Know your whole network. Without documenting a thing.
You never document your network again. CrossConnect does it for you and keeps it true on its own. Then it runs your operations off that same living picture. Anyone can ask it a question in plain English, and every answer arrives with the records that support it.
Read-only by design. It never changes a device. Nothing leaves your server unless you switch on the optional AI assistant, which is off until you supply a key, tells you what it sends, and which CrossConnect runs entirely without. It installs with one command.
Application triage. Every app on the wire, a verdict on each, and whose fault it is.
The problem
The diagram was wrong before you finished saving it.
Your network lives in a diagram, a spreadsheet, an inventory tool and four people's heads. No two of them agree. Each was accurate once, until somebody moved a cable at 11pm and told nobody, and from that moment the diagram described a network you no longer had.
The cost is not the documentation. The cost is that every question you ask afterwards inherits the drift. Capacity plans, audits, impact analysis and the 2am outage call all run on the same out-of-date diagram, and not one of them warns you which parts of it are wrong.
The Black Box
The audio died on Sunday. On Monday, 241 devices are suspects.
That is the second job at its hardest, and the real shape of it is this: something worked on Friday, it does not work now, and the estate is large enough that a person searching it by hand is really just searching the parts they already suspect. So the Black Box does not search. It reads what changed in the window where the thing broke, and discards everything that cannot be responsible.
Narrowing it down
deny rule on the service egress list, and the three lines around it4The flow that stopped is UDP/4455, the Dante control channel: somebody tightened an access list and took the control plane out from under the room. The Black Box did not infer that. It holds the config from before and the config from after, so it can name the lines that appeared between them.
The three things it does
Document. Operate. Ask.
Feed it those inputs over those first two weeks and it settles into three jobs. You have already watched it begin the first one; here is the shape of all three, and how each leans on the record underneath it.
01
It documents itself
Fifteen collectors read 141 SNMP OIDs, LLDP and CDP, and the cloud APIs of the controllers you already run. From those, it discovers the devices, links, VLANs and paths the network will tell it about, and it keeps that picture current on its own, without you. Whatever stays out of its reach, it names in place, so the record shows you every gap it has. And it holds what you intended apart from what it found: one blended record would hide the gap between them, while two records make that gap the thing you can look at.
02
It operates from that record
Health and readiness. What is misconfigured or unreachable. What breaks if a link fails. Traffic, capacity, and where you are about to run out. It found core-sw-02 at 94% uplink and warned you that eleven cameras in four rooms had no second path, and it did that before the switch failed.
03
It answers in plain English
Anyone can ask, including the people who cannot log into a switch. Every answer cites the exact records behind it, so you can check its work and confirm each claim for yourself.
See it work
There is an all-hands at nine. Is the room going to work?
Nobody asks that question until nine o’clock, when it is already being answered badly. CrossConnect asks it the night before, on a schedule, and writes down what it found.
Start here. What it found on the network, what is running over it, and the room it failed before anyone walked in. About a minute.
CrossConnect
network source of truth
Demo estate
It found the room before the room found you.
It read the estate off the wire and kept reading. Then it checked the room on a schedule, failed it, and showed you the evidence behind every finding. It never touched a device.
Sample data. This demo does not connect to any network, and nothing you click changes anything.
The limits
It reads the switch and never writes to it.
The assistant advises and you decide. It can propose an edit to CrossConnect's own record, and a human confirming it is what makes the edit happen. Nothing is applied to a device on your behalf.
Everything else it declines to be is deliberate. Your automation runs against the record rather than inside it, so your playbooks stay where you already keep them. Your monitoring keeps its job: it tells you a link is down, and CrossConnect starts where that alarm stops, naming the eleven cameras in four rooms that went dark with it. The picture maintains itself, because a picture a human has to maintain is already out of date.
Your first week
On day one it knows less than the demo, and it tells you exactly what it is missing.
Everything you just watched needs something to read. None of it needs an agent on your gear, and none of it needs you to describe your network first. You give it one thing at a time, and each one switches on the next answer.
Watch what it does while it waits. It does not fill the gap with a confident guess. A service it cannot assess comes back unknown, a room it cannot see is not ready rather than fine, and every verdict names the evidence behind it. It is worth having on day one, and it is honest about being worth more on day thirty.
How it is built
Intent and reality, kept apart and then joined.
Most tools store one picture of the network and let it rot. CrossConnect stores what you said it should be and what it discovered, keeps them separate, and joins them. Drift is not something you discover during an audit. It is a row in the table.
- One command to install The app, its database and its configuration-analysis engine come up together. Fresh machine to running product in minutes, and an upgrade that does not turn into a project. If you do not want the analysis engine, install without it and CrossConnect tells you which answers it can no longer give.
- Bring what you already have Import your existing records. When your import disagrees with what was discovered, you get both values and you pick. The whole import rolls back if you do not like it.
- An assistant that cites, and cannot touch a device Every answer carries the records it came from, and an answer that cites nothing is rejected before you ever see it. That is enforced in code after the fact rather than requested in a prompt. The assistant reaches CrossConnect's record and nothing else: it can propose an edit to that record, and a human confirming it is what makes the edit happen.
- A typed API from day one An OpenAPI spec, so the record CrossConnect keeps is available to your own scripts and your own reporting, not locked inside a screen.
- Permissions somebody can read Access control reads like a sentence: the AV team can see every device in Building 3 and change nothing. The person who owns it can audit what they granted without opening a codebase.
Add-on modules
Ten more questions, off the same collection.
Once CrossConnect has collected the estate, other questions become answerable without collecting anything again. Prove a regulated area cannot be reached and print the certificate. Build an audit evidence pack from live records. Settle whether it is the network or the application. Find the devices nobody put in inventory. Work out which rooms get used, from switch signals you already have, with no sensors bought.
There are ten of them. Each is a question rather than another agent, each reads only, and you turn on the one you need while the other nine stay off.
Before you ask
How is this different from CrossScan?
CrossScan walks a site once and hands you the inventory. The distinction that matters here is time: a scan is true on the day you ran it, while CrossConnect starts where that inventory ends and never stops discovering, so the picture is still right in eight months and drift shows up as drift.
If you want a drawing of one building, buy the scanner. If you want to run an estate and stop being wrong about it, this is the one.
Before you ask
The eight questions we get on the first call.
What access do you need?
Read-only credentials to your switches, and a Linux machine inside your walls to run it on. It never changes a device.
Will it change anything?
No. Read-only by design. It holds what you meant to build apart from what it actually found, and changing the network is still your job.
How long until I have something useful?
It installs with one command and starts discovering immediately. The value compounds after that, because the point of it is the record it keeps rather than any single answer.
Does this replace the tools I already run?
It replaces the spreadsheet. It does not replace your monitoring: monitoring tells you something is down, and CrossConnect tells you what it was, where it was, and what else depends on it.
What happens when it is wrong?
Every answer cites the record it came from, so you can check it rather than trust it. Where the documented network and the discovered network disagree, it shows you both instead of picking one.
Can I start with one site?
Yes, read-only, on one site. Nothing about the install assumes an estate.
What data leaves my environment?
Nothing leaves your server. The one exception is the optional AI assistant: it is off until you supply a key, it tells you what it sends, and CrossConnect runs entirely without it.
Will it work in a restricted or air-gapped environment?
Yes. It installs inside your walls with one command, Java ships inside the image, and the database comes with it. Leave the AI assistant off and nothing reaches the internet.
What happens next
Four steps, and you can stop after any of them.
- Install it on a Linux machine inside your walls. One command. Docker with Compose v2, PostgreSQL 16 that the install brings with it, and about 4 GB of RAM.
- Give it read-only credentials for one site. It starts discovering the network from there.
- It keeps two records apart. What you meant to build, and what it actually found. The gap between them is the useful part.
- Ask it in plain English. Every answer cites the record underneath it, so the answer can be checked rather than believed.
The buying unit is one site. One building or one campus, read-only, before anybody scopes an estate. It is the only one of the six that keeps running after you walk away, which is exactly why it should start small.
You will never update a network diagram again.
One command, one seed switch. Come back in an hour and read what your network says about itself.