terawiz Network · NOC · Hosting
Work

Things we built because something needed it.

Client names are left out unless the client has said otherwise. Sectors, numbers and tools are real. Each page says what the situation was, what we did, and what changed.

Case notes 8 items
01 · Service-tunnel health model2026 One event, not 125 faults Regional wireless ISP, North West The operator's dashboard kept reporting 125 of 126 client services down. Thirty-nine of them were. We built a state model that needs a second witness before it calls a fault, and carried it through to the hourly report and the WhatsApp dispatch. Scale 126 service tunnels in one region, 93 in another Witnesses Tunnel flag, facility port probe, anchor health Read the case → 02 · NOC intelligence report2026, ongoing An hour on the desk, every hour Regional wireless ISP, North West A report that runs at the top of every hour, remembers what it said last time, and explains outages as cascades from a root rather than as lists of symptoms. Cadence Hourly since June 2026 Steps Collect, diff, audit, synthesise, render, email Read the case → 03 · Availability dashboard2026, ongoing A dashboard built for the wall Bus rapid transit operator, Johannesburg Station switches, cameras, biometric readers, fare collection and microwave links on one screen in the monitoring centre, with the measurement rules written down and the raw data a click away for staff. Stations 94 station switches Placement 408 devices placed by the switch port that learned their MAC Read the case → 04 · Configuration recovery2026 Rebuilding a core router from yesterday's recon PoP router anchoring 128 client tunnels The PoP router died with no current export on file. The previous morning's read-only recon had 48 sections of its configuration. We turned that into a restore script, with every assumption and gap written down. Device CCR1036, RouterOS 7 long-term Restored 128 tunnels, 134 bridge ports, 38 filter rules, OSPF Read the case → 05 · Incident response2026 Containing a compromised hypervisor without a rebuild Hosted Proxmox server running a client's daily Windows server A crypto-miner, an LD_PRELOAD rootkit and three separate backdoors on a hypervisor the business used every day. Contained in place over two days, with the evidence kept and the trade-offs written down. Found Miner, process-hiding rootkit, SSH key-command hook, rogue admin user and API token, emptied logs Entry Likely an authentication bypass on the management port, open to the internet Read the case → 06 · Hosting migration2024 Moving 25 domains and their mail to a new server Terawiz hosting desk, November 2024 Twenty-five client domains, with their websites and mailboxes, moved from a shared host onto our own Debian server, with a per-domain status report at the end. Domains 25 Mail Mailbox-by-mailbox sync, originals left intact until cut-over Read the case → 07 · Configuration standardisation2026 A golden template for 57 customer routers Wireless network, North West Fifty-seven CPEs configured by different hands over several years. We audited 115 settings on each, let the operator decide the template, and generated per-site change files in batches the operator applies. Devices 57 CPEs across 14 sites Audited 115 settings per device, baseline = the most common value Read the case → 08 · Internal tool2026, in use FlowScope: the flows, not just the counters NetFlow and IPFIX collector with a live dashboard A from-scratch flow collector we point MikroTik exports at: who is talking to whom, through which NAT, named by what the network itself says about its devices. Protocols NetFlow v5 and v9, IPFIX, TZSP packet stream Naming Router DHCP and ARP over SSH, passive DNS, mDNS, DHCP, TLS SNI, reverse DNS, OUI Read the case →
Smaller things No page, still real

Consumer apps live on their own page: Terawiz apps →

Have something like this?

If your situation rhymes with one of these, say which. It saves a meeting.

Start a conversation →