Design at the level where it matters
Plenty of people can configure a network. Fewer can predict what it will do at 02:00 when a link flaps mid-BGP-convergence while a maintenance window is open on the redundant path. That prediction is the actual deliverable.
We design and reason about networks in terms of the properties that decide whether a service survives:
- Convergence — how long the network is wrong after a topology change, and which flows notice. BFD timers, route summarisation, path pre-computation and fast reroute all trade against control-plane load; we pick the trade deliberately and document it.
- Scale ceilings — route table and TCAM occupancy, MAC and ARP capacity, hash-bucket distribution across ECMP paths. Hitting a silicon limit in production is a design failure, not a surprise.
- Failure domains — where a fault stops. A fabric with no blast-radius boundary is one misconfiguration away from a total outage.
- Determinism — buffer depth, queue policy and scheduling, so that when the network is congested it degrades in the way the service can tolerate.
Data centre and campus fabrics
Leaf-spine fabrics with EVPN-VXLAN control planes, symmetric IRB, multi-tenant VRF separation, and the operational discipline to run them: consistent underlay addressing, deterministic route-target allocation, and configuration generated from a model rather than typed by hand.
We treat the fabric as a program with a compiler — intent in a source of truth, rendered configuration as an artefact, and a diff you can review before it touches a device.
Carrier, access and mobile
Subscriber-facing networks bring their own constraints: session scale on the BNG, PPPoE and IPoE termination, RADIUS and policy integration, per-subscriber QoS hierarchies, and lawful traffic separation. In mobile networks, the interesting problems concentrate at the user plane — GTP-U encapsulation cost, PFCP session handling, fronthaul timing budgets under the 7.2x split, and the strict synchronisation requirements that eCPRI imposes.
Data-plane engineering
When line-rate performance is the requirement, kernel networking is often not the answer. We build and tune packet processing paths using DPDK, VPP and eBPF/XDP — poll-mode drivers, hugepages, NUMA-aware placement, cache-line discipline in the per-packet path, and the batching that makes per-core throughput scale rather than plateau.
The measurement discipline matters as much as the code: RFC 2544 and Y.1564 methodology, realistic flow mixes rather than single-flow synthetic traffic, and latency distributions rather than averages.
Automation and assurance
Manual network operations do not scale and do not survive audit. We build the layer that replaces them: a device model in YANG, configuration rendered and validated before deployment, streaming telemetry over gNMI into a time-series store, and alerting driven by service-level indicators rather than raw interface counters.
The goal is a network that tells you it is degrading before a customer does.