Your Network Has No Memory

The monitoring asymmetry

Network operations in 2026 has a strange imbalance. The tools for knowing something is wrong are excellent. The tools for proving what caused it are not.

This is the gap. Not between humans and AI. Between knowing something is wrong and proving what caused it.

The response is predictable: more dashboards, more filters, more escalation rules. Each layer reduces noise at the cost of complexity. The monitoring stack grows. The number of browser tabs grows. The time to diagnose does not shrink proportionally because the tools know what is happening. They do not know why.

Root cause analysis is still a human skill. An experienced network engineer can look at a combination of BGP flap, interface errors, and latency spike and know it is a failing SFP module on a specific uplink. A junior engineer looking at the same data sees three unrelated alerts. The institutional knowledge that connects them lives in the heads of senior staff, not in the tools.

When that senior engineer leaves, the knowledge leaves with them.

The last mile: from monitoring to action

Network automation exists. Ansible has networking modules. Nornir and NAPALM can push configuration to routers. Oxidized backs up configs. NetBox tracks inventory. These are good tools. But there is a gap between "I can automate a config push" and "I have a governed, auditable system that can diagnose a problem, propose a fix, get approval, execute it, and record what happened."

The operations chain, from monitoring to record, is: Monitor, Diagnose, Propose, Approve, Execute, Record. Most network automation covers step one. The remaining five are manual, unrecorded, or both.

Most network automation is fire-and-forget. A script runs. It pushes config. If something breaks, you check the script output, diff the config, and hope the backup is recent. There is no structured record of the decision chain: what triggered the change, what the system considered, what alternatives existed, and what the outcome was.

For a three-person team managing a flat network, this works. For a WISP with 200 sites, an MSP managing client infrastructure, or any organisation subject to NIS2, DORA, or PCI DSS, it does not.

What AI should actually do for network engineers

The vendor pitch for AI in networking has been "intent-based" and "self-driving" for five years. The reality has been auto-complete for CLI commands and slightly better anomaly detection. Network engineers are justifiably sceptical. Here is what would actually help.

• Correlate across data sources. When a site goes down, pull the BGP state, interface counters, SNMP traps, syslog entries, and recent config changes into one view. Not as five separate dashboards. As one answer: "Site 7 lost BGP adjacency at 14:32 because interface ether3 went down. Last config change was 3 hours ago by admin-user via Winbox."
• Know the network. Remember that switch-04 had SFP issues last month. Know that the DHCP pool on VLAN 20 is 90% full. Track which firmware versions are running across the fleet. Build this knowledge over time, not from scratch every session.
• Propose, do not execute. Suggest the fix. Show the commands. Wait for approval. Network engineers do not want AI making firewall changes at 3am without supervision. They want AI that does the diagnosis at 3am and has a proposed fix ready when they wake up.
• Record everything. Every diagnostic query, every proposed change, every approval, every execution. A structured, tamper-evident record that answers "what happened to the network" for auditors, incident reviews, and the engineer who was not on call.

What Quox built for this

Quox is not a network management platform. It is an AI agent orchestration platform that happens to have strong network capabilities because the founder manages 50+ hosts and a MikroTik network himself.

• NETWATCH (MikroTik RouterOS Specialist)
  • Device discovery across the network
  • Health monitoring (CPU, memory, uptime, interface status)
  • DHCP lease management and IP conflict detection
  • Firewall rule analysis
  • Guided troubleshooting with safe automation
• SENTINEL (Security Operations)
  • Firewall audits and rule analysis
  • Network scans and vulnerability detection
  • CVE lookups against running firmware
  • SSL certificate monitoring
  • Security posture assessment
• NOVA (Network Operations)
  • Traffic analysis and bandwidth monitoring
  • Connectivity testing and path tracing
  • VPN health and tunnel status
  • DNS management and resolution checks
  • Prometheus query integration
• QuoxBastion (SSH Gateway, Go)
  • Single auditable entry point for all SSH
  • Every session logged, every command traceable
  • Fleet-wide access control
  • Session recording for incident review
  • "Who accessed the core router last night?" has an answer

Prometheus and Grafana tie into the collector service. Your existing monitoring data is available to the AI agents. They query it, correlate it, and present it. No rip-and-replace.

VOLT records every action. When NETWATCH checks a router's health, the query and result are recorded in a hash-chained evidence trail. When SENTINEL audits firewall rules, the audit and findings are recorded. When an engineer approves a change, the approval is recorded. The chain is tamper-evident. If any entry is modified after the fact, the chain breaks.

The MikroTik gap

MikroTik has the market share. Management tooling has not kept up.

MikroTik has enormous market share in the ISP, WISP, and SMB segments globally. RouterOS is powerful, flexible, and affordable. The Dude is free but limited. Winbox is excellent for single-device management. Managing a fleet of 30, 50, or 200 MikroTik routers means either writing custom scripts, using Ansible with the RouterOS module, or clicking through Winbox sessions one by one.

NETWATCH capabilities

• RouterOS API integration (not SSH scraping)
• Fleet-wide device discovery
• Health monitoring across all devices
• DHCP conflict detection
• Firewall rule analysis
• Ships as a plugin: enable if you need it

Try it

Point it at your network. Install QuoxAgent on your hosts. Enable the MikroTik plugin if you run RouterOS. See what happens when your monitoring data, your SSH access, and an AI that remembers your network all live in the same system.

Quox is source-available under BSL 1.1. NETWATCH speaks RouterOS. SENTINEL audits firewalls. NOVA queries Prometheus. QuoxBastion logs every SSH session. VOLT records every action in a tamper-evident chain. Built by someone who got tired of diagnosing network problems from six browser tabs and a fading memory of what changed last week.