| |
| """ |
| parse_modern.py — curated "modern ops" command corpus. |
| |
| Adds the four coverage gaps the cheatsheet was thin on: |
| - Telemetry : gNMI / gRPC dial-out / NETCONF / RESTCONF / streaming |
| - Automation : on-box programmability, model-driven config, scripting |
| - Provisioning : ZTP / day-0 / zero-touch bring-up |
| - Optics : interface breakout + transceiver/DOM diagnostics |
| - Hardening : security baselines (telnet off, SSH ciphers, CoPP, MACsec) |
| |
| Schema: { os, role, vendor, cat, title, cmd, desc } |
| Hand-curated, publicly documented vendor syntax. Merges into commands.json |
| deduping by (vendor, normalized cmd) — same key the rest of the pipeline uses. |
| """ |
| import json, re, pathlib, sys |
|
|
| OUT = pathlib.Path(__file__).parent.parent / "commands.json" |
|
|
| def norm_cmd(s: str) -> str: |
| return re.sub(r"\s+", " ", (s or "").strip().lower()) |
|
|
| REC = [] |
| def r(vendor, os_, role, cat, title, cmd, desc): |
| REC.append({"os": os_, "role": role, "vendor": vendor, |
| "cat": cat, "title": title, "cmd": cmd, "desc": desc}) |
|
|
| |
| |
| r("Arista","eos","switch","Telemetry","gNMI Get (gnmic)", |
| "gnmic -a <switch>:6030 -u admin -p admin --insecure get --path /interfaces/interface/state/counters", |
| "Pull interface counters once over gNMI from an EOS device.") |
| r("Arista","eos","switch","Telemetry","gNMI Subscribe sample (gnmic)", |
| "gnmic -a <switch>:6030 -u admin -p admin --insecure subscribe --path /interfaces/interface/state/counters --mode sample --sample-interval 10s", |
| "Stream interface counters every 10s via gNMI sample subscription.") |
| r("Arista","eos","switch","Telemetry","gNMI Subscribe on-change (gnmic)", |
| "gnmic -a <switch>:6030 --insecure subscribe --path /network-instances/.../state --mode on_change", |
| "Receive updates only when a leaf changes (on-change subscription).") |
| r("Arista","eos","switch","Telemetry","Enable gNMI server (EOS)", |
| "management api gnmi\n transport grpc default\n provider eos-native", |
| "Enable the on-box gNMI/gRPC transport on Arista EOS.") |
| r("Arista","eos","switch","Telemetry","Enable streaming telemetry to collector", |
| "daemon TerminAttr\n exec /usr/bin/TerminAttr -ingestgrpcurl=<cvp>:9910 -taillogs\n no shutdown", |
| "Stream state to CloudVision / a gRPC collector via TerminAttr.") |
| r("Cisco","ios","router","Telemetry","Model-driven telemetry dial-out (IOS-XE)", |
| "telemetry ietf subscription 101\n encoding encode-kvgpb\n filter xpath /interfaces-ios-xe-oper:interfaces/interface/statistics\n stream yang-push\n update-policy periodic 1000\n receiver ip address <collector> 57500 protocol grpc-tcp", |
| "Periodic gRPC dial-out streaming telemetry subscription on IOS-XE.") |
| r("Cisco","nxos","switch","Telemetry","Streaming telemetry path (NX-OS)", |
| "telemetry\n destination-group 1\n ip address <collector> port 50001 protocol gRPC encoding GPB\n sensor-group 1\n path sys/intf depth 0\n subscription 1\n dst-grp 1\n snsr-grp 1 sample-interval 10000", |
| "Configure NX-OS model-driven telemetry to a gRPC collector at 10s.") |
| r("Juniper","junos","router","Telemetry","gRPC streaming telemetry (JTI)", |
| "set services analytics streaming-server collector address <ip> port 50051\nset services analytics export-profile prof reporting-rate 30", |
| "Junos Telemetry Interface gRPC export profile (native sensors).") |
| r("Juniper","junos","router","Telemetry","gNMI / OpenConfig subscribe", |
| "set system services extension-service request-response grpc clear-text port 32767", |
| "Enable the gNMI/gRPC server on Junos for OpenConfig telemetry.") |
| r("Nokia","srlinux","router","Telemetry","gNMI subscribe (SR Linux)", |
| "gnmic -a <node>:57400 --skip-verify -u admin -p admin subscribe --path /interface[name=ethernet-1/1]/statistics", |
| "Subscribe to per-interface statistics on Nokia SR Linux over gNMI (port 57400).") |
| r("Nokia","srlinux","router","Telemetry","Enable gNMI server (SR Linux)", |
| "enter candidate\nset / system gnmi-server network-instance mgmt admin-state enable\ncommit now", |
| "Enable the gNMI server in the mgmt network-instance on SR Linux.") |
| r("NVIDIA","nvue","switch","Telemetry","gNMI server (Cumulus NVUE)", |
| "nv set system gnmi-server listening-address 0.0.0.0\nnv config apply", |
| "Turn on the gNMI server on Cumulus Linux via NVUE.") |
| r("SONiC","sonic","switch","Telemetry","gNMI / telemetry container status", |
| "show feature status | grep telemetry\ndocker ps | grep telemetry", |
| "Verify the gNMI/telemetry (gnmi) container is running on SONiC.") |
| r("SONiC","sonic","switch","Telemetry","gNMI get via gnmic", |
| "gnmic -a <device>:8080 --insecure -u admin -p YourPaSsWoRd get --path /interfaces/interface/state", |
| "Query SONiC interface state over gNMI (default telemetry port 8080).") |
| |
| r("Arista","eos","switch","Telemetry","sFlow export", |
| "sflow sample 16384\nsflow destination <collector>\nsflow run", |
| "Enable sFlow sampling and export on EOS.") |
| r("Cisco","ios","router","Telemetry","Flexible NetFlow / IPFIX", |
| "flow exporter EXP\n destination <collector>\n transport udp 4739\nflow monitor MON\n exporter EXP\n record netflow ipv4 original-input\ninterface Gi0/0\n ip flow monitor MON input", |
| "Flexible NetFlow with IPFIX (UDP/4739) export on IOS-XE.") |
| r("Juniper","junos","router","Telemetry","Inline IPFIX (jflow)", |
| "set services flow-monitoring version-ipfix template IPv4 flow-active-timeout 60\nset forwarding-options sampling instance S family inet output flow-server <ip> port 4739", |
| "Inline-jflow IPFIX sampling/export on Junos.") |
| r("VyOS","vyos","router","Telemetry","sFlow agent", |
| "set system sflow interface eth0\nset system sflow server <collector> port 6343", |
| "Configure sFlow export on VyOS.") |
|
|
| |
| r("Cisco","ios","router","Automation","NETCONF over SSH enable", |
| "netconf-yang\nnetconf ssh", |
| "Enable the NETCONF/YANG agent (port 830) on IOS-XE.") |
| r("Cisco","ios","router","Automation","RESTCONF enable", |
| "restconf\nip http secure-server", |
| "Enable RESTCONF (HTTPS) on IOS-XE for model-driven config.") |
| r("Cisco","ios","router","Automation","Guest Shell / on-box Python", |
| "guestshell enable\nguestshell run python3 /flash/script.py", |
| "Run on-box Python from the IOS-XE Guest Shell container.") |
| r("Cisco","ios","router","Automation","EEM applet (event automation)", |
| "event manager applet LINKDOWN\n event syslog pattern \"Interface GigabitEthernet0/1, changed state to down\"\n action 1.0 cli command \"enable\"\n action 2.0 syslog msg \"Gi0/1 went down\"", |
| "Embedded Event Manager applet reacting to a syslog event.") |
| r("Cisco","nxos","switch","Automation","On-box Python / bash", |
| "feature bash-shell\nrun bash python3 /bootflash/script.py", |
| "Enable and run on-box scripting on NX-OS.") |
| r("Juniper","junos","router","Automation","NETCONF over SSH", |
| "set system services netconf ssh", |
| "Enable NETCONF on port 830 for ncclient/Ansible on Junos.") |
| r("Juniper","junos","router","Automation","Commit script / SLAX op", |
| "set system scripts op file myscript.slax\nop myscript", |
| "Register and run a Junos op (SLAX/Python) automation script.") |
| r("Juniper","junos","router","Automation","JET / Python on-box", |
| "set system scripts language python3\nset event-options event-script file handler.py", |
| "Enable Python scripting and an event handler on Junos.") |
| r("Arista","eos","switch","Automation","eAPI (JSON-RPC) enable", |
| "management api http-commands\n protocol https\n no shutdown", |
| "Enable Arista eAPI (HTTPS JSON-RPC) for programmatic control.") |
| r("Arista","eos","switch","Automation","Config session (commit/rollback)", |
| "configure session add-vlan\n vlan 200\n name PROD\ncommit\n# or: abort / rollback clean-config", |
| "Stage changes in a named config session, then commit or abort — safe automation.") |
| r("Nokia","srlinux","router","Automation","JSON-RPC / candidate config", |
| "enter candidate\nset / interface ethernet-1/1 admin-state enable\ndiff\ncommit now", |
| "Declarative candidate→commit workflow on SR Linux (also exposed via JSON-RPC).") |
| r("FortiOS","fortios","firewall","Automation","REST API admin + token", |
| "config system api-user\n edit \"automation\"\n set api-key ENC ...\n set accprofile \"super_admin\"\n next\nend", |
| "Create a REST API user/token for FortiGate automation (cmdb/monitor).") |
| r("PAN-OS","panos","firewall","Automation","XML API key", |
| "request api key\n# GET https://<fw>/api/?type=keygen&user=admin&password=...", |
| "Generate the PAN-OS XML API key used for programmatic config/ops.") |
| r("VyOS","vyos","router","Automation","Config-mode scripting / commit", |
| "configure\nset interfaces ethernet eth1 address 10.0.0.1/24\ncommit\nsave\nexit", |
| "VyOS structured config with atomic commit (HTTP API mirrors this).") |
| r("NVIDIA","nvue","switch","Automation","NVUE REST API apply", |
| "nv config apply\n# REST: PATCH /nvue_v1/ with revisionID then apply", |
| "NVUE declarative apply; the same model is exposed over the REST API.") |
|
|
| |
| r("Arista","eos","switch","Provisioning","ZTP status / cancel", |
| "show zerotouch\nzerotouch cancel\nzerotouch disable", |
| "Inspect Zero Touch Provisioning state and opt out to a normal boot on EOS.") |
| r("Cisco","ios","router","Provisioning","Network Plug-and-Play (PnP) discovery", |
| "pnp profile pnp-zero-touch\n transport https ipv4 <pnp-server> port 443", |
| "Point IOS-XE PnP agent at a controller for day-0 onboarding.") |
| r("Cisco","ios","router","Provisioning","ZTP Guest Shell (IOS-XE)", |
| "# DHCP option 67 -> http://<srv>/ztp.py ; runs in Guest Shell at first boot\nshow guestshell\nguestshell run python3 /flash/ztp.py", |
| "IOS-XE day-0 Python ZTP delivered via DHCP option 67.") |
| r("Cisco","nxos","switch","Provisioning","POAP (PowerOn Auto Provisioning)", |
| "# abort to manual setup at boot prompt:\nskip poap\nshow boot", |
| "NX-OS POAP day-0 provisioning; 'skip' drops to the manual setup dialog.") |
| r("Juniper","junos","router","Provisioning","ZTP via DHCP", |
| "set chassis auto-image-upgrade\n# DHCP options 150/43 hand off image + config URL at boot", |
| "Enable Junos Zero Touch Provisioning (auto image + config from DHCP).") |
| r("Juniper","junos","router","Provisioning","ZTP status", |
| "show system autoinstallation status", |
| "Check the Junos auto-install / ZTP progress.") |
| r("SONiC","sonic","switch","Provisioning","ZTP control", |
| "sudo ztp status\nsudo ztp enable\nsudo ztp run\nsudo ztp disable", |
| "Manage SONiC ZTP (DHCP-driven provisioning.json) from the CLI.") |
| r("NVIDIA","nvue","switch","Provisioning","Cumulus ZTP", |
| "ztp -s\nztp --status\nztp --disable", |
| "Cumulus Linux ZTP: run the ZTP script, check status, or disable.") |
| r("Nokia","srlinux","router","Provisioning","ZTP / auto-boot", |
| "show system boot\n# ZTP pulls config/image via DHCP opt 66/67 + ztp-server", |
| "SR Linux Zero Touch Provisioning state at first boot.") |
| r("Aruba","aoscx","switch","Provisioning","ZTP / Aruba Central onboarding", |
| "show aruba-central\nshow ztp information", |
| "AOS-CX day-0: ZTP + Aruba Central activation status.") |
| r("FortiOS","fortios","firewall","Provisioning","Zero-touch via FortiManager", |
| "config system central-management\n set type fortimanager\n set fmg <ip>\nend", |
| "FortiGate zero-touch onboarding through FortiManager / FortiDeploy.") |
|
|
| |
| r("Arista","eos","switch","Optics","Interface breakout 4x25G", |
| "interface Ethernet1/1\n speed forced 100gfull\ninterface Ethernet1\n# 100G->4x25G:\n speed 25g-4", |
| "Break a 100G port into 4x25G on EOS (verify with 'show interfaces status').") |
| r("Arista","eos","switch","Optics","Show transceiver / DOM", |
| "show interfaces transceiver detail\nshow interfaces transceiver dom", |
| "Read optic type, Rx/Tx power and DOM thresholds on EOS.") |
| r("Cisco","nxos","switch","Optics","Port breakout (NX-OS)", |
| "interface breakout module 1 port 1 map 25g-4x", |
| "Split a 100G QSFP port into 4x25G on NX-OS.") |
| r("Cisco","ios","router","Optics","Show transceiver / DOM", |
| "show interfaces transceiver detail\nshow hw-module subslot transceiver", |
| "Display optic vendor, wavelength and digital optical monitoring values.") |
| r("Cisco","ios","router","Optics","Breakout (IOS-XE)", |
| "controller TenGigabitEthernet0/0/0\n breakout 4x10", |
| "Configure a breakout group on IOS-XE platforms that support it.") |
| r("Juniper","junos","router","Optics","Channelize / breakout", |
| "set chassis fpc 0 pic 0 port 1 number-of-sub-ports 4 speed 25g", |
| "Channelize a 100G port into 4x25G sub-ports on Junos.") |
| r("Juniper","junos","router","Optics","Show optics / DOM", |
| "show interfaces diagnostics optics et-0/0/1", |
| "Per-lane Rx/Tx power, bias and temperature for an optic on Junos.") |
| r("Nokia","srlinux","router","Optics","Breakout port", |
| "enter candidate\nset / interface ethernet-1/1 breakout-mode num-channels 4 channel-speed 25G\ncommit now", |
| "Declarative 4x25G breakout on SR Linux.") |
| r("NVIDIA","nvue","switch","Optics","Breakout (NVUE)", |
| "nv set interface swp1 link breakout 4x25G\nnv config apply", |
| "Break swp1 into 4x25G on Cumulus via NVUE.") |
| r("Aruba","aoscx","switch","Optics","Split / breakout interface", |
| "interface 1/1/1\n split\nshow interface transceiver detail", |
| "Enable a split (breakout) interface and read optic DOM on AOS-CX.") |
| r("Extreme","exos","switch","Optics","Show optical / DOM", |
| "show ports transceiver information detail", |
| "Per-port transceiver DOM (power/temp) on EXOS.") |
| r("SONiC","sonic","switch","Optics","Transceiver / DOM + breakout", |
| "show interfaces transceiver eeprom\nshow interfaces transceiver presence\nsudo config interface breakout Ethernet0 '4x25G'", |
| "Read SFP EEPROM/presence and set a dynamic port breakout on SONiC.") |
| r("Cisco","nxos","switch","Optics","Show transceiver (NX-OS)", |
| "show interface ethernet1/1 transceiver details", |
| "Optic type and DOM Rx/Tx power for a single NX-OS port.") |
|
|
| |
| r("Cisco","ios","router","Hardening","Disable telnet, SSH-only mgmt", |
| "line vty 0 15\n transport input ssh\n exec-timeout 5 0\nip ssh version 2", |
| "Force SSHv2-only management access and idle timeout on VTYs.") |
| r("Cisco","ios","router","Hardening","Harden SSH ciphers / KEX", |
| "ip ssh server algorithm encryption aes256-gcm aes256-ctr\nip ssh server algorithm mac hmac-sha2-256\nip ssh server algorithm kex diffie-hellman-group14-sha256", |
| "Restrict SSH to strong ciphers/MAC/KEX on IOS-XE.") |
| r("Cisco","ios","router","Hardening","Control-plane policing (CoPP)", |
| "control-plane\n service-policy input COPP-POLICY", |
| "Apply a CoPP policy to rate-limit traffic punted to the control plane.") |
| r("Cisco","ios","router","Hardening","Disable risky services", |
| "no ip http server\nno cdp run\nno service pad\nservice password-encryption\nlogin block-for 60 attempts 3 within 30", |
| "Turn off legacy/unneeded services and add login brute-force protection.") |
| r("Cisco","ios","switch","Hardening","MACsec (802.1AE) on link", |
| "interface Gi1/0/1\n macsec\n mka policy MKA-POL\n mka pre-shared-key key-chain KC", |
| "Enable MACsec link-layer encryption with MKA on a switchport.") |
| r("Juniper","junos","router","Hardening","SSH-only, no telnet", |
| "delete system services telnet\nset system services ssh protocol-version v2\nset system services ssh ciphers aes256-gcm@openssh.com", |
| "Remove telnet and pin SSHv2 with a strong cipher on Junos.") |
| r("Juniper","junos","router","Hardening","Loopback / control-plane filter (lo0)", |
| "set interfaces lo0 unit 0 family inet filter input PROTECT-RE", |
| "Protect the Routing Engine by filtering traffic to lo0 (control plane).") |
| r("Juniper","junos","router","Hardening","MACsec connectivity association", |
| "set security macsec connectivity-association CA1 pre-shared-key ckn <hex> cak <hex>\nset security macsec interfaces ge-0/0/1 connectivity-association CA1", |
| "Configure MACsec with a pre-shared CAK/CKN on a Junos interface.") |
| r("Arista","eos","switch","Hardening","Management SSH hardening", |
| "management ssh\n cipher aes256-gcm@openssh.com\n idle-timeout 5\nno service telnet", |
| "Strong SSH ciphers, idle timeout and telnet disabled on EOS.") |
| r("Arista","eos","switch","Hardening","Control-plane ACL (CoPP)", |
| "system control-plane\n ip access-group COPP-IN in", |
| "Apply a control-plane ACL to protect the EOS CPU.") |
| r("FortiOS","fortios","firewall","Hardening","Admin access + strong crypto", |
| "config system global\n set admin-ssh-grace-time 30\n set strong-crypto enable\n set admintimeout 5\nend", |
| "Enforce strong crypto, short admin timeout and SSH grace on FortiGate.") |
| r("FortiOS","fortios","firewall","Hardening","Restrict admin to trusted hosts", |
| "config system admin\n edit admin\n set trusthost1 10.0.0.0 255.255.255.0\n next\nend", |
| "Lock the FortiGate admin account to a management subnet.") |
| r("PAN-OS","panos","firewall","Hardening","Disable telnet/HTTP mgmt", |
| "set deviceconfig system service disable-telnet yes\nset deviceconfig system service disable-http yes", |
| "Disable insecure management services on Palo Alto.") |
| r("PAN-OS","panos","firewall","Hardening","Permitted management IPs", |
| "set deviceconfig system permitted-ip 10.0.0.0/24", |
| "Restrict which subnets may reach the PAN-OS management interface.") |
| r("Aruba","aoscx","switch","Hardening","SSH-only + login hardening", |
| "no telnet-server\nssh server vrf mgmt\naaa authentication login default group radius local", |
| "Disable telnet, bind SSH to the mgmt VRF, and require AAA login on AOS-CX.") |
| r("Huawei","vrp","router","Hardening","Disable telnet, enforce SSH", |
| "undo telnet server enable\nstelnet server enable\nssh server cipher aes256_gcm", |
| "Turn off telnet and enforce STelnet (SSH) with strong ciphers on VRP.") |
| r("Nokia","srlinux","router","Hardening","SSH server + ACL", |
| "enter candidate\nset / system ssh-server network-instance mgmt admin-state enable\ncommit now", |
| "Restrict SSH to the mgmt network-instance on SR Linux.") |
| r("VyOS","vyos","router","Hardening","SSH hardening", |
| "set service ssh disable-password-authentication\nset service ssh ciphers aes256-gcm@openssh.com\ndelete service telnet", |
| "Key-only SSH with a strong cipher and no telnet on VyOS.") |
| r("Mikrotik","routeros","router","Hardening","Disable insecure services", |
| "/ip service disable telnet,ftp,www,api\n/ip service set ssh port=2200", |
| "Disable telnet/FTP/HTTP/API and move SSH off the default port on RouterOS.") |
| r("Linux","linux","router","Hardening","Host SSH daemon hardening", |
| "sudo sed -i 's/^#\\?PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config\nsudo systemctl reload ssh", |
| "Disable SSH password auth on a Linux network host.") |
|
|
| |
| def main(): |
| data = json.load(open(OUT)) |
| keys = {(r_["vendor"], norm_cmd(r_["cmd"])) for r_ in data} |
| added = skipped = 0 |
| for rec in REC: |
| k = (rec["vendor"], norm_cmd(rec["cmd"])) |
| if k in keys: |
| skipped += 1 |
| continue |
| keys.add(k) |
| data.append(rec) |
| added += 1 |
| if "--dry-run" in sys.argv: |
| print(f"[dry-run] candidates={len(REC)} would-add={added} dup-skip={skipped}") |
| return |
| with open(OUT, "w") as f: |
| json.dump(data, f, separators=(",", ":")) |
| print(f"added={added} dup-skip={skipped} total={len(data)}") |
|
|
| if __name__ == "__main__": |
| main() |
|
|
