A desktop app for Aruba switches. It reads each switch over SSH and shows what's down, what's misconfigured and how the switches connect to each other.

Website · Documentation · Download · Discussions

Every morning I want to know the same things about the switch network: is everything up, did anything change overnight, is spanning tree still sane, and which port goes where. Clicking through web UIs one switch at a time is slow, and a full NMS is a lot to run for a few dozen switches. SwitchDesk reads the switches over plain SSH and keeps everything on your machine. It started with a few dozen switches and is used on networks of several hundred.

Online and offline counts, a problem list sorted by severity, and every switch drawn as a faceplate with one LED per port. Green is up, grey is down, a slashed outline is disabled, amber means spanning tree is blocking it. The faceplates follow the hardware: copper, SFP and module ports sit in separate blocks, and each member of a stack gets its own row.

System facts, a management-access checklist, spanning tree (bridge, root, port roles and states), ports with their configured names and optical levels for SFPs, VLANs, LLDP and CDP neighbors, logs, the running config, and the raw output of every command it ran. Config copies are saved whenever the config changes, and any two can be compared side by side. A console runs show, ping and traceroute, and nothing else.

Create, rename and delete VLANs, and set port membership by clicking ports through untagged, tagged and off. Before anything is sent you see the exact commands. Sending stops at the first line the switch rejects, and write memory only runs when every line before it went through.

A network-wide matrix shows which switch carries which VLAN and flags names that don't match between switches. From there you can rename, add or remove a VLAN on many switches at once, and review every switch's commands before anything is sent.

On AOS-S and AOS-CX, add or remove RADIUS servers and turn 802.1X and MAC authentication on or off per port, with the client limit and re-authentication period. On AOS-S you pick the VLAN for clients that don't log in. On AOS-CX you create local roles with their VLAN and choose per port which role a client gets after a login, after a rejected login, while RADIUS can't be reached and before a login. AOS-CX also lists the connected clients from show port-access clients detail: port, MAC address, user, IP address, login method, status, role and the VLAN the client was put in, read at each collection or with Refresh. Ports that link to another switch or an access point are marked, and you're warned before turning on a login there. Shared secrets never appear on screen, in the command preview or in the transcript.

The interface comes in English and German so far, and every language is welcome. Translations are plain JSON files that anyone can write or fix without building anything: drop one into the data folder and pick it in Settings. See Translating SwitchDesk, and claim your language in #17. Even a half-finished file helps, since anything left empty stays in English.

Off by default. Turn it on in Settings and SwitchDesk asks for a password when it starts. The saved switch passwords can't be read without it, not even from the data folder. The window can also lock itself after some idle time.

Built from LLDP and CDP and laid out top-down from the spanning-tree root. Drag switches wherever you like and the layout is kept. Blocked links are dashed amber, down links red. Firewalls, access points and switches you don't manage get their own shapes. Phones and hosts stay hidden until you turn them on. Hover a switch to see port numbers on its links, double-click to open it.

Between full reads, SwitchDesk checks that each switch is still up, and Settings decides how. By default it opens a TCP connection to port 22 and closes it straight away. That works over most VPN and zero trust setups, but the switch logs every check as an SSH connection, which fills the log on a busy network. Switch the check to ping and no SSH connections are made, as long as ICMP reaches the switches. Turn it off and a switch's status only changes when it's read. With the read interval at 0 as well, SwitchDesk connects only when you click Collect now.

Search by name, address, site, model or software, or by state: offline, disabled, problem. Words combine, so acc offline finds offline access switches. Press / to jump to the search box. Tick switches to collect, disable, enable or delete them together, or use the small buttons at the end of each row. A disabled switch keeps its last data but isn't checked, read or alerted on until you enable it again.

Each switch shows the version it runs, what's in its primary and secondary bank, and whether your firmware library has something newer for its platform. Update copies the image into the spare bank (the running version stays in the other one as a fallback), sets it as the boot default, saves the config and reboots, then checks that the switch came back on the new version. Pick several switches and they're updated one at a time. Or choose copy only and reboot whenever suits you.

On AOS-S, SwitchDesk uploads the image to the switch over SSH (SFTP, or SCP on older firmware). The switch never has to connect back to your computer, so this works over a VPN or zero trust access. For the upload it turns on ip ssh filetransfer, which also switches off the switch's TFTP client and server, and afterwards it puts those settings back the way they were.

On AOS-CX, which has no SFTP or SCP server, the image goes over HTTPS to the switch's REST API, again from your computer to the switch. If the web server is off in the management VRF, SwitchDesk turns it on for the upload and off again afterwards.

Only if the upload is refused does the switch pull the image from SwitchDesk over TFTP (UDP 69). For that the switch has to be able to reach your computer.

HPE only offers firmware downloads after you sign in, so you fill the library yourself. Add .swi files you downloaded, or paste a download link from the HPE Networking Support Portal and SwitchDesk fetches it. Images are matched to switches by platform code (WC, YA, KB, FL, PL…), read from the file name or the image itself.

Automatic mode (Settings) can copy new firmware to every switch's spare bank as soon as it lands in the library, or also install it by rebooting one switch at a time inside a maintenance window you set.

AOS-CX and AOS-S switches only need SSH, plus LLDP if you want the map. Instant On switches need nothing on the switch. Locally managed ones are read through their web interface; cloud-managed ones through the Instant On portal, with an account that has two-step verification turned off (a separate view-only account works best).

If your model isn't listed or reads wrong, open an issue with the model number, its firmware version and the output of show version. When a reading fails, paste the message SwitchDesk shows too. It names the command or page that failed.

Download the latest build from Releases.

Get SwitchDesk-…-macos-universal.zip (runs on Apple Silicon and Intel), unzip it and drag SwitchDesk into Applications. The app isn't notarized by Apple, so the first time right-click it and choose Open, or run:

xattr -dr com.apple.quarantine /Applications/SwitchDesk.app

Get SwitchDesk-…-windows-x64.zip, unzip it and run SwitchDesk.exe. If SmartScreen warns about an unknown publisher, choose More info → Run anyway. WebView2 is already part of Windows 10 and 11.

With Go 1.23+ installed (on a Mac also the Xcode command line tools):

git clone https://github.com/jaba0x/SwitchDesk.git
cd switchdesk
./scripts/build-mac.sh          # macOS: builds, installs to /Applications and opens it
.\scripts\build-windows.ps1     # Windows: builds build\bin\SwitchDesk.exe

SwitchDesk checks GitHub for a newer release when it starts and every few hours after. When one is out, a yellow bar at the top of the window links to the download. Settings → Check for updates does the same on demand.

The build workflow publishes a release with both downloads attached. Push a tag like v0.2.0, or run the workflow from the Actions tab and enter a version.

1. Add a switch with its address and credentials. Test connection shows the hostname and switch family before you save.
2. Add many takes one address per line, name, address pairs, or ranges such as 10.0.1.20-10.0.1.40.
3. The first read starts right away. After that, each switch's SSH port is checked every 30 seconds and each switch is re-read every 15 minutes. In Settings you can change both, check with ping instead, or turn the checks off.

Everything stays on your computer, in one folder.

• inventory.json holds switches, settings and map positions. Passwords are encrypted with AES-GCM using a key in secret.key, readable only by your user. With an app password set, secret.lock replaces it: the same key, encrypted with your password.
• snapshots/ keeps the last reading of each switch, so the app opens with data. It loads in the background, so the window opens straight away even with hundreds of switches.
• translations/ is where your own translation files go (optional).
• backups/ keeps a copy of a switch's running config each time it changes.

To use another folder, go to Settings → Data → Change. You can move the data to another disk or a synced drive, copy it there, or open a folder that already has SwitchDesk data. The key moves with the folder, so the same folder works from any computer that can reach it.

To move to another computer, use Settings → Data → Export. It writes a single .sdbak file. Passwords inside are re-encrypted with a passphrase you pick (Argon2id + AES-GCM), so the file is safe to carry around and opens on any machine. On the other computer, Import either adds the file's switches to the ones already there or replaces everything with the file's contents.

SSH host keys are pinned on first connect. If a switch later presents a different key, SwitchDesk stops connecting to it until you confirm on the switch page.

The full guide is at jaba0x.github.io/SwitchDesk/docs: install, first steps, every screen, firmware updates, moving your data, and troubleshooting. It's built with MkDocs from the docs/ folder. The landing page at jaba0x.github.io/SwitchDesk is plain HTML in web/. Both are published on every push.

go test ./internal/...
wails dev

The UI is plain HTML, CSS and JavaScript in frontend/dist with no build step. To work on it in a normal browser with sample data, open frontend/dev/preview.html. Add ?lang=de to see it in German, or ?locked for the lock screen.

The interface is written in English. frontend/dist/i18n.js swaps in the chosen language as the page is drawn, so new code needs nothing special. After changing interface text, refresh the list translators work from with cd tools/i18n && npm install && npm run extract.

internal/sshx    SSH shell sessions (prompts, paging, escape codes, legacy ciphers) and SFTP/SCP uploads
internal/aruba   command sets per family, output parsers, VLAN and port-access change builders
internal/core    polling, problem rules, network map
internal/store     inventory, encrypted credentials, snapshots, config copies
internal/firmware  image library, version matching, built-in TFTP server
internal/cxrest    firmware upload to AOS-CX over its REST API
internal/instanton Instant On portal sign-in and reads
internal/ionlocal  Instant On web interface sign-in and reads (local management)
tools/i18n         collects the interface text into frontend/dist/i18n/en.json

The parsers are tested against sample output from AOS-S and AOS-CX. When a switch prints something they misread, the Raw output tab shows exactly what came back. That output makes a good test case.

Built by Jaba Macharashvili. More of my infra, homelab and hardware projects are on clihero.com.

Thanks to Arne Naessens for mass VLAN editing, port access, the disabled-port display and the ntp server-name fix, and to everyone who reports issues or helps translate.

Built with Wails. Fonts are IBM Plex, under the SIL Open Font License.