Jeffrey Wilson
Network Architect & Automation Engineer
BGP Operations & Incident Response
Diagnosed campus-wide CDN loss as an inbound traffic-steering prefix leak overnight, sent a cold email to a Google network engineer at 8:40am day 2, and had confirmation in hand before the war room reconvened: restored service via peer shutdown within minutes. Followed with RPKI/ROA registration and a permanent BGP advertisement redesign that eliminates the leak vector class. Multihomed ISP policy, RTBH, uRPF, and carrier WAN boundary design across a 20-year arc.
Network Automation
Built production automation across the full threat response lifecycle — RTBH blackhole injection via iBGP, email parsing, and Quagga CLI wrapping — replacing a multi-step approval workflow with a single-operator paste operation. Authored a TextFSM template corpus against five OS families with preflight coverage reporting and per-site gap analysis. Splunk, Palo Alto, CA Spectrum, and DHCP telemetry pipelines built in Perl and Python; homegrown NMS/IPAM validated by commercial replacement on departure.
Campus Fabric Architecture
Enforced NNI-only core boundary on the 2024 campus overhaul against organizational pushback — held design position through completion on the basis that collapsing edge ports onto core merges failure domains and destroys deterministic troubleshooting. Guided distribution-layer VRF design and provided architectural clarity on isolated FIB sharing a common SPBM backbone. Consolidated the LEARN provider boundary in 2023 by learning IOS-XR l2transport to collapse a discrete L2 breakout switch into ASR subinterfaces — eliminated dedicated hardware, reduced capex, and cleaned the provider handoff stack.
Cross-Domain Authority
Owned the baylor.edu identity and HTTP architecture for 15 years — Palo NAT, F5 iRules, DNS, and SSL SAN cert stack — across four teams with no organizational mandate over any of them. Execution ran on reputation and trust; architecture scaled from 16K to 20K students and 1G to 2x10G ISP handoff without redesign. Personally built and operated F5 BigIP LTM configuration for years before a dedicated specialist was hired; retained architectural lead on novel point solutions even after the specialist came aboard.
Observability
Built a multi-source Grafana stack at zero budget and own initiative: Statseeker, Palo Alto HA pair session counts, DHCP pool utilization, and CA Spectrum asset data — all correlated in InfluxDB via custom Perl pipelines. Session count color-coding detected unexpected HA failover events five to six times over five years. DHCP pool alerting triggered wireless admin rebalancing workflow before client impact.
Overlay Networking
Network architecture advisor on NSX-v deployment and subsequent NSX-T transformation; SME for VXLAN-to-Geneve encapsulation migration and underlay implications. Led brownfield discovery and design-artifact generation for a multi-state hospital fabric upgrade targeting Cisco replacement — identified root cause of a production outage at the SPBM/Cisco boundary before either vendor team did.
Selected Writing
-
The Server That Never Talked: ARP TTL, FDB Aging, and a Broadcast Storm
An ARP TTL FDB aging mismatch turned a data center into a light show. Around 2005, every top-of-rack switch in the data center was blinking like a light show at a disco rave. I traced the cause back to a server doing exactly what its owner designed it to do. The failure wasn’t a misconfiguration,…
-
The Firewall Was the Wrong Layer: Automating Threat Response with BGP
The Firewall Was the Wrong Layer: Automating Threat Response with BGP A LinkedIn post I wrote about this covers the story: a daily infosec email, a firewall policy cycle, and the decision to stop doing the same fix by hand. This post goes deeper into the mechanics behind Remote Triggered Black Hole (RTBH) routing. Specifically,…
-
When the Interior Doesn’t Speak PIM: SPBM Multicast Root Cause
SPBM Multicast and a Replacement Plan That Assumed the Wrong Protocol A hospital system spanning several states runs its live IPTV distribution out of a single metro region’s headend: DirecTV and BlonderTongue encoder headends feeding 60+ active multicast streams. When the core node serving that region was rip-and-replaced, removing legacy Avaya-era SPBM hardware out, standing…