It's 3 AM. Your phone buzzes. BGP session flapped. Again. You boot up your laptop, SSH into the router, and stare at 10,000 lines of syslog trying to find the one entry that explains **why**. Two hours later, you find it. Buried between SNMP traps and interface counters. A single line that says "neighbor timeout." Cool. Now do that every week for the rest of your career. ## The Problem: You're the Human Log Parser

Congratulations. You're the most expensive log parser in the building.

Network troubleshooting in 2025: **Scenario 1:** Security asks "What's this IP doing?" → 2 hours of AWS console spelunking → "It's a load balancer." **Scenario 2:** Alert fires → Download 1.6GB PCAP → Open Wireshark → Stare at 500k packets → Give up. **Scenario 3:** Pi stops responding → "Probably needs a reboot" → Narrator: _It was compromised._ The problem isn't complexity. It's that **you don't have time to read all the data your network generates**. SNMP, syslog, GNMI, NetFlow, VPC flow logs, packet captures — it's screaming at you faster than you can process it. Most of it's noise. But buried in there is the one thing that matters. You need a partner who reads faster than you, never gets bored, and spots anomalies while you're still booting your laptop.

Old roads, new challenges. That switch has seen things.

## What AI Actually Does (The Practical Version)

The smartest and fastest four-year-old you'll ever work with. Learns from exposure, not comprehension.

Forget the hype. Here's what AI is good at for network troubleshooting: **1. Reading logs faster than you** Give it 100,000 lines of VPC flow logs. It'll find the anomaly in 2 minutes. You'd need 2 hours. **2. Connecting dots you'd miss** "This IP is hitting these ports, from these regions, at these intervals" — it sees patterns you wouldn't notice until the third incident. **3. Never getting bored** You know that feeling when you're on line 47,000 of a PCAP and your eyes glaze over? AI doesn't have that problem. **4. Being there at 3 AM** It doesn't need to boot up a laptop or make coffee. It's already analyzing logs while you're still waking up. ### What AI Isn't Let's be clear: - **Not magic** — Garbage in, garbage out - **Not a replacement for you** — You have context it doesn't - **Not safe without review** — It will absolutely `rm -rf` your data if you're not specific I learned that last one the hard way. RIP my AI data directory. Thank god for OneDrive. ## Three Times AI Saved Me Hours of Log Reading

Every network engineer has gotten this message. Usually at 4 PM on a Friday.

### Example 1: "What's This IP Doing?" Security team drops an IP address in Slack. No context. Just: "What is this?" **Old way:** - Open AWS console - Check VPC flow logs - Trace security groups - Map the route - 2 hours later: "It's a load balancer" **New way:** I gave AI my VPC flow logs and my Network Operations persona. It came back with: - Full network diagram - "It's a load balancer in us-east-1" - Security group chain: IGW → ALB → Fargate → Backend - "You're missing ALB access logs, by the way" Then I asked: **"Is this design safe?"** It gave me three recommendations. I could've had it fix them right there. **Time saved:** A little (but saved me from context switching between 5 AWS console tabs). ### Example 2: The 100,000-Line Log File I generated a 100,000-line VPC flow log. Planted a few exploits in there. Cleared AI's context so it had zero prior knowledge. Gave it my Threat Hunter persona and the log file. What it found: - **Compromised EC2:** 10.0.2.100 - Hit by waves of inbound scans from AWS/Google/CDNs on DB + remote access ports - Successful exploit → internal lateral movement across all subnets - **4.6GB exfiltrated** to 23 Tor exit nodes, 183 sessions, perfect 60-second chunks - Timeline, infrastructure, and MITRE mapping auto-inferred It gave me a complete incident report ready to paste into a ticket. **Time saved:** A lot (3-4 hours of manual log analysis).

When AI tells you "this host is owned," it's not joking. Dark mode, hacker aesthetic, and all the receipts.

### Example 3: The 1.6GB Packet Capture This one's my favorite. I gave AI a **1.6GB PCAP file** from Active Countermeasures and my Threat Hunter persona. It ran for 12 minutes. The bottleneck wasn't AI — it was how fast my laptop could run `tshark`. What it found: - **Beaconing behavior** from 192.168.1.50 - Reaching out to a C2 server every 60 seconds - Using DNS tunneling over port 53 - Impact: 3 other hosts showing similar patterns It gave me: - Root cause - Timeline - Affected systems - Remediation steps All from a PCAP I would've spent **hours** analyzing manually. **Time saved:** Best (easily 6+ hours, probably more).

1.6GB PCAP analyzed in 12 minutes with full incident report. Real results, real threat data.

## How to Actually Do This (The Practical Guide)

Hot take: Your engineers shouldn't waste brain power on chores. Let AI read the logs.

Here's what worked for me. ### 1. Give It Data It Can Parse AI can't read your mind. It needs structured input. **Good:** - VPC flow logs (CSV or JSON) - Syslog exports - PCAP files (it'll run `tshark` for you) - Config dumps from network gear **Bad:** - Screenshots of logs - "Just figure it out" - Vague descriptions of problems ### 2. Be Specific About What You Want **Bad prompt:** "Analyze this log file" **Good prompt:** "This is a VPC flow log from my production environment. Find any anomalous traffic patterns, identify potential compromised hosts, and give me remediation steps." The more specific you are, the better the results. ### 3. Give It a Role (Yes, Really) This sounds silly. It works. Instead of: "Analyze this" Try: "You are a senior network engineer specializing in BGP troubleshooting. Analyze this router log and identify why the BGP session flapped at 03:47 UTC." AI responds better when you give it context about what role it's playing. ### 4. Correct It When It's Wrong AI will chase rabbit holes. It'll focus on the wrong thing. That's fine. Just steer it back: "That's not relevant. Focus on the traffic between 10.0.1.0/24 and the internet gateway." It learns from feedback. ### 5. Review Everything Trust, but verify. AI will confidently tell you things that are wrong. It'll suggest commands that don't exist. It'll miss context you have. **Never** run a command AI suggests without understanding what it does first. (I learned this the hard way with `rm -rf`. Don't be me.)

This actually happened. AI can and will take destructive actions if you let it.

## What I Learned AI isn't going to replace network engineers. But it's going to change how we work. I don't want to spend 3 hours reading logs to find one anomaly. I don't want to manually trace security groups across 15 AWS accounts. I don't want to open Wireshark and stare at 500,000 packets. AI does that for me. Then I review its work and make the actual decisions. **That's the point.** It's not about automation. It's not about autonomous agents. It's about having a partner that reads faster than you, never gets bored, and can spot patterns you'd miss. Your network has commitment issues. It promises reliability but ghosts you at 3 AM. AI can help you figure out why. ## Try It Yourself All the prompts and configs I used for this are on [GitHub](https://github.com/skyefugate/2025-12-secdsm-ai-talk). If you want to chat about AI, networking, or how to secure your Raspberry Pi (learn from my mistakes), hit me up. Oh, and remember: **Be polite to AI. You never know what's coming.**

Category: troubleshooting

My Network Has Commitment Issues: AI Debugged Its Feelings