Features

Six topics: discovery and inventory, topology, alerting and integrations, the AI assistant, security and access control, and operations and deployment. Everything below ships in NETMapper Core under AGPL-3.0, and nothing in Core is time-limited or capped.

Discovery and inventory

NETMapper logs in to your switches over SSH and reads what they already know, so the inventory is what the network reports rather than what a spreadsheet remembers.

Network inventory: MAC table, ARP table, hostname, vendor OUI, VLAN, port, and first/last-seen timestamps for every device on every switch.
Scheduled scans: per-switch or scan-all-switches intervals via APScheduler; a manual scan is always available.
DHCP integration: lease correlation via Kea, ISC dhcpd, MikroTik RouterOS, Windows DHCP (SSH and WinRM), pfSense, and OPNsense.
Statistical anomaly detection: a daily batch scorer for device churn, IP churn, VLAN outliers, and unknown-device flags. Pure standard library, no ML dependencies.
Eleven vendor scanners, all shipping in Core. The full table is further down this page.

Topology

The map is drawn from LLDP/CDP neighbor data collected on every scan, so it follows the cabling instead of a diagram somebody last edited two years ago.

LLDP/CDP neighbor edges parsed from switch output and turned into a live topology graph.
Interactive canvas with zoom, pan, and export.
Follow MAC mode to trace one address across the fabric.
Bookmarked topology views persisted server-side, so they follow the user rather than the browser.

Alerting and integrations

Changes in the inventory become alerts, and alerts go wherever your team already looks. Every delivery attempt is recorded.

Alert rules: a flexible rule engine that fires on new device, device missing, vendor, VLAN, or custom field conditions.
Channels: email (SMTP), Slack, Teams, HMAC-signed generic webhook, Telegram, Discord, Mattermost, PagerDuty, and OpsGenie.
Per-rule throttling, per-channel quiet hours, and a delivery audit row for every attempt.
REST API and Prometheus metrics for wiring NETMapper into the rest of your tooling.

AI assistant

A read-only assistant on top of the inventory NETMapper already collected. It answers questions about your data; it does not perform discovery and it cannot change anything.

Chat-completion loop via any OpenAI-compatible provider (OpenAI, Anthropic, Google, Groq, OpenRouter, Azure/Copilot, Ollama, local).
Tool use gated to five read-only lookups: list_devices, list_switches, list_neighbors, list_alerts, and stats_summary.
AI keys are encrypted at rest, and conversations export as Markdown or JSON.
Cmd+K command palette: navigate to any page, run a scan, toggle theme, log out. Typing ? or ai: routes the query straight into the AI chat.

Security and access control

NETMapper holds switch credentials, so the access model and the encryption are part of the product rather than an add-on.

Role-based access control: a 24-permission catalog across 9 categories with three built-in roles (admin, operator, viewer). Custom roles are a Pro feature.
Two-factor authentication with TOTP.
HttpOnly cookie plus CSRF double-submit on every mutation; the access token never lives in localStorage.
Encryption at rest: switch credentials, notification-channel configs, and AI keys are sealed with Fernet, backed by your own encryption key.
bcrypt password hashing with a Have I Been Pwned k-anonymity check, and rate-limited login endpoints.
Audit log with configurable retention: every privileged and mutating action writes a persistent record. Retention defaults to 90 days, with a daily prune job and on-demand pruning from the UI.
Policy acknowledgement: publish your own acceptable use policy, terms, or privacy notice and track per-version acceptance per user.

Operations and deployment

One Docker Compose command is the short path. Kubernetes, bare metal and the day-to-day surfaces are all covered too.

Docker Compose install with digest-pinned images, plus built-in HTTPS via nginx with automatic Let's Encrypt certificates.
Helm chart (beta) for Kubernetes, and a bare-metal install script with a systemd unit.
Prometheus metrics endpoint, plus health and readiness endpoints.
Installable PWA shell with a service worker and an offline fallback page.
Server-side user preferences: topology bookmarks, device tags, and dashboard widget order persist per user.
Drag-and-drop dashboard widget reordering with a reset button, and a print stylesheet for management reviews.

Core vs Pro

Core, AGPL-3.0

Every topic on this page, for homelabs and small teams. Uncapped.

Pro adds

Syslog and EDR / XDR / SIEM channels, compliance evidence reports, custom roles, active-active replicas, and a Vault secrets provider, for businesses that need them.

Full comparison

Supported vendors and scanners

Eleven vendor scanners, all shipping in Core. Each registers itself with the scanner factory, so adding a vendor is a self-contained change.

Vendor	Tested against	Notes
HPE Comware	A5500, A5120, 5900, 5130	H3C silicon
HPE ProCurve	2510, 2610, 2910, 3400, 5300	Legacy ProCurve/Aruba
Cisco IOS / IOS-XE	Catalyst 2960, 3750, 3850, 9300
Cisco NX-OS	Nexus 3k/5k/7k/9k	Data center
Aruba AOS-CX	CX 6xxx/8xxx/10xxx	Newer Aruba
Aruba AOS-Switch	2530, 2920, 2930, 3810, 5400	Legacy HP/Aruba
Juniper Junos	EX series, QFX series
Dell OS10	S3000, S4100, S5200, Z9100
Extreme EXOS	X440, X450, X460, X670, X870
Nokia SR Linux	SR Linux via containerlab	Verified in lab
SONiC	SONiC VS via containerlab	Verified in lab

FRR/Linux acts as an LLDP peer in the lab topology but does not have a dedicated scanner yet. Need another vendor? Open an issue. Adding scanners is one of the highest-value contributions right now.

REST API

The same API the dashboard uses. Interactive docs are served by every install at/docs (Swagger UI) and /redoc.

Swagger UI and ReDoc documentation
API tokens for automation, and JWT cookie auth for the browser
Mutating endpoints gated by granular permission checks and written to the audit log
Health and readiness endpoints, plus Prometheus metrics

A versioned, rate-limited public API is on the roadmap for v1.0.0.

GET

/devices

List discovered devices

GET

/devices/{id}

Device detail

GET

/neighbors

LLDP/CDP neighbors

POST

/switches

Add a switch (admin)

POST

/scan

Scan all active switches (async, 202)

GET

/alerts

List alerts

POST

/ai/query

AI chat-completion query

GET

/health

Liveness check

Ready to get started?

Read the docs, or clone the repository and run docker compose.

Read the docs View on GitHub