Abstract
A method for measuring how strong a set of network verification checks is. The checks pass on a lab of real network-operating-system software booted from a team's own configurations. The lab is then mutated with known-bad variants generated from its own configuration: customer leaks sized to the edge of each prefix-count range, removed import-filter lines, sessions or links down, attribute drift, default or link-subnet leaks. Each variant is applied, confirmed, reverted and verified against a canonical baseline snapshot. It is classified as caught, survived, no effect or inconclusive from post-policy routing-state differences, excluding the variant's own footprint. The report lists the blind spots and suggests checks written from the baseline state. The publication covers CLI, CI and AI-agent (MCP) use, and variations across protocols, network operating systems, model-based verifiers and variant selection.
Creative Commons License
This work is licensed under a Creative Commons Attribution 4.0 License.
Recommended Citation
KHEN, VICTOR, "Check strength: measuring network checks against known-bad variants", Technical Disclosure Commons, ()
https://www.tdcommons.org/dpubs_series/12682