first engineering.
Bring us the difficult system
Tell us what you operate, where manual steps are slowing incident response, and which actions cannot be allowed to fail silently. We can help with architecture, implementation, deployment and operational handover.
