Built from your switches’ own tables.

• Reads with SNMP GET, GETNEXT and GETBULK only. The client has no Set method, and a test fails the build if one appears.
• SNMPv3 with SHA-256 authentication and AES-128 privacy by default. MD5, DES and no-auth are refused, and nothing is sent with refused credentials. SNMPv2c is allowed only as a logged exception.
• Each poll reads the MAC table, ports and link aggregation, LLDP and CDP neighbors, and ARP tables, from the standard bridge, interface, IP and LLDP MIBs. Each source is polled every 150 seconds by default.
• Ports are classed as desk, uplink, phone, access point, hypervisor or behind an unmanaged switch. A device seen only on uplinks is marked “not placed”, never guessed.
• Every read is capped in rows, bytes and time, so one misbehaving switch cannot stall the rest. Every string a device sends is cleaned and capped before it is stored.
• An optional local scan, which a person starts, lists devices on the attached subnet before any switch is added: one empty UDP packet per address, no port probes and no credentials. Scan results are labeled point-in-time and never count as monitoring.

Each device has a provable history: when it was first seen, every time it arrived and left, and every change of status. Every evidence pack carries inventory.csv with first seen, last seen, status, how the device was seen, and the decision entry behind each status.

Entries this feature writes to the tamper-evident audit log. Each one is in the evidence packs that cover its date.

• poll_runA source’s first poll, and any poll whose status, coverage or warnings change, with the SHA-256 of its normalized table.
• poll_rollupOne per source per hour, summarizing every poll with a SHA-256 of its runs, so coverage stays provable after per-poll rows are purged at 30 days.
• device_first_seenThe first time a MAC address appeared, and where.
• presence_openWhen a device arrived on a port. presence_close records when it left.
• status_changedEvery change of status, linked to the decision behind it.

What it does not do yet, stated plainly. The technical page lists every known gap.

• Collection is SNMP only today. Reading tables over SSH and vendor APIs is planned.
• There is no SNMP trap receiver yet; changes are seen at the next poll. Branch tripwires catch links that came and went in between.
• Each source is matched to a vendor profile by its sysObjectID and sysDescr, and each poll records the profile used. Today’s profiles are generic (the standard MIBs), Cisco IOS (adding per-VLAN contexts) and Meraki, whose MAC and ARP tables need its dashboard API, which is not built yet. Profiles for other makers wait on captures from real equipment.