Snitch is a self-hosted network monitor and outbound firewall that shows every connection your server makes, which process opened it, and where in the world it goes, then lets you block it on the spot. A live force graph puts your machine at the center with each remote host as a node, while a world map plots geolocated destinations and a sliding timeline keeps the last day of traffic searchable. Every alert is actionable: block the IP, kill or suspend the process, or write a rule that firewalls matched hosts automatically by address, domain, port, country, or ASN. Detection covers port scans, beaconing, DNS tunneling, ICMP tunnels, cleartext ports, and self-signed or mismatched TLS certificates, and an isolation-forest model learns your normal flows and flags outliers. A lockdown switch cuts all public outbound traffic while the LAN stays up, for the moment something looks wrong. Findings can stream to Wazuh, Splunk, or Elastic as syslog and ECS events, or land in Discord, Slack, and Telegram as webhook alerts. Everything stays on your machine: history lives in a local database, geolocation works fully offline, and the interface speaks eight languages. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Your router calls it "Unknown device" at 192.168.1.23; Vedetta calls it the kitchen light and shows its work. Vedetta is a Home Assistant app that scans your local network, identifies what each device actually is, and explains every identification. One scan lists every device it can find with presence and latency history, in tile or list view, light or dark, on a computer or a phone. Behind each name sits the recognition engine: it weighs many weak clues together, counts a repeated fact once, groups devices by family, and shows certainty honestly, keeping anything doubtful in Other rather than inventing a label. Tap the info marker beside a name, brand, or type and a pop-up lists every clue, its weight, and the hypotheses that were rejected. Names or rooms you set by hand are never overwritten by later scans, and sleeping phones are remembered instead of flickering in and out. Choose from three search levels depending on how hard you want it to probe, let the nightly deep search refresh the picture, and use the network doctor to spot duplicate addresses, repeated restarts, devices that drop together, or a slowing gateway. It can also publish what you choose to Home Assistant and MQTT, display devices from other networks your Home Assistant already sees, and mask exports before they leave the machine. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Most home and office networks quietly accumulate dozens of devices nobody can name, and LAN Orangutan answers the basic questions about all of them: what is connected, what changed since yesterday, and what should not be there at all. It scans one or several networks with nmap and merges in the host ARP table, resolving MAC addresses, manufacturers, hostnames, and device types so a phone, printer, TV, and server each show up as themselves rather than as bare IP addresses. You label devices, file them into your own groups and locations, and attach notes that survive every rescan, turning a one-off scan into a maintained inventory. Snapshots freeze the network at a moment in time, and comparing two of them shows exactly which devices appeared, vanished, or moved to a new address. Mark the devices you expect, and the dashboard flags newcomers and missing hardware, with webhook notifications to Telegram, Discord, Slack, ntfy, or Home Assistant when something changes. Tailscale peers appear next to local devices, so the laptop on your tailnet and the printer downstairs live in the same list. Risky exposures such as Telnet or FTP get flagged, scans show live progress you can cancel, and a password you create on first open guards the whole dashboard. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

NetMap answers the four questions every homelab owner asks in four different tools: what is on my network, what address did it get, is it still up, and why is the firewall shouting about it. Devices you add appear automatically on a visual canvas where you can drag them into place, draw the links between them, and group them into VLANs or separate sites, and the layout is still there when you come back. Behind the map, every device is watched continuously: ping times graphed over history, service checks on the ports you care about, a heartbeat strip that betrays intermittent dropouts, and an uptime percentage that settles arguments. Address management stops being a spreadsheet: define subnets, import the leases your router already handed out, see used and free addresses as a grid, and get warned before a duplicate assignment causes a mysterious outage. Firewall logs stream in live and each entry links to the device it concerns, ready to search by address, port, or protocol. When something new appears, a network scan discovers hosts with their names, hardware addresses, and open ports for review before they join the inventory. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. GPL-3.0 licensed.

HomeLabInfo gives your homelab one dashboard where the network itself and everything running on it finally appear together, instead of scattered across router pages and terminal sessions. It watches for new devices the instant they ask the network for an address, identifies who made them, and can fire a webhook so you hear about a stranger joining your LAN before you notice it yourself. Scans keep track of which devices are online and which have gone quiet, and the interactive topology view lets you arrange the map of switches, access points, NAS boxes, and servers the way your rack actually looks. Lightweight agents installed on each machine report their containers back to the hub, so running and stopped containers, uptime, health, and host CPU, memory, and disk all show in one place without opening a separate tool per server. When an agent falls behind, its card tells you a newer version exists instead of leaving you guessing. You can add a username and password login before putting the dashboard anywhere beyond your desk, and arrange container layouts that stay put between visits. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. GPL-3.0 licensed.

TapMap draws a computer's live network connections on an interactive world map, so you can watch which applications are talking to which services, where those services sit, and what normal looks like for that machine. A local pipeline scans active sockets, extracts the remote addresses, and enriches them with geolocation from databases stored on the machine itself. Every connection carries the owning application or process, its network operator, and the operating system's verification status for that app, and places that share a location are highlighted when connections overlap. The same view lists local open ports, both TCP listeners and bound UDP sockets, established services on your LAN, and public services whose location could not be mapped. A rolling 30-day history turns raw connections into awareness: an Insights panel surfaces new applications, providers, countries, and ports, plus the most frequent activity, while a Significant Connections log records first sightings and failed verifications. A Daily Activity Report goes further, sorting applications into seen-once, occasional, recurring, and stable patterns, analyzing provider concentration, and charting country activity with detailed timelines. New significant connections can raise a desktop notification or publish to an MQTT broker you configure. Nothing is sent anywhere by default: processing happens locally, with no telemetry. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Network traffic stops being a mystery once ntopng names the hosts, applications, and protocols behind every flow, live in your browser. To find the host saturating an uplink, open the dashboard, which ranks top talkers, countries, autonomous systems, and protocols beside historical charts. To see what a suspicious host is contacting, open its page for traffic, ports, DNS queries, TLS details, and visited sites, plus a map of its conversations. Deep packet inspection recognizes applications such as Facebook, YouTube, and BitTorrent, so charts name the app behind the bytes instead of relying on port numbers alone. The console reads packets from a SPAN port or TAP and NetFlow, sFlow, or IPFIX records from routers and switches through nProbe, so it can cover a single switch or many remote sites. Behavioural checks raise alerts for flows, hosts, and interfaces and send them to email, Discord, Telegram, or webhooks. Active monitoring probes remote hosts over ICMP and HTTP/S, and network discovery lists the devices on your local network. A REST API and Lua scripting pull statistics into your own tools and add custom checks. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. GPL-3.0 licensed.

Point your routers at Akvorado and every NetFlow, IPFIX, and sFlow record crossing your network becomes a chart you can interrogate. The web console opens on a live summary of flows per second, exporter count, and traffic split by autonomous system, port, protocol, country, and address family. From there, the visualize page turns stored flows into stacked, line, grid, and heatmap time series, plus Sankey diagrams that show how traffic moves between networks, interfaces, and countries. Filters use a simple SQL-like syntax, so a question like which customers pulled traffic over a transit link last night becomes a query, not a support ticket to your future self. Because the outlet polls each exporter with SNMP or gNMI, flows arrive wearing real interface names, descriptions, and speeds instead of raw ifIndex numbers nobody can read. GeoIP lookups attach country and city to addresses, classification rules tag providers, peers, and connectivity types, and optional BMP sessions add AS paths and BGP communities to every flow. Retention is tiered: raw flows keep full detail for recent days while one-minute, five-minute, and hourly rollups stretch summaries across a year of history. A Grafana plugin is available too, so the same flow data can sit on the dashboards your team already watches. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Netra watches your network from the side, plugged into a switch mirror port, and turns everything it sees into a live picture of your traffic without ever sitting in the forwarding path. A single binary loads its eBPF collectors in the kernel, so aggregation happens before packets reach user space and multi-gigabit mirror feeds stay observable instead of dropping samples. The dashboard opens on totals, protocol share, and traffic trends, then lets you drill into flows by address, port, domain, or service, check which countries your traffic talks to on a world map, and read the internal topology as a live graph. Domains surface passively from TLS handshakes, public addresses are enriched with country and organization data, and heuristic detectors flag scanning, flooding, and single-host surges, pushing alerts to your team chat with an optional AI-written explanation. You can ask the built-in assistant questions about real recorded history, connect external MCP servers so it can call your own tools while it answers, and stream flows onward to Kafka for other consumers. History rolls into compressed columnar files on a schedule and stays queryable for a month by default. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. GPL-3.0 licensed.

Monitoring everything from network switches to Kubernetes clusters since 2001 with over 6,200 GitHub stars and deployments exceeding 100,000 devices per installation, Zabbix has established itself as one of the most mature and feature-rich open-source monitoring platforms available, trusted by organizations including Dell, Salesforce, ICANN, and T-Mobile. The platform collects metrics from virtually any source using Zabbix Agent written in C, Zabbix Agent 2 written in Go with native plugin support, SNMP v1/v2c/v3 polling and trapping, IPMI for hardware health, JMX for Java applications, SSH and Telnet checks, HTTP/HTTPS polling, and ODBC database queries. Version 7.0 LTS introduced synthetic browser monitoring that executes user-defined JavaScript via WebDriver to simulate multi-step user interactions on websites, proxy load balancing with automatic host redistribution across proxy groups for high availability, in-memory proxy data buffering delivering up to 100x performance improvement, native multi-factor authentication with TOTP and Duo support, and just-in-time user provisioning from SAML and LDAP. Low-level discovery automatically detects file systems, network interfaces, SNMP OIDs, VMware resources, and Kubernetes pods, creating monitoring items and triggers dynamically. The alerting engine correlates events with configurable escalation chains, sending notifications through Slack, Microsoft Teams, PagerDuty, Jira, email, and SMS with customizable message templates. Over 1,000 official templates provide instant monitoring for Linux, Windows, VMware, AWS, Azure, Docker, PostgreSQL, MySQL, Apache, Nginx, and hundreds more. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Servers, services, and network gear report their health to Icinga 2, the open-source monitoring core that runs checks, evaluates thresholds, and decides who gets woken up. A distributed hierarchy of master, satellite, and agent zones scales from a single box to global estates: satellites execute checks in remote regions and keep working when the master is unreachable, while agents run local checks under TLS-secured, certificate-based trust. The object-based configuration language defines hosts, services, dependencies, and notification rules as code, with apply rules generating checks across whole groups automatically. Performance data streams into Graphite, InfluxDB, or Elasticsearch writers, and Icinga DB carries runtime state and history into Redis and SQL for the web frontends. The REST API drives acknowledgements, downtimes, and check scheduling from scripts and chat tools, with fine-grained permissions down to diagnostic information. The 2.16 line hardens API security, streams richer runtime updates to Icinga DB for the new Icinga Notifications 1.0 incident workflows, and lets operators set exact acknowledgement times through the API. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. GPL-3.0-or-later licensed.

Resolvr gives your Technitium DNS server the clean, readable dashboard it deserves, turning raw query traffic into an overview you can understand at a glance. Four tabs divide the picture: Traffic charts queries over time with allowed and blocked stacked together and a seven-day heatmap of when your network is busy; Resolution shows where answers come from, cache, upstream, blocked, or authoritative, with response times and a flow diagram of each lookup; Top lists rank your chattiest clients and most-requested domains; and Infrastructure tracks DHCP scope usage, zones, and cache growth. Every chart is a doorway: click one and you land in Query Logs already filtered to what you clicked. Pick any device on the Clients page to see its queries, block rate, DHCP lease, and favourite domains. Query Logs themselves filter by client, name, protocol, response code, and time window, export to CSV, and can live-tail as new lookups arrive. Blocked Zones manages your feeds, your own blocked domains, and a checker that tells you whether a name is blocked and which feed caught it. Run a Technitium cluster and each panel gains a scope chip, comparing nodes side by side or merging their logs into one timeline. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

SpatiumDDI is the open alternative to commercial DDI platforms that charge by the IP, by the appliance, and by the feature, then lock every zone and subnet you own inside a renewal cycle. It does not just render configuration for servers somebody else runs, but deploys and operates BIND9, PowerDNS, Technitium, and Kea itself. Manage zones and records with per-server sync state, hand out DHCP scopes, pools, and static reservations per server group, and watch live leases reported back by the Kea agents. The IPAM side keeps spaces, blocks, and subnets in a tree with per-address DNS and DHCP sync, while the dashboard shows utilization, capacity, and platform health at a glance. Bring an existing estate with you through importers for BIND, Windows, PowerDNS, Technitium, Kea, ISC, and NetBox, and manage Windows DNS and DHCP agentlessly over WinRM when a full cutover is not on the table. Delegate safely with group-based roles over LDAP, OIDC, SAML, RADIUS, or TACACS+, search every object globally, and keep an append-only audit log of who changed what. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

Spreadsheets and sticky notes stop scaling the day your network grows past a rack or two, so JT-IPAM keeps every address, subnet, and device in one searchable system of record. Track subnets and individual IPs with their hostnames, MAC addresses, and owners, then reconcile what you documented against what scan agents actually find through ICMP, ARP, reverse DNS, and SNMP collection from routers and switches. Connect the DNS servers you already run, from PowerDNS and BIND 9 to Windows DNS and Technitium, and flag records that have no matching address in IPAM. Pull devices and virtual machines in from LibreNMS, Zabbix, Proxmox VE, ESXi, Hyper-V, and OpenStack so monitoring and address records stop drifting apart. Draw floor plans and rack elevations, trace a cable across multiple hops, and open an SSH terminal, SFTP browser, or RDP desktop to a device straight from its address page. Route new address requests through configurable multi-stage approval workflows, distribute certificates to web servers and firewalls from central encrypted storage, and keep a full audit trail of every change and console session. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Neko Master watches every connection flowing through your Clash, Mihomo, or Surge gateway and turns the stream into a live map of devices, domains, countries, and proxy nodes, so questions that once needed packet captures get answered at a glance. The dashboard refreshes over WebSocket as traffic moves, charting upload and download trends across thirty minutes, one hour, or a full day. Domain views rank every host your network contacts by traffic and connection count, and IP views add ASN and geographic detail, so an unfamiliar endpoint explains itself instead of raising an alarm. Proxy statistics break traffic down per node and per rule, which makes a saturated exit, a misrouted application, or an underused subscription obvious in seconds. One panel watches several gateways at once: add OpenClash backends directly, or install the one-command agent on OpenWrt, Linux, or macOS machines beside remote gateways and let each agent report home. Because agents open the connection outward, gateways behind NAT still report in, and the panel never reaches into your network uninvited. History persists in SQLite by default, and busy networks can dual-write traffic statistics to ClickHouse for larger histories while configuration stays in SQLite. Token-based access control protects the dashboard, dark mode and an installable PWA keep it comfortable on a phone, and the interface switches between English and Chinese. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Subnet math, DNS lookups, DHCP options, and certificate checks share one browser tab in Networking Toolbox, a free toolkit for sysadmins and network engineers. Need to carve a /24 into departments? The VLSM planner fits named subnet requirements into a parent block, reports each subnet's efficiency and the leftover space, and exports the plan as CSV or JSON. Merging address lists? CIDR utilities summarize, split, compare, and deaggregate prefixes, with set operations for difference, overlap, and containment. Writing configs? Generators build DHCPv4 and DHCPv6 options, PXE profiles, Kea or ISC snippets, and SPF, DKIM, DMARC, CAA, TLSA, and SRV records, and DNSSEC helpers calculate key tags and DS records. Something broken? Diagnostics query DNS through Cloudflare, Google, Quad9, OpenDNS, or a resolver of your choice, read TLS certificate chains, grade HTTP security headers, trace redirects, check TCP ports, look up BGP routes and RDAP records, and test mail servers. Need a refresher? Reference guides explain private ranges, CGNAT, IPv6 address types, and common ports. A keyboard search palette puts any tool a few keystrokes away, and bookmarked tools stay available offline. Eighteen themes, four languages, custom branding, and accessibility switches make it feel like your own, and a keyless JSON API serves the subnet, CIDR, IP, and DNS utilities to scripts. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.