Network Topology Viewer

See Every Connection. Map Your Entire Network.

Q: Does the Network Topology Viewer require eBPF?

No. The connection map reads kernel socket tables via NETLINK_INET_DIAG and /proc on Linux, and works with or without eBPF. eBPF monitoring is a separate, complementary feature that adds deeper kernel-level network metrics.

Q: What is the difference between the connection map and the SNMP device topology?

The connection map (network-viewer.plugin) shows live TCP/UDP socket relationships between processes, containers, and endpoints. The SNMP device topology (snmp_topology) maps physical and logical relationships between network devices using protocols like LLDP, CDP, BGP, OSPF, and STP. Both share the same topology schema and render in the same dashboard.

Q: How quickly does the topology graph update?

The connection topology graph refreshes approximately every 5 seconds from live socket tables. The underlying socket table is available live, on demand.

Q: Do I need to configure the SNMP device topology separately?

No separate configuration is needed beyond setting up the SNMP collector. The topology engine automatically reads whatever devices the SNMP collector is already monitoring.

Q: Does the topology map work with Kubernetes?

Yes. Connection actors are enriched with container names, Kubernetes pod names, namespaces, and workload labels on Linux. Grouping by container turns the connection map into a live service-dependency view for containerized workloads.

Q: Are all SNMP topology links definitive?

LLDP, CDP, OSPF, and BGP links represent confirmed adjacencies. Some links inferred from FDB and STP data are marked as probable. The map offers selectable confidence levels (lldp_cdp_managed, high_confidence_inferred, all_devices_low_confidence) so you always know what is confirmed versus inferred.

Q: Does ML anomaly detection run on the topology graph itself?

Netdata’s ML anomaly detection runs on all metrics across the platform, including network metrics associated with the devices and connections shown in the topology. The AI Co-Engineer and blast radius detection use this metric data to accelerate troubleshooting alongside the topology view.

Q: Can I see the topology across my entire fleet?

Yes. Both topology engines emit the same shared schema (netdata.topology.v1), which Netdata Cloud or Netdata Parents aggregate into a fleet-wide unified map. This is the intended architecture for distributed visibility.

Topology maps built live inside the Netdata agent from the kernel’s own socket tables - refreshed every few seconds, with no scheduled discovery scans and no central poller. See processes, containers, Kubernetes pods, and network devices connect in real time.

Get Started Free View Live Demo

Real-Time Topology

The connection graph refreshes from live socket tables every few seconds. No scheduled discovery scans, no stale snapshots.

Dependencies & Dependants

Click any actor — a process, container, or host — to trace what it depends on and what depends on it. Application actors map alongside the SNMP device fabric in one graph, every layer.

Zero-Config Discovery

The connection map auto-detects all sockets immediately on install. No seed lists, no polling schedules, no manual setup.

Container-Native

Group by process, PID, or container. Kubernetes pods, namespaces, and workloads appear as actors on the map natively.

Per-Connection Detail

Every socket edge carries live RTT, retransmission counts, and direction. Granular telemetry on every link in the graph.

Endpoint Intelligence

Remote endpoints enriched with ASN, geo-IP, and address-space classification. See public, private, loopback, or multicast at a glance.

Trusted by operations teams worldwide

Two Engines. One Unified Map.

Live Connection Mapping

Every active TCP/UDP socket on your system, mapped in real time. See which processes, containers, and hosts talk to which remote endpoints, with direction awareness and per-connection RTT and retransmission data on every edge.

~5s graph refresh

Explore Network Connections

Trace Dependencies and Dependants

Click any actor on the map - a node, container, or process - and Netdata pivots to that actor’s Dependencies (what it connects out to) and Dependants (what connects in to it). Follow a failure up or down the call path in seconds instead of guessing which service broke which.

Per node, container, process

Explore Network Connections

Container-Native Service Maps

Switch grouping to container and watch the network graph become a live service-dependency map. Kubernetes pod names, namespaces, workloads, and Docker container names appear directly on actor nodes.

Zero-config k8s awareness

See Kubernetes Monitoring

Physical Network Fabric

Map switches and routers from LLDP, CDP, FDB, STP, ARP, OSPF, and BGP. Devices are discovered automatically from your running SNMP collector jobs. Tune the map to match how much you trust it: choose the confidence level (managed LLDP/CDP, high-confidence inferred, or all devices), pick the inference strategy for unmanaged links, and identify device nodes by management IP or MAC.

LLDP, CDP, BGP, OSPF, STP, FDB

Explore SNMP Monitoring

Endpoint Intelligence Built In

Every remote endpoint is enriched with ASN, country, city, and geographic coordinates from Netdata’s built-in IP intelligence databases. Address-space classification shows whether each endpoint is loopback, private, public, or multicast.

ASN, geo-IP, address-space

Explore NetFlow Analysis

Topology, reimagined

Why Teams Choose Netdata for Network Topology

Netdata builds topology maps inside the agent that already monitors your infrastructure. No separate product, no central poller, no scheduled scans.

Topology Refresh

✅ Real-Time
Live socket tables, ~5s graph refresh

⚠️ Scheduled Scans
Periodic discovery, often hourly or daily

Setup

✅ Zero-Config
Auto-detects all connections on install

⚠️ Manual Configuration
Seed lists, SNMP credentials, pollers

Scope

✅ Full-Stack
Process, container, k8s, and SNMP devices

⚠️ Layer-Specific
Typically network-only or app-only

Architecture

✅ Edge-Native
Graphs built in-agent, no central poller

⚠️ Centralized
Dedicated NPM server infrastructure

Per-Connection Detail

✅ Per-Socket Telemetry
RTT and retransmissions on every edge

⚠️ Aggregated Flows
Often limited to flow summaries

Cost Model

✅ Included
Part of the platform, per-node pricing

❌ Separate License
Expensive NPM module add-on

Compare Netdata to Alternatives

Explore the Topology Viewer

Per-Process Topology

Group connections by process name or PID. Every socket edge carries live RTT, retransmission counts, and direction classification.

See exactly which process owns each connection

Try the Live Demo

Key Takeaways

What makes Netdata’s topology viewer fundamentally different.

Unified Topology

Application dependencies and physical device fabric in one graph, sharing the same schema and dashboard.

Genuinely Live

Socket tables refresh the graph every few seconds. No nightly discovery scans or stale snapshots.

Instant Discovery

Connection map auto-detects all sockets immediately. Zero configuration, no seed lists.

Per-Connection Telemetry

RTT and retransmissions carried on every socket edge in the graph, backed by a live socket table.

Endpoint Intelligence

ASN, geo-IP coordinates, and address-space classification enrich every remote endpoint automatically.

Exposure Visibility

Public, private, loopback, or multicast classification shows your attack surface at a glance.

Frequently Asked Questions

Does the Network Topology Viewer require eBPF?

What is the difference between the connection map and the SNMP device topology?

How quickly does the topology graph update?

Do I need to configure the SNMP device topology separately?

Does the topology map work with Kubernetes?

Are all SNMP topology links definitive?

How much control do I have over what the topology map shows?

The SNMP topology view is fully tunable. Identify device nodes by management IP or by MAC / chassis ID; switch the map between managed LLDP/CDP, high-confidence inferred, and all-devices views; choose how unmanaged links are inferred (FDB minimum-knowledge, FDB pairwise, STP parent-tree, STP+FDB correlated, or CDP+FDB hybrid); focus on a specific device; and limit hop depth to isolate exactly the part of the network you need.

Does ML anomaly detection run on the topology graph itself?

Can I see the topology across my entire fleet?

June 23, 2026

5 Best SolarWinds Alternatives for 2026

Discover the top SolarWinds alternatives for 2026. Compare modern monitoring platforms built for cloud-native infrastructure - now with NPM-class network monitoring - with transparent pricing and real-time insights.

June 23, 2026

SolarWinds Price Increases 2026: What Customers Need to Know

Understanding SolarWinds' subscription-only pricing changes following the Turn/River Capital acquisition, and exploring your options for infrastructure monitoring.

February 27, 2026

Introducing the Netdata Cloud MCP Server

Connect AI coding agents like Claude Code, Codex, and Cursor to your entire infrastructure with a single endpoint. The Netdata Cloud MCP Server brings infrastructure-wide observability to any MCP-compatible AI tool.

See Every Connection. Map Your Entire Network.

A Complete Picture of Your Network

Real-Time Topology

Dependencies & Dependants

Zero-Config Discovery

Container-Native

Per-Connection Detail

Endpoint Intelligence

Two Engines. One Unified Map.

Live Connection Mapping

Trace Dependencies and Dependants

Container-Native Service Maps

Physical Network Fabric

Endpoint Intelligence Built In

Why Teams Choose Netdata for Network Topology

Explore the Topology Viewer

Per-Process Topology

Service Dependency Map

Physical Device Topology

Logical Routing Overlay

Live Socket Evidence

Key Takeaways

Unified Topology

Genuinely Live

Instant Discovery

Per-Connection Telemetry

Endpoint Intelligence

Exposure Visibility

Frequently Asked Questions

5 Best SolarWinds Alternatives for 2026

SolarWinds Price Increases 2026: What Customers Need to Know

Introducing the Netdata Cloud MCP Server

Book Your Free Demo