NetMap answers the four questions every homelab owner asks in four different tools: what is on my network, what address did it get, is it still up, and why is the firewall shouting about it. Devices you add appear automatically on a visual canvas where you can drag them into place, draw the links between them, and group them into VLANs or separate sites, and the layout is still there when you come back. Behind the map, every device is watched continuously: ping times graphed over history, service checks on the ports you care about, a heartbeat strip that betrays intermittent dropouts, and an uptime percentage that settles arguments. Address management stops being a spreadsheet: define subnets, import the leases your router already handed out, see used and free addresses as a grid, and get warned before a duplicate assignment causes a mysterious outage. Firewall logs stream in live and each entry links to the device it concerns, ready to search by address, port, or protocol. When something new appears, a network scan discovers hosts with their names, hardware addresses, and open ports for review before they join the inventory. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. GPL-3.0 licensed.

Mapping every physical server, virtual machine, container, and network link across a sprawling homelab into a live interactive canvas, Circuit Breaker gives infrastructure operators real-time topology visualization, IP address management, and rack elevation modeling on a single screen. Operators can switch between hierarchical, concentric, cortex ring, radial, and force-directed graph layouts where animated edges reflect link speeds and color-coded status rings display live hardware health. Automated discovery scans local subnets using nmap, SNMP, and ARP while querying Proxmox VE clusters, TrueNAS storage pools, and UniFi controllers, staging newly detected nodes in a review queue before adding them to the map. For multi-site labs or isolated VLANs, lightweight remote agents connect outbound over Noise-encrypted links after fingerprint approval to report host telemetry and run scoped network scans without opening inbound firewall ports. Rack diagrams let administrators drag servers into U slots with cabling overlays using a built-in catalog covering Dell, HPE, Supermicro, Ubiquiti, MikroTik, Synology, and APC gear alongside live iDRAC, iLO, and UPS metrics. Role-based access control, OIDC single sign-on, TOTP multi-factor authentication, encrypted full-state snapshots, and a SHA-256 hash-chained audit log keep multi-user operations accountable. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

From the first rack to the last circuit, Nautobot is the open-source network source of truth that records what your network should look like and runs automation against it. Built-in models cover locations, racks, devices, interfaces, cables, VLANs, VRFs, IP prefixes, circuits, and contacts, so one searchable record replaces the spreadsheet and the wiki. Teams encode their own standards with custom fields, user-defined relationships, computed fields, and validation rules. Config contexts attach JSON or YAML data, such as syslog servers, to devices by location, role, platform, or tag. Jobs run your own automation code from the web UI, REST API, or command line, on a schedule, or through hooks when an object changes, with approvals and logs built in. Query the data over REST or GraphQL, and let the GraphiQL editor autocomplete a device and interface query you can save inside Nautobot. When an object is created, updated, or deleted, webhooks notify outside systems, with Jinja2-templated bodies and HMAC SHA-512 signatures. Git repositories can carry export templates, Jobs, and config contexts too, so YAML data and Jinja2 templates get pull request review before Nautobot syncs them. Open-source Apps add Golden Configuration for config backup, compliance, and remediation, Device Lifecycle for hardware tracking, SSoT for syncing other systems, and ChatOps. Object permissions and change logging keep a shared instance auditable. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

Netra watches your network from the side, plugged into a switch mirror port, and turns everything it sees into a live picture of your traffic without ever sitting in the forwarding path. A single binary loads its eBPF collectors in the kernel, so aggregation happens before packets reach user space and multi-gigabit mirror feeds stay observable instead of dropping samples. The dashboard opens on totals, protocol share, and traffic trends, then lets you drill into flows by address, port, domain, or service, check which countries your traffic talks to on a world map, and read the internal topology as a live graph. Domains surface passively from TLS handshakes, public addresses are enriched with country and organization data, and heuristic detectors flag scanning, flooding, and single-host surges, pushing alerts to your team chat with an optional AI-written explanation. You can ask the built-in assistant questions about real recorded history, connect external MCP servers so it can call your own tools while it answers, and stream flows onward to Kafka for other consumers. History rolls into compressed columnar files on a schedule and stays queryable for a month by default. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. GPL-3.0 licensed.

Network traffic stops being a mystery once ntopng names the hosts, applications, and protocols behind every flow, live in your browser. To find the host saturating an uplink, open the dashboard, which ranks top talkers, countries, autonomous systems, and protocols beside historical charts. To see what a suspicious host is contacting, open its page for traffic, ports, DNS queries, TLS details, and visited sites, plus a map of its conversations. Deep packet inspection recognizes applications such as Facebook, YouTube, and BitTorrent, so charts name the app behind the bytes instead of relying on port numbers alone. The console reads packets from a SPAN port or TAP and NetFlow, sFlow, or IPFIX records from routers and switches through nProbe, so it can cover a single switch or many remote sites. Behavioural checks raise alerts for flows, hosts, and interfaces and send them to email, Discord, Telegram, or webhooks. Active monitoring probes remote hosts over ICMP and HTTP/S, and network discovery lists the devices on your local network. A REST API and Lua scripting pull statistics into your own tools and add custom checks. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. GPL-3.0 licensed.

Point your routers at Akvorado and every NetFlow, IPFIX, and sFlow record crossing your network becomes a chart you can interrogate. The web console opens on a live summary of flows per second, exporter count, and traffic split by autonomous system, port, protocol, country, and address family. From there, the visualize page turns stored flows into stacked, line, grid, and heatmap time series, plus Sankey diagrams that show how traffic moves between networks, interfaces, and countries. Filters use a simple SQL-like syntax, so a question like which customers pulled traffic over a transit link last night becomes a query, not a support ticket to your future self. Because the outlet polls each exporter with SNMP or gNMI, flows arrive wearing real interface names, descriptions, and speeds instead of raw ifIndex numbers nobody can read. GeoIP lookups attach country and city to addresses, classification rules tag providers, peers, and connectivity types, and optional BMP sessions add AS paths and BGP communities to every flow. Retention is tiered: raw flows keep full detail for recent days while one-minute, five-minute, and hourly rollups stretch summaries across a year of history. A Grafana plugin is available too, so the same flow data can sit on the dashboards your team already watches. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

HomeLabInfo gives your homelab one dashboard where the network itself and everything running on it finally appear together, instead of scattered across router pages and terminal sessions. It watches for new devices the instant they ask the network for an address, identifies who made them, and can fire a webhook so you hear about a stranger joining your LAN before you notice it yourself. Scans keep track of which devices are online and which have gone quiet, and the interactive topology view lets you arrange the map of switches, access points, NAS boxes, and servers the way your rack actually looks. Lightweight agents installed on each machine report their containers back to the hub, so running and stopped containers, uptime, health, and host CPU, memory, and disk all show in one place without opening a separate tool per server. When an agent falls behind, its card tells you a newer version exists instead of leaving you guessing. You can add a username and password login before putting the dashboard anywhere beyond your desk, and arrange container layouts that stay put between visits. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. GPL-3.0 licensed.

VyManager puts every VyOS router you run, across every site, into one web control plane with live dashboards and per-site permissions. Organize instances into logical sites, from the datacenter core to the smallest branch office, and add or remove routers without touching a command line. Live dashboards stream interface counters, system information, network graphs, and WireGuard peer status, so a saturated link announces itself before your users do. Configuration adapts to each router's VyOS version, with 1.4, 1.5, and rolling releases supported side by side during the longest upgrade cycle. Access is granted per site with OWNER, ADMIN, and VIEWER roles, API keys authenticate the machines, and SSH credentials stay encrypted at rest. A setup wizard walks a fresh deployment to its first managed router, and light, dark, and custom themes keep the night shift comfortable. For automation, AI assistants can be connected through the companion MCP integration, and the whole stack arrives as Docker Compose services you can redeploy in minutes. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. GPL-3.0 licensed.

Every server, switch port, virtual machine, and network VLAN in a homelab or small IT environment can be cataloged, visualized, and exported through RackPeek's unified web interface and command-line toolkit. Operators record rack-mounted servers, managed switches, routers, firewalls, wireless access points, and uninterruptible power supplies alongside their CPU, memory, and storage specifications in a clean browser dashboard. Beyond physical gear, the inventory tracks operating systems, containerized or bare-metal services, IP subnets, and port-to-port cable connections while organizing assets with searchable tags and key-value labels. From that structured inventory, the interactive visualization engine renders live physical wiring diagrams and logical subnet-grouped service maps that export directly as high-resolution PNG graphics or Mermaid flowcharts. Because all state lives in a single human-readable configuration file backed by built-in Git repository synchronization, teams can version-control infrastructure changes or push automated updates through the authenticated REST API with dry-run diff previews. Day-to-day administration becomes faster with built-in generators that turn your cataloged hosts into ready-to-use Ansible inventory files, SSH client configurations, and tag-filtered hosts tables. Line-and-column validation feedback in the web editor catches schema mistakes immediately before changes are committed. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Every cable, switch port, VLAN, and rack unit in a homelab or small server room gets a documented place in Rackpad, a self-hosted inventory and operations workspace. Rack elevations show mounted gear, including paired half-width appliances. Switch-panel port maps and aggregate ports show what is patched where. Cables carry type, length, and color, editable in bulk. VLANs, subnets, DHCP scopes, reservations, and zones sit in one Networks workspace, with gateway and DNS protection and a mismatch review for IP assignments. Storage topology follows drives, bays, and pools that span several devices. Wi-Fi controllers, access points, hypervisor hosts, and virtual machines have pages of their own, and Proxmox and Hyper-V hosts can be imported after review. Discovery scans a subnet or any CIDR and stages every finding in an inbox. Per-device checks over ICMP, TCP, HTTP, HTTPS, and SNMP raise alerts by email, Discord, or Telegram. Everything feeds a movable topology map. Markdown runbooks attach to devices, and an audit log records every change. Admin, editor, and viewer roles control access, and OpenID Connect login is optional. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

MikroTik Manager is a web control plane for whole RouterOS fleets, built so that a bad VLAN change reverts itself instead of costing you a drive to the site. Before any risky edit, Change Guard saves a restore point on the device and arms a scheduler; if a fresh connection cannot reach the router afterwards, it rolls itself back. Lockout prediction simulates each change against live device state and refuses one that would cut management access, naming the exact port and VLAN at fault. Config Health audits for settings RouterOS accepts but silently ignores. Day to day, a live dashboard tracks availability, wireless clients, and alerts delivered by email, Slack, Discord, Telegram, or ntfy. Switch faceplates, per-port client views, VLAN copy wizards, bulk SSID deployment, RF health charts, rogue AP detection, and a guest Wi-Fi captive portal wizard cover the wired and wireless side. A rule builder handles firewall and NAT, topology maps come from LLDP, CDP, and MNDP, and a built-in NetFlow collector attributes traffic to clients and applications. Firmware rolls out in canary waves that halt on failure, and every configuration snapshot supports diffs and one-click rollback. OIDC single sign-on, TOTP two-factor, role-based access, and scoped API tokens protect the console, while sites group devices per customer network. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Monitoring everything from network switches to Kubernetes clusters since 2001 with over 6,200 GitHub stars and deployments exceeding 100,000 devices per installation, Zabbix has established itself as one of the most mature and feature-rich open-source monitoring platforms available, trusted by organizations including Dell, Salesforce, ICANN, and T-Mobile. The platform collects metrics from virtually any source using Zabbix Agent written in C, Zabbix Agent 2 written in Go with native plugin support, SNMP v1/v2c/v3 polling and trapping, IPMI for hardware health, JMX for Java applications, SSH and Telnet checks, HTTP/HTTPS polling, and ODBC database queries. Version 7.0 LTS introduced synthetic browser monitoring that executes user-defined JavaScript via WebDriver to simulate multi-step user interactions on websites, proxy load balancing with automatic host redistribution across proxy groups for high availability, in-memory proxy data buffering delivering up to 100x performance improvement, native multi-factor authentication with TOTP and Duo support, and just-in-time user provisioning from SAML and LDAP. Low-level discovery automatically detects file systems, network interfaces, SNMP OIDs, VMware resources, and Kubernetes pods, creating monitoring items and triggers dynamically. The alerting engine correlates events with configurable escalation chains, sending notifications through Slack, Microsoft Teams, PagerDuty, Jira, email, and SMS with customizable message templates. Over 1,000 official templates provide instant monitoring for Linux, Windows, VMware, AWS, Azure, Docker, PostgreSQL, MySQL, Apache, Nginx, and hundreds more. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.