Sri Ranga Enterprises

Network Scan

Detected Networks

IP Range / CIDR (auto-filled or type manually)

SNMP Discovery Port Scan OS Detection (needs admin)

Schedule Auto-Scan

Never scanned

Run a scan to
discover devices

No Topology Data

Enter an IP range and click Scan Network to discover your network.

Idle — ready to scan

0 nodes 0 edges

Device Details

Click a device on the
graph to view details

Connections

Select a device to see its connections

Event Log

Total Devices

Online

Offline

Active Alerts

—

Avg Health

Bandwidth Timeline (Kbps)

Device Status

Protocol Distribution

Avg Health Score

Network Health Engine —

Healthy Devices

—

Score 80–100

Warning Devices

—

Score 50–79

Critical Devices

—

Score 0–49

Network Score

—

Overall / 100

Top 5 Unhealthy Devices

Device	IP	Type	Score	Status
Run a scan to analyse health

Device Health Overview

Status	Device	IP	Type	CPU	Memory	Latency	Health
No devices yet — run a scan

No alerts — all systems normal

Bandwidth In / Out (Kbps)

Protocol Distribution

Top Talkers

Rank	Host	IP	Bytes In	Bytes Out	Total	Usage
No traffic data yet

Total

Online

Offline

Critical

Device Inventory

CSV JSON

Status	Hostname	IP	MAC	Type	OS	Ports	Latency	Uptime	Last Seen
No devices — run a scan first

Enterprise Historical Reports Backed by PostgreSQL long-term storage

Start date

End date

Quick range

Download PDF:

Historical Metrics

SLA Status —

Device	IP	Status	Avg Latency	SLA Met
Load report to see SLA data

Devices Found

—

Avg Health

—

Avg Latency

Total Alerts

Device Types

Vendors

OS Distribution

Subnet Calculator

IP Address / CIDR

Open Port Security Summary Flagged ports that may need attention

Device	IP	Port	Service	Risk Level
Run a scan to analyse port security

Device Uptime Report

Status	Device	IP	Type	Uptime	Last Seen	Latency
No data — run a scan

—

Healthy (80–100)

—

Warning (50–79)

—

Critical (0–49)

—

Network Avg Score

Health Score Distribution

Device Type vs Health

All Devices — Health Scores

Health	Score	Device	IP	Vendor	Type	CPU	Memory	Latency	Confidence
Run a scan to see health data

Intelligent Device Profiles

Device	IP	Vendor / Logo	Type	Sub-Type	Confidence	MAC OUI	OS
Run a scan to see device profiles

Total Tracked

New (last 5m)

—

Last Check

Online Now

Newly Detected Devices Auto-cleared after 5 minutes

Device	IP	MAC	Vendor	Type	Detected At	Status
No new devices detected yet — auto-discovery starts after first scan

Discovery History — All Tracked Devices

Status	Device	IP	Vendor	Type	First Seen	Last Seen	Flag
Run a scan to start tracking

How Auto Network Discovery Works

Background ARP Scan — every 60 seconds, the backend runs an ARP sweep of the last scanned subnet to detect new MAC addresses not in the current device database.
New Device Alert — when a new device joins, it appears here marked NEW, a toast appears, and an info alert is generated.
Last Seen Tracking — every known device's lastSeen timestamp is updated every 60s so you know exactly when each device was last active.
Auto-Clear — the NEW badge is automatically cleared after 5 minutes. The device remains tracked in history permanently.

Dual-Backbone VPN Architecture — Sri Ranga Enterprises NMP

🔐

IPsec/IKEv2 Backbone

Site gateways between branch firewalls, HQ, cloud VPCs and datacenter edges. Managed via strongSwan swanctl/VICI running directly on this Ubuntu VM.

TRANSPORT BACKBONE

🌐

WireGuard Overlay

Monitoring agents, probes, edge mini-PCs and cloud probes. Managed via wg / wg-quick on this VM. Simple handshake age, bytes, and peer count.

MONITORING OVERLAY

🏢

NMP Monitoring Core

Sri Ranga NMP runs on this Ubuntu VM. Three collectors feed into a Tunnel Service that merges all state into one unified graph.

MONITORING CORE

⚙️

Control Plane

Tunnel Service + Polling Scheduler. Jobs run locally via swanctl, wg show dump, and Linux net tools (ping, dig, ip).

CONTROL PLANE

Unified Tunnel Graph

Three Collectors — Health

IPsec Collector

Polls strongSwan SAs via VICI or swanctl --list-sas. Cisco/Fortinet/Palo Alto via SNMP MIBs when reachable.

—Tunnels

—UP

—TX Total

—Backend

WireGuard Collector

Reads wg show <iface> dump on this VM. Per-peer: handshake age, bytes TX/RX. Maps to UP<120s / STALE / DOWN.

—Peers

—UP

—STALE

—Latest HS

Experience Collector

Runs ping, dig, MTU probe, jitter, TCP check via Linux net tools on this VM. Tunnel state alone is not enough.

—Tests

—Passing

—Avg Latency

—Packet Loss

All Tunnels — Unified View (IPsec + WireGuard)

Type	Name	Local	Remote	State	TX	RX	HS / DPD	Vendor
Loading tunnels…

IPsec/IKEv2 Site-to-Site

Bring up an IPsec/IKEv2 tunnel using strongSwan on this Ubuntu VM. Writes swanctl config and calls swanctl --initiate.

Connection Name (auto-generated if blank) Remote Gateway IP * Pre-Shared Key (PSK) * Local Subnet (CIDR) Remote Network (CIDR) IKE Version Remote Vendor / Platform

Profile name (optional)

Saved profiles

Save Another Profile Fill the form on the left and click Save to add it here

IPsec / IKEv2 strongSwan Multi-vendor

Active Security Associations

Polls Security Associations via VICI → swanctl --list-sas → ipsec status in priority order.

—UP

—DOWN

—TX Total

SA Name	Local GW	Remote GW	Phase	Cipher	State	DPD	TX	RX	Vendor	Actions
Click Poll Now to fetch live SA data from strongSwan

WireGuard Collector

Reads wg show <iface> dump on this Ubuntu VM for all WireGuard interfaces. Per-peer fields: public key, endpoint, latest handshake epoch → age, bytes TX/RX.

—Total Peers

—UP (<120s)

—STALE (120–300s)

—DOWN (>300s)

WireGuard Interfaces on this VM

WireGuard Peers

No WireGuard peers — add below or click Refresh to poll live

Add WireGuard Peer

Name / Role

Endpoint (IP:Port)

Public Key

Allowed IPs

—

Active Tunnels

—

Connected Clients

—

Total TX

—

Total RX

OpenVPN Client Connect

Connect to an OpenVPN server using certificate or password authentication. Requires openvpn installed and sudo access.

Authentication Type

Connection Name *

Remote Server IP / Hostname *

Port

Protocol

CA Certificate (PEM text)

Client Certificate (PEM)

Client Private Key (PEM)

TLS Auth Key (ta.key) — optional

Advanced options

Cipher Override

Enable LZ4 compression Start on boot (systemd enable)

Extra config lines (appended)

Saved Profiles

Save Another Profile Fill the form on the left and click Save to add it here

OpenVPN / TLS Remote Access Certificate Auth

Active OpenVPN Tunnels

Name	Remote	Proto	State	TX	RX	Clients	Auth	Actions
No OpenVPN tunnels — connect above

Connected VPN Clients 0

Common Name	Real Address	VPN Address	RX	TX	Connected Since	Actions
No clients — server mode tunnels will show clients here

Experience Collector — Synthetic Tests

Measures VPN tunnel quality by running tests FROM this Ubuntu VM TO the remote VPN gateway/peers: ping (latency + packet loss), DNS resolution, MTU discovery, jitter, and TCP reachability. Tests run through the VPN tunnel — results reflect actual tunnel performance, not just internet connectivity. Auto-detects targets from connected IPsec sites and WireGuard peers.

Test Output

— Run tests to see output —

Control Plane Services

Tunnel Service

Ingests IPsec SAs and WireGuard peers, normalises state (UP/STALE/DOWN/UNKNOWN), and builds a unified tunnel graph accessible via /vpn/tunnels.

Running — merged graph at /vpn/tunnels

Polling Scheduler

Distributes collection jobs. Local polls run on this VM directly. Remote site collectors are separate processes; schedule them via cron or systemd timers calling POST /vpn/ipsec/poll.

Active — jobs listed below

IPsec State Ingestor

Priority order: python-vici (direct VICI socket) → swanctl --list-sas → ipsec status. Normalises bytes, DPD, cipher, and phase 1/2 state from any of these sources.

Ready

WireGuard State Ingestor

Parses wg show <iface> dump tab-separated output. All WireGuard interfaces on the VM are polled automatically. Handshake age drives UP/STALE/DOWN state.

Ready

Polling Scheduler — Jobs

Loading jobs…

Connecting to Wazuh…

Agents

—Total

—Active

—Offline

Alert Severity

—Critical

—High

Agent Status

ID	Name	IP	Status	OS	Last Seen	NMP Device
Loading…

Recent Security Alerts

Time	Agent	Rule	Level	Description
Loading…

Vulnerabilities

—Critical

—High

—Medium

—Low

CVE	Severity	Package	Version	Agent
Loading…

Network Performance Command Center

Real-time throughput, latency & quality telemetry across all links

Idle Server Online Collectors Ready

Live Test Telemetry

— Mbps

Throughput

— ms

Jitter

— %

Packet Loss

—

Retransmits

—

SLA Status

Derived

— / 100

Quality Score

Throughput Timeline LIVE

No tests run yet.

Test Path

Client

Switch

Router

Firewall

Target

Event Timeline

No events yet — run a test to populate the log

—

Total Devices

—

Backed Up

—

Changes Detected

—

Failed

—

Next Run In

Scheduled Config Backup

Last run: — · Next: —

Device Backup Status

Status	Hostname	IP	Vendor	Last Backup	Config Size	Changes	Actions
No devices — run a scan first

Select Device

Device

Backup Stats — No device selected

—

Total Backups

—

With Changes

Backup Timeline

Select a device to view backup history

Compare Backups

Device

Backup A (older)

Backup B (newer)

Diff Summary

Select backups and compute diff

Unified Diff

Diff output will appear here

Store Device Credentials

Device

Vendor / Protocol

SSH Username

SSH Port

Password (AES-256 encrypted at rest)

SSH Private Key (optional)

Credential Store

Device	Vendor	Port	Stored
No credentials stored yet

Credentials encrypted with Fernet AES-256. Key stored only in .env. Never logged.

Syslog listener starting…

Queue: — Port UDP: 5514

— Total Events

— Crit/Error

— Warnings

— Sources

— Last 1h

— Last 24h

Time	Severity	Source IP	Host	Facility	Program	Message

IP	Host	Count
Loading…

Link Down

Auth Failure (3/60s)

Config Changed

VPN Tunnel Down

Firewall Deny Spike (20/60s)

Port Scan (3/30s)

Disk Full

Kernel Panic

—

Sites

—

Collectors Online

—

Collectors Offline

—

Total Collectors

Collector Heartbeats — Live Updated every 30s · Green = last heartbeat <70s

No collectors registered yet

All Registered Collectors

Status	Hostname	IP Address	Site	Version	Last Heartbeat	Devices	Capabilities	Actions
Loading collectors…

Recent Collector Events (WebSocket)

— Waiting for collector events —

Create / Edit Site

Site Name *

Location / City

Subnet (CIDR) — for scan automation

Description

All Sites 0

Name	ID	Subnet	Location	Description	Actions
Loading sites…

Site *

Hostname / Name *

IP Address (optional)

Capabilities

Scan SNMP Syslog Traps

What happens next?

Registering creates a collector record and generates a one-time API key. Copy and store it securely — it is shown once only.

1 Registration creates the record in PostgreSQL and returns the API key

2 Download the collector.env file from the API key dialog

3 Deploy collector/agent.py on the remote site VM

4 The agent sends heartbeats every 60s and appears green here when active

Collector Agent — Complete Installation Guide Ubuntu 22.04+ / Debian 12+

Go to the Register Collector tab, select the site, enter a hostname, then click Register. Copy the API key — it will not be shown again.

Install dependencies on the remote VM

sudo apt update
sudo apt install -y python3 python3-pip python3-venv nmap arp-scan git
sudo mkdir -p /opt/srn-collector
sudo useradd -r -s /bin/false srnagent
sudo chown srnagent:srnagent /opt/srn-collector

Deploy the collector agent files

# Copy from central server or clone your repo
scp -r srn_multisite/collector/ srnagent@REMOTE_VM:/opt/srn-collector/
scp -r srn_multisite/shared/    srnagent@REMOTE_VM:/opt/srn-collector/

# Create Python virtual environment
cd /opt/srn-collector
python3 -m venv venv
./venv/bin/pip install requests pysnmp nmap

Configure the collector.env file

cp /opt/srn-collector/collector.env.template /opt/srn-collector/collector.env
nano /opt/srn-collector/collector.env

# Fill in these required values:
SRN_CENTRAL_URL=https://your-srn-server.example.com
SRN_COLLECTOR_KEY=<key from registration step>
SRN_COLLECTOR_ID=<UUID from registration>
SRN_SITE_ID=<site UUID>
SRN_SCAN_RANGE=192.168.10.0/24

Grant sudo for nmap and arp-scan (no password)

sudo bash -c 'cat > /etc/sudoers.d/srn-collector << EOF
srnagent ALL=(ALL) NOPASSWD: /usr/bin/nmap, /usr/sbin/arp-scan, /usr/bin/arp
EOF'
sudo chmod 440 /etc/sudoers.d/srn-collector

Install as a systemd service

sudo cp /opt/srn-collector/srn-collector.service /etc/systemd/system/
sudo systemctl daemon-reload
sudo systemctl enable srn-collector
sudo systemctl start srn-collector

# Verify it's running
sudo systemctl status srn-collector
journalctl -u srn-collector -f

Verify on central server

Within 60 seconds the collector will send its first heartbeat. Switch to the Collectors tab — the status dot turns green and the heartbeat indicator shows OK. Discovered devices appear on the Topology map tagged with the site name.

Firewall / Network Requirements

Collector VM → Central Server:
    TCP 443 (HTTPS) or TCP 5000 (HTTP)   — API uploads

Central Server → Collector VM (not required — push-only):
    No inbound ports needed on collector

Devices → Collector VM:
    UDP 5514  — Syslog
    UDP 1620  — SNMP Traps

Agent ID —

IP Address —

OS —

Wazuh Version —

Last Seen —

Manager —

NMP Device

Not linked to any scanned device

Recent Alerts —

Loading alerts…

File Integrity (Syscheck) —

Loading…

Security Config Assessment (SCA)

Loading…

Sri Ranga Sentinel

No Topology Data

Network Performance Command Center

Live Test Telemetry

Test Path

Event Timeline

iPerf3 — Test History

No Topology Data

Network Performance Command Center

Live Test Telemetry

Test Path

Event Timeline

iPerf3 — Test History

Run iPerf3 Test

Scan Complete