Skip to content
Log in Sign up My account

Terminal and Productivity Tools for Network Engineers

This article covers the tools you sit in front of all day: SSH and console clients (SecureCRT, MobaXterm, Royal TS, Windows Terminal), tmux, VS Code with Remote SSH, diff tools, and the config backup systems Oxidized and RANCID. You will get an honest view of what each does, how to configure the parts that matter for network gear, and a working Oxidized setup.

What a network terminal needs

General-purpose terminals work, but network work stresses a few specific features.

  • Session management. Hundreds of devices need folders, search and inheritance of settings such as username and key.
  • Logging. Every session logged to a file with a timestamp. This is your evidence after a change.
  • Console and SSH in one tool. Serial, SSH and sometimes Telnet.
  • Reliable multi-line paste. Pasting a 200-line config must not drop characters or hang on a slow VTY.
  • Scripting or multi-send. Send the same command to many sessions.
  • Support for old crypto. Old IOS images may only offer legacy key exchange and host key algorithms.

SSH and console clients

SecureCRT

A commercial terminal emulator from VanDyke Software for Windows, macOS and Linux.

  • Strengths. A mature session manager, per-session logging with timestamps, strong scripting (Python, VBScript, JScript), serial and SSH, and a good reputation for stability under heavy use. Its "send commands to all tabs" feature is practical for simultaneous changes.
  • Weaknesses. Paid licence with a limited-term updates model, so check the current terms. Not open source.
  • Fits. Engineers who live in a terminal and want scripting and reliability.

MobaXterm

A Windows-only terminal with a Home edition that is free for personal use and a paid Professional edition.

  • Strengths. Many protocols in one app (SSH, serial, Telnet, RDP, VNC), a built-in SFTP side panel, an X server, and a set of small servers such as TFTP. Multi-execution mode sends one command to many tabs.
  • Weaknesses. Windows only. Check the licensing for professional or company use, as the free edition has limits and is aimed at personal use.
  • Fits. Windows users who want an all-in-one tool.

Royal TS

A commercial connection manager available on Windows and macOS, with a free tier limited in the number of connections.

  • Strengths. Manages connections of many kinds (SSH, RDP, web, VMware and others) in one organized document, with credential handling and team sharing of connection documents.
  • Weaknesses. It is a connection manager more than a specialist terminal, so scripting and logging features are less focused on network work.
  • Fits. Engineers who move between servers, jump hosts and network devices all day and want one organized inventory.

Windows Terminal with the OpenSSH client

Windows Terminal (open source, MIT licensed) is a modern tabbed terminal. Windows includes an OpenSSH client, so plain ssh works in PowerShell, Command Prompt and WSL tabs.

  • Strengths. Free, fast, profiles for each shell, and your SSH configuration in ~/.ssh/config works exactly as on Linux.
  • Weaknesses. No built-in session tree and no built-in serial support, so pair it with plink, PuTTY or another tool for console work.
  • Fits. Engineers who prefer a command-line workflow and plain OpenSSH.

Many engineers keep a graphical session manager and also use OpenSSH. The tools are not exclusive.

SSH configuration that saves time

A shared ~/.ssh/config file gives you shortcuts and handles the old-device problem:

Host *
    ServerAliveInterval 30
    ServerAliveCountMax 3
    ControlMaster auto
    ControlPath ~/.ssh/cm-%r@%h:%p
    ControlPersist 10m

Host core-sw1
    HostName 192.0.2.11
    User netadmin
    KexAlgorithms +diffie-hellman-group14-sha1
    HostKeyAlgorithms +ssh-rsa
    PubkeyAcceptedAlgorithms +ssh-rsa

Host branch-*
    ProxyJump jump.example.net
    User netadmin

Notes:

  • The + form appends an algorithm to the default list instead of replacing it.
  • Enabling legacy algorithms is a risk acceptance. Use it only for devices you cannot upgrade yet, and track them so they get fixed.
  • ControlMaster reuses one connection for many sessions, which is a real speed-up when scripts connect repeatedly. Note that on Windows' OpenSSH client, connection multiplexing may not be supported, so remove those lines there.
  • ProxyJump (also ssh -J) reaches devices behind a bastion host.

Tip

Use SSH keys for the devices that support them and keep keys in an agent. On IOS XE you can add a public key to a user with ip ssh pubkey-chain. Device support varies, so check your platform's security configuration guide.

tmux

tmux is a terminal multiplexer. Run it on a jump host and sessions survive a dropped connection, which matters during long upgrades.

tmux new -s upgrade          # start a named session
# Ctrl-b d                   # detach
tmux ls                      # list sessions
tmux attach -t upgrade       # reattach

Features that help with network work:

  • Panes and windows. Split a window (Ctrl-b % and Ctrl-b ") to watch a ping, a log and a device at once.
  • Synchronized panes. Send identical keystrokes to every pane in a window, useful for configuring several devices the same way. Toggle with:
tmux setw synchronize-panes on
  • Logging. Pipe output to a file:
tmux pipe-pane -o 'cat >> ~/logs/tmux-#S-#I-#P.log'
  • Scrollback. Increase it in ~/.tmux.conf:
set -g history-limit 50000

Warning

Synchronized panes apply to every keystroke, including mistakes. Check the prompts on all panes before you type, and switch it off the moment you are done.

VS Code with Remote SSH

Visual Studio Code with the Remote - SSH extension edits files and runs a terminal on a remote Linux host. It installs a small server component on that host.

  • What it is good for. Editing automation code, Jinja templates and YAML on a jump host or lab server, with the local editor's search, Git integration and extensions.
  • What it is not. It does not connect to network devices. Cisco IOS has no place for the VS Code server, so use it to reach a Linux host that talks to the devices.
  • Useful extensions. YAML, Jinja, Python, GitLens, and a Cisco syntax highlighting extension for reading configs. Pick extensions from reputable publishers and review what you install on a machine that holds credentials.
  • Practicalities. Use the same ~/.ssh/config hosts, which the extension reads. Keep the remote host's resource use in mind, because the server process and extensions use memory.

Diff tools

Network changes are about what changed. A good diff habit prevents a lot of outages.

On the device. IOS XE can compare configurations itself:

show archive config differences flash:before.cfg system:running-config
show archive config incremental-diffs flash:before.cfg

The first needs a saved copy; take one before you start (copy running-config flash:before.cfg). If the configuration archive is enabled, configure replace can also revert to a known file, which is a rollback tool, so test it on a lab device before relying on it.

On your workstation.

# Unified diff
diff -u before.cfg after.cfg

# Works outside a Git repository, with colour and word-level detail
git diff --no-index --color-words before.cfg after.cfg

Graphical and enhanced tools: VS Code's built-in compare, Meld (open source), WinMerge (open source, Windows), Beyond Compare (commercial) and delta (open source pager for Git). Use whichever you will open without thinking.

Compare after normalizing. Strip timestamps, Building configuration... lines, ntp clock-period lines and other noise first, otherwise every diff is full of changes that mean nothing.

Config backup: Oxidized and RANCID

Backups are the cheapest insurance in networking. A backup tool logs in to each device on a schedule, pulls the configuration and stores each change in version control, so you can see what changed, when, and often who.

graph LR
    S["Device inventory<br/>(CSV, HTTP, NetBox)"] --> O["Oxidized"]
    O -- "SSH, show running-config" --> D["Devices"]
    O --> G["Git repository"]
    G --> W["Diff and history"]
    O --> H["Hook: notify on change"]

Oxidized

An open source (Apache 2.0) configuration backup tool written in Ruby, the successor to the RANCID idea with a more modern design.

  • Strengths. Model support for a large number of vendors, output to Git, a web interface (oxidized-web), several inventory sources including CSV, SQL and HTTP (so it can read from NetBox or Nautobot), and hooks that run on a config change.
  • Weaknesses. A Ruby application you have to install and maintain, and device models occasionally need tuning for odd prompts or paging behaviour.

A basic ~/.config/oxidized/config file:

---
username: backup
password: change-me
model: ios
interval: 3600
use_syslog: false
resolve_dns: true
input:
  default: ssh
  ssh:
    secure: false
output:
  default: git
  git:
    user: Oxidized
    email: [email protected]
    repo: "/var/lib/oxidized/configs.git"
source:
  default: csv
  csv:
    file: /var/lib/oxidized/router.db
    delimiter: !ruby/regexp /:/
    map:
      name: 0
      ip: 1
      model: 2
      group: 3

And a matching router.db:

core-sw1:192.0.2.11:ios:core
edge-rtr1:192.0.2.1:iosxe:edge

Set secure: true under ssh to enforce host key checking once you have the keys in known_hosts. Create a dedicated read-only account for backups rather than using an admin account. On Cisco devices, a privilege-level 15 account is often needed to read the full running configuration, so limit it with command authorization or network ACLs on the VTY lines, and monitor its use. If your config includes secrets, treat the Git repository as sensitive.

RANCID

The Really Awesome New Cisco confIg Differ is the older tool, written mainly in Perl and Expect, with CVS or Subversion history (newer releases can use Git).

  • Strengths. Proven, simple, and light, with email diffs after each run that many teams rely on.
  • Weaknesses. Older architecture, less friendly for modern inventory sources, a smaller feature set than Oxidized, and fiddly login scripting for new platforms.
  • Fits. Existing deployments that work. For a new one, evaluate Oxidized first.

Other options

Many teams also back up with Ansible (cisco.ios.ios_config with backup: true), with a vendor tool such as Cisco Prime, Catalyst Center or SolarWinds NCM, or with scripts based on Netmiko or NAPALM. Choose by how well it integrates with your inventory, how it handles secrets and how easily you can see a diff.

A sensible workstation baseline

  1. A session manager you like plus plain OpenSSH, both pointing at the same inventory if possible.
  2. Terminal logging on by default, to a dated folder.
  3. A jump host with tmux for long-running work.
  4. A shared ~/.ssh/config committed to a private repository, without private keys.
  5. A diff habit: take a before copy, compare after.
  6. Automated backups to Git, with alerts when a device fails to back up.

For practice environments where you can build these habits safely, see the CCNP course lab setup guide, and for related tooling see The Network Engineer's Field Bag for console access and Packet Analyzers and Capture.

References