NacTrack
FRGet the demo
Product

No probe. No agent. No traffic mirror.

NacTrack opens an SSH session on each device, runs read only commands, and closes it. Here is what happens between the session and the answer.

See the live demoThe how to guides
app.nactrack.com/diff/config
Comparing two collections: what changed between two dates

The four stages of a collection

  1. 1

    Connection

    SSH with the credentials you provide, read only. Telnet remains possible for devices that offer nothing else, and that is precisely one of the gaps compliance reports.

  2. 2

    Running the platform commands

    Each system has its own command set. What IOS shows with one command is read differently on VRP, and differently again on Junos or AOS-CX.

  3. 3

    Parsing and normalisation

    Raw output is kept as it came, then parsed into fields comparable across vendors. Keeping the original text matters: a question nobody thought of is often answered from it.

  4. 4

    Correlation

    MAC tables, ARP tables, reported neighbours and configurations cross reference each other. Topology, and the answer to any question that spans several devices, comes out of that.

    An answer always comes from the last collection, never from the live device. That is a property of the model, and the collection date travels with the data: the views that list collected records carry their timestamp, column by column.

The mechanism

From the device to the answer

The same path, on every collection, for every device on the estate.

Diagram of the pipeline, from the network device through to the answersNacTrack opens a read only SSH session on the device, runs the command set specific to its platform, parses the output with a dedicated parser, normalises the result into fields comparable across vendors, indexes it with its date, then cross references MAC tables, ARP tables, reported neighbours and configurations into a single graph. Inventory, topology, compliance, vulnerability exposure, addressing, L2VPN transport and reports all come out of that graph.Collection1Network deviceRouters, switches, firewalls,controllers, load balancers.2Read only SSH sessionYour credentials, the same accessan operations engineer has. Nothingis written to the device.3Per platform command setWhat IOS shows with one commandreads differently on VRP or Junos.show versiondisplay deviceInterpretation4Per platform parserA dedicated parser per system, notone regular expression for all.ciscohuaweiarubapanos5Normalised modelThe same fields whatever thevendor. The raw text received iskept exactly as it arrived.6Index and historyEvery collection is dated and kept.Two dates compare, and a questionasked later still finds an answer.Answer7Correlation and graphMAC tables, ARP tables, reportedneighbours and configurations crossinto a single graph.What you getSeven families of answer, all from the same collection.InventoryTopologyComplianceCVE and end of lifeIPAML2VPN and transportReports

Collection

  1. Network deviceRouters, switches, firewalls, controllers, load balancers. This is the only stage that touches your network, and it reads. Everything after it happens on the NacTrack appliance, on your own infrastructure.
  2. Read only SSH sessionYour credentials, the same access an operations engineer has. Nothing is written to the device. Telnet remains possible for devices that offer nothing else, and that is precisely one of the gaps compliance reports.
  3. Per platform command setWhat IOS shows with one command reads differently on VRP or Junos. The full list is published: every command the collector issues, per platform, read out of the collector source rather than typed by hand.

Interpretation

  1. Per platform parserA dedicated parser per system, not one regular expression for all. One parser per system rather than one shared pattern, so a format change at one vendor stays contained to that vendor.
  2. Normalised modelThe same fields whatever the vendor. The raw text received is kept exactly as it arrived. Keeping the original text matters: a question nobody thought of is often answered from it.
  3. Index and historyEvery collection is dated and kept. Two dates compare, and a question asked later still finds an answer. An answer always comes from the last collection, never from the live device, and the collection date travels with the data.

Answer

  1. Correlation and graphMAC tables, ARP tables, reported neighbours and configurations cross into a single graph. Topology, and the answer to any question that spans several devices, comes out of that crossing.
  2. What you getSeven families of answer, all from the same collection. All seven come from the same collection. Nothing collected leaves the building.

Only the first stage touches your network, and it reads. Everything after it happens on the NacTrack appliance, on your own infrastructure: nothing collected leaves the building.

The trade off

What this choice implies

The upside: nothing to deploy on the devices, no impact on the data plane, a first collection of a few minutes per device run in parallel once access exists, and identical behaviour on a heterogeneous and ageing estate.

The pace is not ours to set. A loaded device answers more slowly, and pushing the parallelism is paid for on the device: on some platforms the vty sessions run out or AAA rate limits, and the refusal arrives as an authentication error rather than as a timeout. That is why the number of simultaneous collectors is a per estate setting, taken down to one on sensitive equipment, and why collections are scheduled outside the hours that matter.

The trade off: data is only as fresh as the last collection. NacTrack does not detect a failure the second it happens, and is not meant to. That is your monitoring system's job, and it stays necessary.

  • No agent on the devices
  • No impact on the data plane
  • Read only access is enough
  • Works on old hardware
  • Real time monitoring stays necessary
From the wire to the answer

Seven steps between what a device says and what you read

The same collection, from left to right. It starts as everything your devices say when asked, and ends as the three or four things somebody has to decide on. Nothing is discarded on the way: the raw text is kept exactly as it arrived.

Seven stages of a collection, from unreadable raw text on the left to a legible score on the rightSeven columns read left to right. On the left, your devices and the commands sent to them, then a block of raw text deliberately too small to read. In the middle, the parsers that turn it into comparable fields, then fifty four indices. On the right, a few correlated nodes, then three legible cards: a compliance score, a chart and a table with colour indicators. The drawing gets less dense from left to right, and that is what the figure shows.01ConnectSSH, read onlywhatever the vendor02Askthe platform's own commands7 protocol families03Read backraw text, exactly as sentkept verbatim04Parseone parser per platformvendor neutral fields05Store54 indices54 indices, 22 modules06Correlateacross devices and timeone estate, not a list07Showthe answer, at a glancereport, dashboard, tableshow versionshow cdp neighbors detailshow lldp neighborsshow ip routeshow vlan briefshow spanning-treeshow mac address-tabledisplay arpshow ip ospf neighshow bgp summaryshow interfacesdisplay devicefields83.9% compliant322 open findingsEverything a device says, verbatimOne number a committee can act on
  1. Connectwhatever the vendor
  2. Ask7 protocol families
  3. Read backkept verbatim
  4. Parsevendor neutral fields
  5. Store54 indices, 22 modules
  6. Correlateone estate, not a list
  7. Showreport, dashboard, table

Meaning appears only at the seventh step: it is the only place where anything carries a verdict.

Underneath the figure

And if you want the list, here it is

The figure shows the shape. This is the same thing named: every protocol family read off a device, and every module the licence can open.

02 · Ask, what is read by family

Discovery and adjacencyCDP · LLDP · ARP · MAC tables
SwitchingSTP · RSTP · MSTP · LACP · VLAN · QinQ
RoutingOSPF · OSPFv3 · IS-IS · BGP · EIGRP · VRF · BFD
TransportMPLS · LDP · L2VPN · VPLS · EVPN
Gateway redundancyVRRP · HSRP · GLBP
Access control802.1X · MAB · TACACS · RADIUS · TrustSec
Management planeSSH · Telnet · SNMP · NTP · DHCP

05 · Store, the 22 modules a licence opens

Core platformInventoryMulti tenancyNeighbors and topologyNetwork discoveryRoutingSpanning treeIP managementL2VPN and transportQoSlabAccess lists and prefixeslabOperator customerslabComplianceVulnerabilities and end of lifeNetwork access control (Cisco ISE)labLogging and snapshotsReportingDashboardsNotificationsAI copilot (NacBuddy)labNacTrack AcademylabSupport desk

Watch it on a real estate

The how to guides show every screen, step by step, with screenshots and video.

Open the guidesRequest access