![]()
Foxtrotter has been my longest withstanding project with the most development hours behind it, which lends a lot of the icon sets from it to this site. Initially created to provide a simple map of devices based on IP ranges, hostnames, or layer 3 hops in the path, it has continued to evolve into a discovery and reporting tool to document unknown environment. The underlying purpose is simple but effective - mimic the end user interaction with the network to provide observability or automate changes at scale. While this seems like a simple enough phrase, I continuously see commercial products which fall short of this mark - whether it's expecting the list of management addresses (leaving the unknown still unknown), attempting to connect to every IP in a subnet (which is just a reconnaissance attack), or even asking for SNMP information (if I put that on there, there's a good chance I know it exists!). Instead, Foxtrotter uses the same management protocols an operator would and only connects to IP addresses if there is an indication it would be a network device.
The current phase of development centers on abstracting device configurations into virtual models. I have seen numerous vendors speak to this idea, but in each case, they fall short of creating a fully detached virtual model as they rely either on the device configuration for testing and parsing or they force themselves as the authoritative source of configuration. However, these both fall short in production as it changes the environment for the tool - not integrate the tool into the environment. The goal is to achieve true vendor agnosticism such that every device is parsed to a Common Information Model (CIM) similar to how SIEMs handle the alerting from various security vendors. As the development continues, I'll add screenshots and GIFs of workflows - and of course, invitation for beta testers!