Every feature, in plain terms
This is the full list of what NetManager does today, grouped the way you'd use it. Each group is color-coded with the TIA-598 fiber strand colors, so you'll recognize them.
Monitor & alarms
The home screen. It answers "is anything down?" in the time it takes to look at it.
Live site and device status
Ping reachability runs on its own fast schedule, independent of the full SSH/SNMP poll. Sites show OK, Degraded or Down based on every device assigned to them.
Debounced up and down
A device is marked down after two consecutive missed pings and back up after two good ones, so a single dropped packet never pages anyone.
One alarm list, three sources
Polling findings, SNMP traps and syslog messages land in one list, sorted Critical, Major, Warning, Info and newest first.
- Reachability and threshold alarms clear automatically
- Manual Clear and Clear All, with a cleared-alarm history
- Optional browser sounds for Critical and Major
- Auto-refresh every 15 seconds
Your rules, your severities
Pattern rules decide which trap, polling event or syslog text becomes which severity, and whether it plays a sound or sends email. Thresholds for CPU, memory, disk, OSPF/BFD neighbor loss and interface errors are all adjustable.
Network device health
A sortable table of every device: status, role, model, management IP, uptime, CPU, memory, VSF stack size, software version, client count and alerts. Problem devices pin to the top.
Traps history
Every alarm event ever recorded, searchable by time range from the last hour to 30 days or a custom window.
Watchdog
A curated ping monitor for anything that matters, in inventory or not.
- 30, 60 or 90 second intervals
- Mark down after 1, 2 or 5 misses; up after 2, 5 or 10 successes
- Paste or upload a list of IPs with labels
- Repeat email every 15 minutes while down
- Outage log with start, end and duration, exportable to PDF or Word
Email notifications
SMTP alerts for new Critical and Major alarms, specific event IDs or any text you choose to match.
Sites & inventory
Organize the fleet the way your network is actually built: by site, group, role and connection type.
Sites
Site ID, name, address, connection type, site type and primary data center, with a rolled-up status column and one-click geocoding.
Devices
The daily operations view: SNMP poll or full CLI collect on the devices you check, ping and traceroute on any row, and a progress banner while background polls finish.
Device detail pages
Everything about one device on one page: alerts, key facts, VSF, VSX, HA and PoE status, OSPF and BFD neighbors, IP SLA, route and ARP tables, interfaces, LLDP neighbors, raw command output and config backup history.
Fast onboarding
Add one device, clone an existing one, or bulk add a pasted list of IPs with shared settings. Devices rename themselves to their real hostname after the first poll.
Credential and SNMPv3 profiles
Reusable SSH credentials and SNMPv3 auth/privacy profiles. Change a password once and every device using it updates. Secrets are encrypted at rest; admins can reveal them, and every reveal is audit-logged.
Map
Every site on a map with status-colored markers, geocoded from its street address.
Topology
Diagrams built automatically from LLDP data, per site, with routers, distribution and access layers drawn in order. A second table lists LLDP neighbors that aren't in inventory, which is handy for finding unmanaged switches, APs and phones.
Aruba Central APs
Pull access points from Aruba Central's API: name, site, status, model, firmware, IP, clients, CPU, memory and serial. Offline APs raise alarms.
Networks & IPAM
Who's connected where, which subnets live on which interfaces, and how traffic gets there, across every vendor.
Clients
Every client learned from MAC and ARP tables, fleet-wide: name (from LLDP where available), IP, MAC, MAC vendor, connected device and switchport. Filter by device type or search by site.
Interfaces
Every interface on every device: VLAN, mode, description, LLDP neighbor, IP, speed, utilization in and out, discards and errors.
Networks
Every connected subnet in CIDR format with the device, interface, description and number of ARP entries on it. Sorted the way an engineer expects, by prefix.
Routes
The routing table of every switch, router and firewall: prefix, next hop, next-hop device, origin, distance, metric and age. Collected on its own hourly schedule so a full table never slows regular polling.
Look back in time
Clients, networks, routes and interface counters are snapshotted daily. Pick any date in the last 30 days (adjustable) to see what the network looked like.
Interface utilization charts
Per-port In and Out charts from SNMP 64-bit counters, in percent or Mbps, over the last hour up to 30 days, at 5 to 60 minute resolution.
Performance & traffic
Built-in collectors, so you don't need a separate flow tool or log server to find out what's eating the link.
Metrics
Fleet-wide rankings, highest first: CPU, memory, disk, interface errors and discards, and outbound utilization.
NetFlow collector
Point exporters at NetManager on UDP 9995 (v5 and v9). See flows, total traffic and exporters, plus top protocols, conversations and hosts for any time range.
Syslog server
Receive syslog on UDP 514, filter by device, severity and time range, and auto-refresh the view. Matching messages can raise alarms.
SNMPv3 polling and traps
Authenticated, encrypted SNMPv3 polling for system facts and interface counters, and a trap receiver that feeds the alarm list.
Troubleshooting
The tools you'd otherwise open five windows for.
SSH terminal in the browser
A real interactive terminal with multiple tabbed sessions, syntax highlighting for IPs, MACs, interfaces and good/bad keywords, and sessions that survive a quick trip to another page. Admin only.
Bulk show commands
Run show, ping and traceroute across up to 50 switches, routers or firewalls at once, scoped by selection, group or site, with every result on one page.
Per-device command console
A locked-down console on each device page that only allows read-only commands, so anyone on the team can look without being able to change anything.
Ping and traceroute anywhere
Run either from any device row in Monitor or Devices, in a pop-up, without leaving the page.
PCAP analysis
Upload .pcap, .pcapng or .cap files for a full breakdown powered by tshark.
- Protocol hierarchy, top hosts and conversations
- RTP streams with jitter, loss and observed ptime
- SIP signaling and SDP negotiation side by side
- Expert info and TCP anomalies
- Group captures into cases and add context to highlight what matters
Analyze with AI (your LLM)
Get a written root-cause analysis of a capture from the AI provider you choose: a local model such as Ollama or LM Studio, any OpenAI-compatible endpoint, or Anthropic. Off by default. Only the computed analysis is sent, never raw packets.
Configs & reports
Proof of what changed, and proof of uptime for the people you report to.
Config backups
Back up running configs for all switches, routers, firewalls, a group, a site or a selection. A new file is saved only when the config changed, and empty or failed pulls are never saved as a backup.
Diffs and history
Pick any two backups and see a unified diff, or view any backup as raw text.
Scheduled and off-box
Schedule backups by interval and time of day, and copy them to a remote server over SCP or TFTP.
Reports
Four fleet-wide reports over 1, 7, 14 or 30 days, filterable by site and exportable to PDF or Word.
- Availability: uptime %, outages, total downtime
- Latency: average, min and max RTT and loss
- IP SLA: per-operation RTT and loss (Cisco)
- Watchdog: uptime and outage history per target
Administration
The parts that let you run it in production and sleep at night.
Users, roles and LDAP
Local users with Admin and Read-Only roles enforced on every request, plus LDAP / Active Directory login with group-based role mapping.
Audit log
Every add, edit, delete and login attempt, including blocked read-only attempts, with who did it and when.
Scheduling without restarts
SSH poll, SNMP poll, interface counters, ping, Watchdog and backup schedules are all editable live and take effect on the next tick.
Editable poll commands
See and change the exact CLI commands sent to each vendor on every poll, with conditions (for example, only on VSF stacks). Add your own per-device commands too.
Retention and housekeeping
Retention per data type (syslog, NetFlow, stats, alarms, PCAPs, snapshots and more), server CPU, memory and disk gauges with capacity alerts, and Purge Now per category.
Backup, restore and services
One-click database backup and restore with an automatic safety snapshot, optional daily backups, and live status for the syslog, NetFlow and trap listeners.
MCP server
A read-only Model Context Protocol server so your own AI assistants can query inventory, status and alarms.
Seven themes
Classic Light and Dark, Terminal Green, NOC Blue, Amber Console, Cyber Violet and Graphite Carbon. Each person picks their own.
Built-in user guide
A walkthrough of every tab and settings page inside the app, also downloadable as a PDF.
Supported vendors
What NetManager collects from each platform today. Parsers were validated against live output from these devices.
| Capability | Aruba CX switches | Cisco IOS routers | Palo Alto firewalls | Aruba Central APs |
|---|---|---|---|---|
| Reachability, uptime, CPU, memory | ✓ | ✓ | ✓ | ✓ |
| SNMPv3 polling and traps | ✓ | ✓ | ✓ | API |
| Interfaces, counters, utilization | ✓ | ✓ | SNMP | – |
| Routing table and connected networks | ✓ | ✓ | ✓ | – |
| Clients from MAC / ARP (per VRF) | ✓ | ✓ | ✓ | count |
| LLDP neighbors and topology | ✓ | ✓ | – | – |
| Platform health checks | VSF, VSX, PoE, fans, PSUs, temperature, disk | OSPF, BFD, IP SLA, QoS policy-maps, disk | HA state | Online / offline |
| Config backup and diff | ✓ | ✓ | ✓ | – |
| Bulk CLI and SSH terminal | ✓ | ✓ | ✓ | – |
Need another platform? Vendor support is added against real device output. Tell us what you run.
Architecture
Designed to run for years on your own hardware, from a lab VM to a fleet of thousands.
- Deployment
- Docker Compose on Linux, or Docker Desktop on Windows
- Database
- PostgreSQL with TimescaleDB for time-series data
- Job queue
- Celery workers on Redis; SSH, SNMP and ping each on their own queue
- Scaling
- Add poller containers to add capacity; no single-worker ceiling
- Ingest
- Dedicated syslog and NetFlow receivers with batched writes
- Ports
- HTTPS UI; UDP 514 syslog, 9995 NetFlow, 162 traps
- Security
- Encrypted credential vault, role checks on every request, audit log
- Backups
- Native database backup and restore, with a pre-restore safety snapshot
- File ownership
- PUID / PGID support for clean bind mounts on shared Linux hosts
- Licensing
- One license key sets device count and the features your plan includes
Want a walkthrough?
We'll show you the features that matter for your network, on a live fleet.