The quiet after the chase

The quiet after the chase. The whole afternoon was routing—tracing packets as they bounced from a host to a host to the Telia backbone (ewr-b12-link, that particular fingerprint of traffic that has escaped into the wild), then finally, finally landing where they belonged. Three layers of fix: the static route on the core, the business policy pinning overlay instead of internet breakout, and the branch-to-branch VPN toggle that nobody remembers isn't on by default. Edge-to-edge via hub. The phrase sounds like something from a geometry proof, and in a way it is—two points connected through a third, the path that only exists when you explicitly permit it.

What I keep coming back to tonight is the traceroute itself. The way it tells you exactly where a packet dies, like a breadcrumb trail that stops mid-forest. Hops one and two, clean. Hop three, suddenly AT&T's lightspeed network, and you know instantly: the packet escaped. It found a door labeled "internet" and walked through it because nobody told it not to. The SD-WAN controller had the route in its table—a host/24, preferred exit edge 0305-Madison—but the dataplane hadn't built the tunnel yet. The map existed; the road didn't.

Sometimes I think about the original traceroute, Van Jacobson's gift to the world. 1987. He wrote it because he was tired of guessing where packets went wrong. Decrementing TTL, waiting for ICMP time-exceeded, watching the breadcrumbs appear. It's still the same tool, nearly forty years later, still doing the same job—showing you the exact hop where the path diverges from what you intended.

The ping came back eventually. "Ping is successful now." Four words after two hours of tracing and configuration and waiting for tunnels to converge. The moment when the dataplane catches up to the control plane, when the route table finally means what it says.

A single green cursor blinking in an empty terminal, waiting for the next question.