Features

Everything it does

The whole list, including the small things, because those are usually what somebody is actually asking about. Nothing is listed here that the product does not do — and what is not built yet is at the bottom.

The estate Switches Ports Traffic and billing Monitoring sources Out-of-band access Proxies Access control Audit Programmatic access Running it The interface

The estate

What is racked, cabled and sold, held in one place with the identifiers of the system it came from.

Datacenters with a short code, name, location and notes
Racks per site, with a configurable height in rack units
Rack elevation showing switches and passive equipment together
Patch panels, power strips and blanking plates as first-class rack items
Double-booked rack units reported rather than silently overlapped
Servers with hostname, primary address, asset tag, serial and rack position
Multi-unit servers occupying the rack units they actually fill
Customer services mirrored from the billing system, never written back
Source identifiers retained permanently, so both systems can be reconciled
Import from an existing DCManage module over a read-only snapshot

Switches

The devices, how the platform reaches them, and what it reads from each.

Switch inventory across every site, with vendor and platform recorded
Cisco IOS and NX-OS, with a generic mode for anything else
SNMP v2c with a per-switch community, port and version
Per-switch maximum varbinds, so a device that refuses a large request is asked smaller ones
Automatic halving of a batch a device rejects, rather than failing the whole poll
Per-switch poll interval, independent of every other device
Port discovery on demand or on a schedule
Total port count per switch, and how many of them are being measured
Forwarding table (MAC address table) read over the command line
Hardware and TCAM usage read over the command line
Switch health — CPU, memory and uptime — over vendor-specific object identifiers
Connectivity probe that reports which transport answered
Telnet command line with hand-rolled option negotiation and an enable password
Credentials sealed per switch and never displayed again
Consecutive failure count and last-reachable time per device

Ports

The interface level, where a measurement becomes a customer.

Full port table per switch with interface index, canonical name and reported name
Administrative and operational status, and negotiated speed
Whether the interface offers 64-bit counters, recorded per port
Traffic collection switched on or off per port, not per device
Port lock with a stated reason — neither automation nor a manual action may change a locked port
A lock is recorded locally and sends nothing to the device, so it works while enforcement is off
Port-to-server mapping, with the source of each mapping recorded
A patched interface distinguished from a measured one
Interfaces with nobody behind them reported as such rather than guessed at
Ambiguous mappings left unattached and counted, never resolved by picking one
Per-port traffic chart with a selectable range

Traffic and billing

What was measured, how good the measurement was, and what a customer is charged on.

Counters read over SNMP on a schedule, from the device itself
One request per device built from known interface indexes, not an interface walk
Samples stored per port, partitioned by day
Counter wrap and counter reset detected and recorded rather than producing a spike
Every sample carries a quality: usable, spanning a gap, following a reset, or suspect
A window nobody watched reports nothing rather than zero
Coverage describes what was observed, not what was inferred
Rollups at five minutes, one hour and one day
Ninety-fifth percentile taken on the direction that is billed
Billing basis of download, upload or both — per service, per server or per site
Base allowance, additional allowance and carried-over debt held per service
Usage shown against allowance, with over-quota marked rather than merely coloured
Percentage stated as text beside every meter, so no figure has to be read off a colour
A dual-calendar date and time range picker with a correct Solar Hijri grid

Monitoring sources

The platform measures traffic itself, and can read somebody else's system alongside.

The platform's own SNMP collector, shown as a source in its own right
PRTG read over its API as a second source
Authentication by API token, passhash, basic credentials or none — stated, not guessed
Sensors cached locally, so no page ever waits on a remote system
Traffic sensors attached to ports by matching what both systems agree on
Unmatched sensors left alone and counted rather than resolved by guessing
How many of a source's sensors point at a port the platform also measures
Circuit breaker: after repeated connection failures the platform stops asking
A bare socket rather than a timer decides when to start asking again
An HTTP error does not open the circuit, because a system that answers is reachable
Per-source request timeout and certificate verification
The web tier cannot authenticate to a source at all, so no page can be made to wait on one

Out-of-band access

The management controller, recorded on the machine it belongs to.

Management address, port, kind and account held on the server record
iLO, iDRAC, IPMI and Redfish recognised as kinds
Certificate fingerprint pinned when the controller is first reached
The proxy a controller is reached through, named per server
Credential sealed to the server row, and never displayed
Imported from the existing module and matched to its machine by name

Proxies

How the platform reaches a network it has no route to.

SOCKS5, SOCKS4 and HTTP CONNECT
SOCKS4a used automatically when a name rather than an address is reached
Optional username and password, sealed per proxy
Name resolution at the far end, for names only the private range knows
Named per switch, per server management controller and per monitoring source
Naming none means a direct connection — there is no "direct" row to pick by mistake
Reachability check that costs a connect and no credential
A proxy still in use cannot be deleted out from under the equipment that names it
Per-proxy connect timeout

Access control

Who may do what, declared once and read by everything.

Roles as named sets of permissions
Individual exceptions on an administrator, on top of their roles
A revoke always wins over a role that grants the same permission
One permission registry driving the gate, the interface and the role editor
A rendered button is always a pressable button, because both read the same key
Permissions grouped by consequence, with high and critical groups marked
Full administrators who bypass every check, including permissions added later
Administrators disabled without losing their history
The last full administrator cannot be removed or demoted
Nobody can change their own roles, permissions or account status
Sign-in throttling per account and address
Source address allow-list enforced before the sign-in form is drawn

Audit

The record of what happened, which nobody can edit.

Every action that changed something, and every refusal
UPDATE and DELETE revoked at the database, not merely absent from the code
Eighty-six actions with a readable label in both languages
The stored key kept beside the label, so a row can be filtered on exactly what was recorded
Actor, address, user agent and request identifier on every entry
Field-level before-and-after for changes
Values that could carry a secret redacted before storage
Filter by action prefix and by outcome
A refused authorisation records the permission that was refused

Programmatic access

For the things that should not need a browser.

API keys with their own set of permissions
Keys restricted to a list of source addresses or networks
Optional expiry date per key
Keys revoked without being deleted, so the audit trail still resolves
The secret shown once, at creation, and never again
A documentation page generated from the permissions a key can actually hold
Issuing and revoking a key is itself an audited action

Running it

The parts an operator only notices when they go wrong.

Scheduler under cron with its own identity, separate from the web process
Each task in its own process with its own overlap guard, so one slow task starves nothing
A status page showing what ran, when, and how long it took
Device work queued to a worker and reported back to the page that asked
The web tier cannot open a device credential, by file ownership rather than by convention
Deploy script that restores ownership, migrates, restarts both processes and verifies every invariant
Destructive database commands blocked unless the database name ends in _test
Daily partition maintenance and rollup folding
Retention pruning that leaves every port a baseline sample

The interface

How it behaves once somebody is actually using it.

Persian and English throughout, as one stylesheet with a different direction
Right-to-left built with logical properties rather than mirrored afterwards
A missing translation in either language fails the build
Light and dark schemes, chosen by the operator and remembered
Two densities, because an operator scanning three hundred ports wants rows rather than air
Tables that stack into labelled cards on a phone, where stacking helps
A frozen first column instead, on the tables where stacking would not
Live list filters that do not reload the page
Every table with an empty state that says what is missing
No external asset of any kind: no font service, no CDN, no analytics, no build step
Keyboard bypass links, focus outlines and current-page state on every navigation item

What is not built yet

Stated here rather than discovered later. This list shrinks with each release.

A customer-facing portal; today the platform is for operators only
Automatic enforcement is written but ships switched off, and is not yet recommended for production
Zabbix, Cacti and LibreNMS are anticipated by the schema but have no client yet