InfraNet Pro — a quick tour: topology, live racks, VLAN isolation, SNMP discovery and the AI assistant
A quick tour — auto-discovered topology, live 19′′ racks, one-click VLAN isolation, SNMP discovery and the grounded AI assistant. More screenshots ↓

InfraNet Pro is a self-hosted web application that lets network engineers draw rack layouts and floor-plan diagrams, then bring them to life by polling live data from real devices via SNMP. Interfaces, VLANs, LAG groups and neighbour topology are discovered automatically — no external database, no cloud dependency, minimal tooling (a lightweight esbuild bundle for the frontend; npm start builds it).

Current product direction: InfraNet Pro keeps discovery and classification inside the app. External discovery and monitoring engines are not part of the active roadmap; the internal SNMP/sysObjectID/LLDP/CDP/FDB engine is the source of truth and can be refined with local plugins over time.

git clone https://github.com/muttley1973/infranetpro.git
cd infranetpro
npm install
npm start

Open http://localhost:8421 . An admin account is created on first start and you are prompted to change its password.

Your first five minutes: New project → Add device → give it an IP → Properties → Integration → community → Poll. Then run Discover subnet on your LAN, and press Verify to see your document compared against the live network, row by row.

📰 What's new (v2.11.3) — one question, one alphabet: how sure the app is, said the same way everywhere.

• Six words in place of seven vocabularies. Looking at a row you ask one thing — how much do I trust this? — and the app used to answer in whatever notation that screen happened to own. It is one alphabet now: Measured, Declared, Derived, Contradicted, Not declared, No reading. Learn it once and it reads the same on a cable, a device field, a discovered host, a floor-plan tile and the Overview. No engine was merged — a declaration still does not age and a measurement still does — what is shared is the word.
• A cable's «Status» row went from five badges to two. Three of the five were answering that one question in three incompatible notations, one of them a percentage that contradicted the other two. What the link is (access, trunk, LAG member) and how far it is trusted are separate questions now, with the protocol and the score in a quiet chip behind the grade instead of standing as a third opinion. The Dashboard's cable list, which had kept a vocabulary of its own for that same engine, now shows the very same pill: one cable, one word, wherever you look at it.
• A discovered device reads as «Measured» only when something authoritative spoke — it answered SNMP, or a neighbour declared it over LLDP/CDP. The confidence score is an additive vote over heterogeneous clues and reaches «high» with neither of those, so a well-summed pile of weak signals used to look like a reading. And a barely-recognised device is no longer painted red: not being sure about something is not a fault.
• The floor plan and the racks say in words what they used to say in colour alone. A red halo, a greyed-out tile and a grey ring were the last place in the app with no words at all — you can now read whether the probe looked and found nothing, never looked there, or found a device you had declared out of service.
• The two kinds of «missing» are told apart. «Nobody wrote it» and «nobody read it» shared one grey dot labelled not declared, which was simply false wherever no declaration was missing in the first place. They are two signs now, drawn identically, because what separates them is who has to move next: you, or a probe.
• And the Dashboard draws one badge, not two. A row could carry the new pill next to the old provenance tag — rounded against fully round, tinted against hollow, Measured against measured — which is odd in a panel and absurd on one line. Every label there has one shape now, so what tells them apart is the word and the colour: where a value came from, and why an entry is on the list, no longer look like two different kinds of thing. It was the screen the alphabet took its words from, and the last one still spelling them its own way.

📰 v2.11.2 — the Overview reads the same in every section, and wireless discovery explains itself.

• All six Overview sections give their verdict the same way, and «I don't know» is grey everywhere. There used to be two — a sentence in the Summary columns, a hand-built number in the other three lenses. One component says both now: the number where the answer is a number, the sentence otherwise. A section with nothing to judge shows grey and names what is missing, instead of a green it never earned or a red that promised a diagnosis nobody made — so a never-synced project no longer reads as a fault.
• Wireless discovery says why it found nothing, instead of three silent zeros. A Sync that made no associations used to report 0 / 0 / 0 and no reason, so an access point that answers no SNMP looked broken. Each of the five gates that can skip a device is named now — no clients read, no declared SSID, client not yet in the document, not an endpoint, rejected pair, manual link — and a wired-only network stays silent. An OpenWrt access point is recognised again as well: its current interface name phy0-ap0 (and a USB adapter's wlx...) was not being matched.
• qs pinned to 6.16.0, clearing two dependency advisories carried under Express. Neither was reachable here — the arrayLimit bypass needs comma: true, which the app never sets, and bodies are parsed only by express.json() — so the fix is a one-line override that leaves Express untouched.

📰 v2.11.1 — the canvas got about twice as fast, and the app stopped stating things it had not measured.

• Drawing is roughly twice as fast, and a click costs the same at any size. A full render now reuses the DOM instead of recreating it: 55 ms at 500 devices and 92 at 1000, where it used to be 119 and 203. The floor-only render no longer grows with the project at all, selecting a device repaints only what depends on the selection rather than the whole canvas, and dragging one no longer produces a single long frame. The project list is paid once per save instead of once per read — which is what the per-site device counts on the multi-site map are made of, so the cost used to grow with the number of sites.
• A port's VLAN that could not be read is no longer written down as 1. Zero is not a value a PVID can take — the standard uses it to mean no VLAN — so a zero there was a decoding failure wearing the shape of a measurement, and on a device that switches VLANs that invented 1 could outrank a network somebody had documented by hand. It stays absent now, which is a state the rest of the app already knows how to read.
• The toolbar stopped moving under your hand. The four status badges live in one bay after the search field, so nothing shifts when one of them lights up; thirteen dividers became the five that mark what the bar actually does; Delete is no longer painted red at rest, because a warning that is always lit stops warning; and Save is loud when there is something to save rather than when there is not.
• Notifications stay until you dismiss them. They used to share one box at the bottom of the screen and fade on a timer, so a second message overwrote a first nobody had read yet.
• Text you could not read, in two places. Four of the twelve cable badges could not carry white text — the worst at 2.03:1 was the one warning you not to trust that cable — and the ink is now derived from each background instead of assumed. The type scale is applied as well, which retires 31 near-identical text sizes crammed between 10 and 16 pixels.

📰 v2.11.0 — a project documents one building; this release documents how the buildings talk to each other.

• Sites and links, as a map and as a form in the same place. A panel beside the project picker holds the organisation: its sites, the WAN lines each one buys, the tunnels between them. Clicking a site on the map walks down into that site's own project. Writing it by hand is the primary path, not a fallback — and the NetBox import fills these same fields rather than different ones, reading the circuits and the VPN tunnels an import used never to open.
• The declared model now checks itself. A tunnel carrying a network no site claims, the same subnet declared at two sites, a link that never says which WAN line carries it, an address declared public that is a carrier's 100.64 — inconsistencies and gaps kept in separate lists, because a missing line and a false one are not the same thing. Every check that could not run leaves its name and its reason instead of passing for a clean bill of health.
• The dossier gains the WAN chapter. The map of the sites, then one recovery card per line and per link: who sells it, the circuit id you dictate on the phone, the port bandwidth, the device holding each end, and the networks the link makes reachable — which on an IPsec are the encryption domain.
• A floor plan can hold storeys, drawn as containers rather than modelled as devices, and the NetBox import stops flattening the locations it reads.
• Three ways of quietly losing work are closed. An edit made during a save no longer vanishes; two sessions no longer overwrite each other in silence; and a project reopened from its backup now says so, before you save the older content back over the newer.

📰 v2.10.2 — a scan now recognises the model, and the dashboard is a map you can click.

• A scan recognises the device model and proposes it — it never applies it on its own. The model is matched against the catalogue from what the device actually reports (its ENTITY-MIB model name, else its sysDescr), with an honest confidence — an exact hit, or a family. A chip in Discover names the match, and the properties panel offers an Adopt button: the same manual choice you always had, one step shorter.
• The dashboard is a map you can click. A cable lights up its physical path across the floor and the rack; a subnet, gateway, VLAN or LLDP/CDP neighbour jumps to where it is declared. Each row leaves the overview for the place the thing is edited.
• A device that answers on several NICs is one box, not one per address. A multi-homed server or NAS is folded on authoritative keys only — its own IP table, serial, engine-id — shown with a badge and reversible with a split, and each interface now carries the IP it owns.

The cable VLAN diagnostics were also made consistent and legible.

📰 v2.10.1 — the app stopped filling in what nobody had told it.

• A VLAN nobody declared is left absent, not written down as 1. And three things the devices were saying that nobody was reading: the native VLAN of a Cisco trunk, the dot1Q sub-interface where a router-on-a-stick keeps its VLAN and its address, and what a link aggregate declares to the ports bundled into it.
• A cable's colour has one definition instead of the eight that had drifted apart. An access cable takes the one VLAN that applies; a trunk takes none and shows what it carries; a routed link belongs to no VLAN at all — and you can now declare one by hand, so a project drawn without polling anything stops claiming a router-to-router cable switches.
• A port has three states, and "idle" is no longer one of them — one word had been doing four jobs. A port with no link across three verifies turns amber: one switched off by hand is a decision and stays quiet, one that simply lost link is a symptom worth going to look at.

Twenty areas were re-tested live against a home network and a 12-device, 7-OS bench.

📰 v2.10.0 — the document learns where things are, and what hosts what.

• A NetBox location becomes a room on the floor plan, with its racks and devices inside it. What has no location stays outside the rooms rather than in one nobody declared.
• Hosting virtual machines is a capability, not a type, so the import stops rewriting a device's type to make room for them.
• An LLDP identifier is read from the subtype it declares, not from the length of its value — the old rule lost MAC addresses written out in full and invented others out of port names.

📖 Earlier releases — networks as first-class objects with IPv6 parity (2.9.0), the NetBox/DCIM import (2.8.0), per-interface addresses (2.8.2) — are in the CHANGELOG.

🔒 Security-audited & hardened. The codebase has undergone an application-security audit (no critical issues) and the follow-up fixes are covered by automated security regression tests: the data surfaces (AI context, REST DTOs, exports) are allowlist-only so secrets never leave the machine, OS commands run via execFile with no shell, project IDs are path-traversal-safe, and secrets use a CSPRNG. See Authentication & Roles → Security hardening & audit.

Roadmap · Feedback & requests · Contributing · Support · License · ARCHITECTURE.md · CHANGELOG.md · LICENSING.md

Full feature manual (PDF) — Italiano · English
_{Dark cover, white printable interior, 22 illustrated chapters — 65 pages in Italian, 69 in English.}

InfraNet Pro — Sites and links: the multi-site map, with each site's WAN lines, the tunnels between them and the coherence counters
Sites and links — the floor above a project: each site with the lines it buys and what is inside it, the tunnels between them, and the counters of what does not add up. Click a site to walk down into its own project.

InfraNet Pro — topology view
Topology — auto-discovered L1/L2 neighbours (LLDP / CDP / FDB) drawn over the floor plan

InfraNet Pro — the Dashboard: three columns of verdicts with the provenance of every figure
Dashboard — three standing questions in three columns, every number carrying its provenance: declared, from a scan, derived, or not declared as a dash rather than a zero. Rows open in place. _{(Shown in Italian — the whole UI ships in both languages.)}

Every heading below opens. Deeper detail lives in ARCHITECTURE.md, the technical manuals and the commit history.

A single Node/Express backend serves a static frontend and persists each project as a JSON file — no database, no cloud. Top-level layout:

infranetpro/
├── server.js · auth.js · utils.js # Express bootstrap, session auth (bcrypt), shared helpers
├── server/ # Backend modules: projects store, netscan, classify, PDF/label render, AI (context/prompt/provider), routes
├── drivers/snmp.js # SNMP v1/v2c/v3 driver (poll / probe / neighbours)
├── engine/ # Plugin engines: sysobject-engine.js, oui-engine.js, fusion-scorer.js (+ index.js)
├── plugins/ · plugins/oui/ # Seed vendor catalogs (sysObjectID + OUI/MAC), zero-database
├── data/ # oui-db.json (IEEE snapshot) · ai-config.json (BYO key, git-ignored)
├── lib/ # Pure shared logic (browser + tests): i18n, cidr, correlate, and the app-*.js glue modules
├── src/ # Frontend ESM bundled by esbuild → dist/app.bundle.js (app.js nucleus + glue)
├── styles/ # Modular CSS (partials + design tokens)
├── netmapper.html · login.html · export.js
├── test/ · tests/ · tools/ # Regression suites + syntax check
└── projects/ · users.json · .session-secret # Runtime data (git-ignored)

Design principles:

• Minimal-tooling frontend — the only build step is a lightweight esbuild bundle of the src/ ESM modules; the pure lib/*.js and export.js stay classic static assets by design. The strangler migration to ESM is complete; retiring the transitional window bridge (win.* reads → import, inline handlers → event delegation) is being finished one panel at a time — Axis A (win.* → import) is down to 264 reads and still falling — twice now a supposed floor turned out to be one more caller nobody had converted — and Axis B (inline handlers → delegation) is driven down behind a monotonic ratchet that only shrinks. See ARCHITECTURE.md §10.
• File-based storage — each project is a plain JSON file (easy to back up / version-control); the floor-plan image is kept out of the JSON as a sidecar asset and re-attached as a data-URL on load, so saves stay fast even with large maps.
• Internal plugin model — discovery intelligence is extended with local SNMP/sysObjectID/OUI plugins and self-contained drivers, never external discovery platforms.
• Tested core — bug-prone parsing/normalization logic is covered by a dependency-free regression suite (npm test); CI also runs a syntax check, an ESLint gate, a tsc JSDoc type check and a real-browser e2e suite.

The full module-by-module layout is documented in ARCHITECTURE.md.

No external database. A one-command Docker setup is provided, but it's optional — bare-metal Node works exactly the same.

# 1. Clone the repository
git clone https://github.com/muttley1973/infranetpro.git
cd infranetpro
# 2. Install dependencies
npm install
# 3. Start the server
node server.js
# or
npm start

Open your browser at http://localhost:8421

On first start, a default admin account is created automatically. You will be prompted to change the password on first login.

Windows users: double-click avvia.bat to start the server in a console window.

Prefer git clone over "Download ZIP". The frontend bundle (dist/app.bundle.js) is a build artifact and is git-ignored — it is never in the repo. npm install rebuilds it automatically (via the postinstall hook), so a clone + npm install always runs the current code. A stale ZIP, by contrast, has no .git (you can't tell which version it is) and won't update — the classic "I'm on an old version" trap. If you must use a ZIP, download it from the main branch and re-npm install. To confirm you're current: src/app.js exists and there is no root app.js.

Run InfraNet Pro in a container — no Node install required. The image builds the frontend bundle internally and keeps all data (projects, skins, user accounts) in a named volume, so it survives container re-creation and upgrades.

# 1. Set a fixed session secret (otherwise logins reset on every re-create)
cp .env.example .env # then edit .env → SESSION_SECRET=<random>
# openssl rand -base64 48
# 2. Build and start
docker compose up -d --build

Open http://<host-ip>:8421 (the IP of the machine running Docker). On first start the generated admin password is printed to the container log — read it with docker compose logs infranetpro, then change it on first login.

The default docker-compose.yml uses network_mode: host, so the container behaves like a native install: it sees your real network. Discovery is complete — ARP gives device MACs → vendor names (OUI), alongside SNMP and LLDP/CDP — and the UI is reachable at http://<host-ip>:8421.

⚠️ Security: host mode publishes the (login-protected) UI on the host's interfaces. Keep it on a trusted network; for outside access use a VPN or a reverse proxy with TLS — never expose it directly to the internet. To bind the server to one address set HOST=<host-ip> (or HOST=127.0.0.1 for host-loopback only).

Host networking needs a Linux host. On Docker Desktop (macOS/Windows) host mode is limited — use the isolated variant below.

Isolated (bridge) variant — for a sandboxed container behind a reverse proxy/VPN, or on Docker Desktop:

docker compose -f docker-compose.bridge.yml up -d --build

Here the container's network is isolated from the host: SNMP discovery still works (it's L3), but ARP-based MAC/vendor detection does not — devices without SNMP appear with no MAC/vendor. It binds host-loopback only by default; set BIND_ADDR=0.0.0.0 to reach it from the LAN.

docker build -t infranetpro .
docker run -d --name infranetpro \
 --network host \
 -e SESSION_SECRET="$(openssl rand -base64 48)" \
 -v infranet_data:/data \
 --cap-add NET_RAW \
 infranetpro

All configuration is done via environment variables — no config file needed.

Example:

PORT=80 node server.js

To expose the server on all interfaces (e.g. inside a trusted LAN):

HOST=0.0.0.0 node server.js

⚠️ InfraNet Pro is designed for internal/trusted networks. Do not expose it directly to the internet without a reverse proxy and TLS. When you put it behind a TLS reverse proxy, also set INFRANET_TRUST_PROXY=1 so the session cookie is flagged secure (sent over HTTPS only).

Click New Project, give it a name (e.g. Core Network). Each project stores its own devices, cables, VLANs and layout independently.

Use Add Device to place a switch, router, server or generic device on the rack or floor map. Set the hostname, IP, icon and number of ports.

Select a device → Poll tab → choose driver (snmp-v2c, snmp-v3, ...) → enter community / credentials → Poll. The app fills in:

• Hostname (sysName)
• All physical interfaces with speed, admin/oper state, duplex
• LAG aggregators and their member ports
• VLAN information
• LLDP/CDP neighbours

Use Discover Subnet to scan a CIDR block (e.g. 192.168.1.0/24) and auto-place all reachable SNMP devices. Then Walk Topology on a seed device to recursively pull LLDP neighbours and auto-draw cables between them.

Click any cable to inspect it (mode: trunk/access, native VLAN, allowed VLANs). Click any port LED to see the interface detail and edit its VLAN assignment. LAG member ports glow yellow when selected.

Universal discovery. The Scopri dialog scans with auto (only Community + Timeout to set). A host that speaks v2c is imported with data; a v3-only host is detected without credentials via the SNMPv3 engineID/USM handshake and flagged "v3 da configurare" (a 🔑 pill on the device + a counter next to Sync jump you to each one). You then fill the v3 credentials in Properties → Integration and Sync. Devices that answer both show SNMPv2c · +v3 (v2c is exposed — consider disabling it). The Integration panel is available for any device with an IP (rack and floor: printers, APs, cameras, NAS...), not just rack devices.

Standard, vendor-neutral MIBs (v2c and v3 expose the same OIDs):

• IF-MIB (ifTable/ifXTable, ifStackTable) — interfaces (name, type, speed, status) + LAG stacking
• IEEE 802.3ad (dot3adAgg*) — LACP aggregator / member ports
• BRIDGE-MIB / Q-BRIDGE-MIB — bridge port mapping, VLAN egress/untagged bitmaps
• LLDP-MIB + CISCO-CDP-MIB — neighbour discovery
• Cisco VTP MIB — VLAN names without a per-VLAN community
• SNMPv2-MIB (sysName/sysDescr/sysObjectID/sysServices, sysLocation/sysContact/sysUpTime) — identity, vendor/model intelligence, live system card
• ENTITY-MIB (entPhysical*) — hardware inventory (vendor, model, serial, firmware)
• Printer-MIB (RFC 3805) + hrPrinterStatus — toner/ink %, page count, status (printers)
• HOST-RESOURCES-MIB (RFC 2790) — CPU / RAM / disk (server/pc/nas/homelab, and network gear)

Live read-only cards. System / Printer / Host-resources data is shown as read-only "live" cards in the Integration panel and never overwrites manual fields (manual-first), appearing only when the device exposes them. Printer-MIB is read in an isolated concurrency-1 pass (weak agent stacks like HP JetDirect truncate the supplies columns under a concurrent walk); HOST-RESOURCES is fetched only for compute devices.

A dependency-free sysObjectID engine (engine/sysobject-engine.js, public via const { SysObjectEngine } = require('./engine')) enriches SNMP discovery results without a database. It resolves an OID against local plugins under plugins/ using longest-prefix-wins, runs one isolated instance per webapp, hot-reloads plugin files at runtime, and isolates failures (a plugin throwing in enrich() returns null, never crashes the engine). It can also return OS/agent fingerprints — context-only matches use vendorPrefix: '0' via engine.fingerprint(ctx). server/classify.js resolves row.objectId through it before the legacy PEN/regex fallback. A storage constructor seam is reserved for a future SQLite catalog; today it stays zero-database. This is the preferred extension path for vendor intelligence — refine local plugins, don't add external discovery dependencies. See ARCHITECTURE.md.

The bundled seed catalog covers common home-lab / SMB vendors — network (Cisco, HPE/Aruba, MikroTik, Ubiquiti, Zyxel, Netgear, TP-Link, D-Link), security (Fortinet, Palo Alto), storage/server (Synology, QNAP, VMware), power/video (APC, Eaton, Axis, Hikvision) and OS/agent fingerprints (Windows, Net-SNMP/Linux, Proxmox, TrueNAS, Apple macOS/iOS, Android, Chromecast). It's intentionally practical, not globally complete: sysObjectID has no universal official model database — the stable part is the IANA PEN/vendor prefix, while model-level mappings are vendor/community-specific.

Add one file under plugins/ exporting exactly vendorPrefix, match(oid, ctx) and enrich(oid, ctx) — where enrich returns vendor / deviceType / family / confidence plus optional os and infranet hints. Use the vendor PEN prefix (1.3.6.1.4.1.<PEN>), keep deviceType aligned with InfraNet types (switch, router, firewall, server, nas, ap, printer, webcam, nvr, ups, pdu, iot, pc), prefer generic family logic over per-lab hacks, and never query SQLite/HTTP/external files from a plugin. For OS-only/context fingerprints use vendorPrefix = '0'. Run npm test after changes. The full plugin contract and a worked example live in ARCHITECTURE.md and the seed files under plugins/.

A second plugin-based engine (engine/oui-engine.js, public via const { OuiEngine } = require('./engine')) resolves MAC OUI → vendor + device intelligence, mirroring the sysObjectID engine: plugin-based, hot-reload, zero-database. Lookup uses a compact prefix trie (longest-prefix-wins with priority tie-break) over 24/28/36-bit IEEE assignments plus special non-IEEE blocks (e.g. Docker 0242). A catch-all plugin (plugins/oui/_ieee-database.js) loads data/oui-db.json — the official IEEE snapshot (~57k entries: MA-L + MA-M + MA-S + IAB) regenerated by npm run update-oui and committed so the engine works right after git clone. 32 vendor-specific seed plugins under plugins/oui/ (virtual NICs, network, endpoint, IoT/CCTV, NAS, printer, security) win over the IEEE fallback (priority 0). server/classify.js._resolveOui() enriches every discovery row with vendor (and often deviceType) from MAC, feeds the scoring engine, and filters virtual NICs (isVirtual()) out of auto-link/topology. Helpers: lookup / isVirtual / isLocallyAdministered / isMulticast / getVendor / format. See ARCHITECTURE.md.

The Fusion Scoring Engine (engine/fusion-scorer.js, pure and tested) is the central decision layer: it fuses every discovery signal — the sysObjectID engine, OS fingerprint, OUI engine, sysServices OSI bits, TCP ports and hostname/vendor/banner regexes — into a single classified device with a numeric confidence (10–99), ranked alternatives, the full scores map and an evidences/reasons trail.

Design invariant — vendor identity ≠ device type. Exactly as nmap / Fingerbank / netdisco do, the vendor (from a MAC OUI or a sysObjectID PEN) is identity only and is never keyword‐matched for the type nouns gateway|switch|router|firewall (so a "Gateway Inc." PC or an org literally named "SWITCH" isn't mistyped). Type comes from behaviour/structure, and signals are tiered so a measured signal (SNMP, banner/model text, a probed service port, NetBIOS/SMB, Google Cast, the opt‐in mDNS/SSDP listen for closed‐port devices) always outranks a vendor‐identity inference; a device known only by inference has its confidence capped (manual‐first).

It is the single authoritative classifier — the Discover UI defers to it (the thin client _guessType only fills gaps), the in‐line legacy twin was removed, and behaviour is frozen by the 55‐device tests/classify-golden.test.js plus a representative freeze in tests/fusion-scorer.test.js. server/classify.js._scoreDiscoveredDevice(row) is the production entry point; the discovery payload exposes a classification object (deviceType / confidence / alternatives / scores / reasons) alongside the legacy deviceClass/confidence. See ARCHITECTURE.md.

InfraNet Pro uses a four-level cascade to detect link aggregation groups:

Level 0 — ifStackTable
 Higher/lower layer walk. If ifA is stacked above ifB,
 ifA is the aggregator and ifB is a member.
Level 1 — dot3adAggMemberPorts
 IEEE 802.3ad MIB. Direct map of aggPortAttachedAggID.
Level 2 — dot3adAggPortActorOperState
 LACP bitmask — distinguishes active/collecting/distributing ports.
LLDP-inferred
 If two or more LLDP links exist between the same device pair,
 they are automatically grouped into a logical LAG,
 even without SNMP LAG MIB support on the device.

Cisco IOS specifics:

• Port-channel interfaces have ifType 53 (propVirtual), not 161 (ieee8023adLag)
• The regex /^(port-?channel|bond\d*|ae\d|po\d+$|lag\d)/i catches all common naming conventions
• LAG groups are auto-named from the first aggregator interface with a name (e.g. Port-channel1)

VLAN data is collected from three sources, in priority order:

1. Q-BRIDGE-MIB egress/untagged bitmaps (dot1qVlanCurrentEgressPorts) — most accurate, but requires per-VLAN SNMP community context (public@100) on Cisco IOS
2. Bridge port → VLAN membership from state.ports — used when explicit VLAN bitmaps are available
3. Cisco VTP MIB (vtpVlanName, OID 1.3.6.1.4.1.9.9.46.1.3.1.1.4 — column .4 of vtpVlanTable; .2 is vtpVlanState) — fallback that works without any special community, returns all VLANs defined in the VTP domain (the reserved rows 1002-1005 are skipped)

Trunk vs access detection is derived from the egress / untagged bitmaps: a port is a trunk if it carries any VLAN not in its untagged set.

Users are stored in users.json with bcrypt-hashed passwords (cost factor 12).

The login endpoint is rate-limited to 10 attempts per 15 minutes per IP.

InfraNet Pro is designed for a trusted LAN, behind login, bound to 127.0.0.1 by default. The codebase has undergone an application-security audit (no critical findings) and the follow-up hardening is enforced by tests.

🔐 Found a vulnerability? Please report it privately to the maintainer instead of opening a public issue.

Log in as admin → Settings → Users to:

• Add new users
• Change passwords
• Promote / demote roles
• Delete users

Each project is a plain JSON file in projects/<id>.json: top-level format, schemaVersion, id / name / created_at / updated_at plus a state object holding the network. The main collections are nodes (devices), links (cables — with cabling metadata, LAG grouping, auto-link confidence and pass-through segments), ports (keyed by portId), racks, lagGroups, vlans and VLAN/IPAM state; the floor-plan image is kept out of the JSON as a sidecar asset. The state is migrated idempotently and carries its schema version so older projects remain readable. Verification history and restorable snapshots live in projects/history/<id>/ with retention and are removed together with the project.

The Export → JSON action creates a portable infranet-project-export envelope containing the schema version and state, while removing SNMP credentials and credentials embedded in backup pointers. Import accepts this envelope as well as legacy bare state JSON and server project envelopes.

The secret-free device projection reused by the REST API and the exports is defined in lib/api-shape.js (nodeToDevice). Field-by-field detail of each object (node / link / port / rack) lives in ARCHITECTURE.md.

All endpoints require an authenticated session. Write endpoints require the admin role.

Full request/response schemas are in the machine-readable OpenAPI 3.0 spec at GET /api/v1/openapi.json. A project (and the organisation) travels with an ETag taken from the file itself: a client sending If-Match gets a 409 carrying who wrote last and when, rather than a silent last-writer-wins; a client sending nothing keeps the previous behaviour, deliberately, so imports and scripts do not have to learn a protocol to stay alive. In short: /api/poll takes { driver, host, community, port, timeout }; /api/discover takes a subnet (CIDR or a.b.c.1-254 range) plus driver / community / concurrency / timeout and scan flags (safeMode, deepScan); /api/discover/topology takes one or more seed(s) with maxDepth / maxDevices and streams text/event-stream progress (start, probing, found, queued, dup, skip, warn, done).

A versioned, read-only API for external consumers (Ansible, dashboards, wikis, automation) to read the documented network as a source of truth. Unlike the session-gated endpoints above, /api/v1/* authenticates with a bearer token (no browser session needed) and returns sanitized data only — never SNMP communities or other secrets.

Mint a token as an admin in Users and access → API tokens (shown once), then pass it as a bearer header:

curl -H "Authorization: Bearer inp_..." http://<host>:8421/api/v1/projects/1

Each device exposes id, name, type, brand, model, ip, mac, vlan (derived from IP ↔ subnet), rack, snmp (a boolean — the community is never exposed) and wireless.

integrations/ansible/ ships a ready-made dynamic inventory (infranet_inventory.py, Python standard library only): every device with an IP becomes a host (ansible_host = its IP), grouped automatically by type_*, vlan_*, rack_*, brand_* and backup_missing. Each host also carries ansible_network_os (derived from the documented vendor + sysDescr — Cisco IOS/NX-OS/ASA, Arista, Juniper, VyOS, MikroTik, Fortinet; omitted, never guessed, for unknown vendors) and a config-backup pointer (config_backup_ref/_method/_at) — so a generated backup playbook targets the right module and destination with no hand-editing. InfraNet documents where the backup lives, never the config itself, and never a credential. InfraNet stays the source of truth; Ansible executes. Set INFRANET_URL, INFRANET_TOKEN and INFRANET_PROJECT, then:

ansible-inventory -i infranet_inventory.py --graph

See integrations/ansible/README.md for the full walkthrough.

Full release notes live in CHANGELOG.md. Highlights of what has shipped:

Planned:

• Per-field provenance in the schema — every field carrying an explicit origin (declared / measured / derived), so the document can say where each value came from instead of the app inferring it per screen. Half of it exists: lib/provenance.js is the envelope and lib/project-schema.js classifies all 165 fields of a project — what is missing is the consumption, since today only the multi-site layer is born wrapped in it
• DCIM write-back — the half that writes, gated: maker-checker, dry-run, re-read after the write, and a closed list of writable fields. A deduced cable is never promoted to the DCIM unless its proof state allows it
• ENTITY-SENSOR-MIB (temperatures/fans/PSU) + real PoE wattage per switch
• Explicit topology states in the UI (exact / probable / ambiguous / shared-segment / uplink-to-unknown)
• SQLite-backed storage for discovery/IP history, FDB cache and audit log
• Internal discovery/classification hardening (richer local plugins, more real-device tests)
• Topology multi-source fusion (LLDP + FDB agreement boost; stricter unmanaged-switch detection)
• Discovered-device de-duplication, shadow/rogue-device signal
• Keep discovery propose-and-reconcile, never overwrite (the "discovered ≠ intent" model)

Out of scope (parked): WebSocket multi-user live push, SNMP trap receiver, temporal confidence on links, per-VLAN community auto-config wizard, BGP4 / POWER-ETHERNET / Print MIBs, conduit/cable-tray modeling, fiber loss-budget math, HA Tappe B+C.

The project ships with a zero-dependency regression suite built on Node's built-in test runner (node --test). No framework, no node_modules for tests.

npm test # run the regression suite (node --test)
npm run check # syntax-check all project JS sources
npm run typecheck # JSDoc + checkJs type-check of the pure libs (tsc --noEmit)
npm run build # bundle the migrated ESM frontend modules (esbuild → dist/)
RUN_E2E=1 npm run e2e # headless end-to-end in a real Chrome (login bypass) — off by default

A real headless E2E (test/e2e/, Playwright on the system Chrome via INFRANET_DEV_NO_AUTH) drives the critical flows in a real browser (cable routing, VLAN propagation, wireless, rack drag/pan); it spawns an isolated server on a temp store and is skipped unless RUN_E2E=1.

Coverage focuses on the pure, bug-prone logic that has historically broken: SNMP parsing & extraction (test/snmp.test.js, test/extractData.test.js), discovery & classification (test/discovery.test.js, 14 real-device cases), correlation primitives (test/correlate.test.js), the sysObjectID / OUI / Fusion engines (tests/*.test.js), front-panel state, cable validation (incl. Cat8 30 m reach), IPAM & LAG audits, and an app-wide smoke E2E (test/smoke-app.test.js) that loads every netmapper.html script plus the esbuild bundle into a vm + DOM stub and asserts renderAll/renderProps never throw on any device type.

Current local quality baseline:

• npm run check parses every JS source of the product — 528 of them. It skips the folders eslint.config.js already ignores (git worktrees, the private workspace, the editor's caches), so the number stays stable between runs instead of drifting with whatever happens to be checked out beside the repo
• npm test runs the full regression suite (currently 3,549 tests, 0 failing) plus a real‐browser E2E suite (RUN_E2E=1, 120 flows)
• final visual verification is still important for rack/front-panel refinements

Pure functions are exposed for tests via an additive _internals export on drivers/snmp.js and server.js — runtime behaviour is unaffected. server.js starts its listener only under require.main === module, so it can be imported by tests without binding a port.

CI (GitHub Actions) runs npm run check and npm test on every push and pull request to main, across Node 18 and 20.

Found a bug, or want to request a change? Here's where it goes:

• 🐞 Bugs → open an issue using the Bug report template (steps, version, OS, logs).
• 💡 Feature requests / changes → open an issue using the Feature request template.
• 💬 Questions & ideas → start a Discussion — best for open-ended ideas before they become a concrete issue.
• 💼 Commercial license / private enquiries → see LICENSING.md.

Contributions are welcome! Please follow these guidelines:

1. Fork the repository and create a feature branch (git checkout -b feature/my-feature)
2. Respect the minimal-build philosophy — the only frontend build step is the lightweight esbuild bundle of the src/ ESM glue (npm run build → dist/app.bundle.js, run automatically by npm install/npm start). The pure lib/*.js, app.js, export.js and the modular styles/ CSS stay plain static assets loaded directly; no transpile step
3. New device drivers go in drivers/<protocol>.js and must export poll(cfg), probe(cfg) and optionally pollNeighbors(cfg)
4. Test against real hardware or a GNS3/EVE-NG lab before submitting
5. Open a Pull Request with a clear description of what changed and why

// drivers/myprotocol.js
'use strict';
/**
 * @param {object} cfg { host, port, timeout, ...protocolOptions }
 * @returns {Promise<{ hostname, interfaces, lags, vlans }>}
 */
async function poll(cfg) {
 // ... your implementation
 return { hostname, interfaces, lags, vlans };
}
/**
 * Quick reachability probe — used by /api/discover
 * @returns {Promise<{ reachable: boolean, hostname?: string, descr?: string }>}
 */
async function probe(cfg) {
 // ...
 return { reachable: true, hostname: 'myswitch' };
}
module.exports = { poll, probe };

Register it in server.js:

const DRIVERS = {
 'snmp-v2c': loadDriver('snmp'),
 'myprotocol': loadDriver('myprotocol'), // ← add here
};

InfraNet Pro is free and open source (AGPLv3). If it saves you time, you can support its development with a coffee on Ko-fi — it funds the work that keeps new features coming. ☕

Support me on Ko-fi

Need it adapted to your company's specific devices/APIs, or embedded in a closed-source product? Custom integration and commercial licensing are available — see LICENSING.md.

GNU Affero General Public License v3.0 or later (AGPL-3.0-or-later) — Copyright © 2026 muttley1973. Full text in LICENSE.

InfraNet Pro is free software: you can use, study, share and modify it under the terms of the AGPLv3. In short — if you run a modified version to provide a service over a network, you must make your modified source available to its users.

A commercial license is available for organizations that prefer not to be bound by the AGPL copyleft obligations (e.g. embedding InfraNet Pro in a closed-source product). Custom integration to specific device APIs is also offered. See LICENSING.md for details and contact.

This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU AGPL for more details.