NetInv v1.0.0

NetInv is a network asset monitoring platform — a modern successor to Cacti + Weathermap. SNMP collection, ICMP availability, inventory with change history, alerting, a weathermap editor, and flow collection, on Go + VictoriaMetrics + PostgreSQL.

It runs a real network. The reference pilot has been live continuously through development: four UniFi gateways in an SD-WAN mesh, a Ruckus Unleashed controller with a mesh AP, a published weathermap over six WireGuard tunnels with live traffic, and three gateways exporting NetFlow.

Read this before deploying

v1.0.0 ships with four release gates open. They were written at the start of the pilot and are not met. They are listed here rather than dropped, and the reasoning is in ADR-023.

1. Six of eight connectors have never been run against the hardware they target. ubiquiti, generic and ruckus are validated against real units and documented in doc 10 with what each device actually exposes. cisco-ios, juniper-junos, huawei-vrp, zte-zxr, fortinet-fortios and paloalto-panos are written from published vendor MIBs and have never received a packet from the platform they describe. If you run one of those, expect to find faults — and please report them.
2. No soak or chaos testing. There is no staging Kubernetes cluster behind this release. Behaviour under sustained load or component failure is untested rather than proven.
3. No TLS security review. The doc 20 §12 checklist has not been run against a TLS deployment.
4. No backup/restore drill. Restoring this system from backup has never been rehearsed. Do your own before you rely on it.

What is validated: a live single-site pilot running continuously, an automated suite covering both Go modules and the frontend, and every gate in CI — build, vet, golangci-lint, race detector, connector plugin contract, licence check, shellcheck, Helm lint, and Playwright end-to-end.

What it does

Collection. SNMP v2c/v3 for interface traffic, device health, inventory and topology, plus ICMP availability. Eight vendor connectors behind a compile-time plugin contract — adding a platform is one package and one registry line, with no core changes.

Weathermap — the flagship. A drag-and-drop editor with LLDP-based link suggestions, draft/publish revisions, and live utilization on the Cacti colour scale. Links show one band coloured for the heavier direction with the reverse rate still readable, name their destination so a crossing map stays legible, can be deleted without deleting their nodes, and parallel links between the same pair are drawn apart.

Flow collection (ADR-020/022). A dedicated netinv-flow service decodes NetFlow v5, v9 and IPFIX on UDP 2055 and 4739 — including v9/IPFIX templates, options-template sampling, IPv6, variable-length and enterprise fields. It aggregates at ingest into top-N talkers, conversations and applications per interface, so cardinality is bounded by construction and no per-flow record is stored. Surfaced on a device Flow tab and a dashboard panel, with an in-product setup guide carrying per-vendor snippets.

Dashboards and graphs. A per-user customisable dashboard including embedded weathermaps and arbitrary metric panels. One shared time range across every graph using Cacti's nineteen timespans. Retention configurable, defaulting to two years, with a Capacity page that measures whether the disk will actually hold it.

Alerting. Threshold, state and inventory rules evaluated against MetricsQL, with acknowledge/silence, and delivery by email, webhook or Slack.

Operations. RBAC with audit trail, per-site pollers, discovery, an SNMP OID browser for working out why a metric is empty, and a fleet-wide poll cadence settable from the UI.

Deploying

• One host: deploy/compose-app/quickstart.sh (doc 32).
• Proxmox LXC: deploy/proxmox/netinv-lxc.sh create|verify|destroy (doc 33), verified end to end on Proxmox VE 9.2.10 — including the fix for unprivileged-container ICMP that Docker's ping_group_range clamping breaks.
• Kubernetes: Helm charts for the app and for remote-site pollers.

Images for all seven services are published per release.

A note on the documentation

Thirty-four design documents, and they are kept honest rather than aspirational: where the code diverges, the doc changes in the same commit. Several record things this project got wrong and later corrected — most recently a flat claim that UniFi gateways cannot export flow, which was inferred rather than tested, and turned out to be false. The reasoning behind every architectural decision is in DECISIONS.md as numbered ADRs.

Contributing

The most useful contribution is a hardware validation report for any of the six unvalidated connectors — see CONTRIBUTING.md and the ask in Discussions. SECURITY.md covers vulnerability reporting and the deployment posture worth knowing before exposing this anywhere.

Apache-2.0.