For IT & network engineering

Know what's actually on the wire.

Your CMDB is a hypothesis. The diagram is a year stale, the spreadsheet disagrees with it before lunch, and a change nobody logged is in production right now. CrossConnect reads the gear read-only and keeps a live source of truth in Postgres, current with what is actually on the wire. Engineer to engineer: here is exactly how it collects, tracks what changes, and proves what it shows you.

Read-only collection, no writes SNMP, LLDP/CDP, ARP/FDB, SSH Self-drawing topology Golden-config drift Formal reachability Self-hosted Postgres
The whole idea

It reads your network, keeps a map you can trust, and answers from it.

flowchart LR
  NET["Your network
switches, routers, firewalls"] -->|reads it, changes nothing| CC["CrossConnect"] CC --> MAP["A live map you can trust
kept current on its own"] MAP --> ASK["You ask, in plain English"] ASK --> ANS["A clear answer
with the record to prove it"] classDef app fill:#173a6b,stroke:#0f2a4f,color:#ffffff; classDef good fill:#1797b3,stroke:#0d7d90,color:#ffffff; classDef ext fill:#ffffff,stroke:#9aa8c0,color:#173a6b; class CC app; class MAP good; class NET,ASK,ANS ext;
Read-only in, a trustworthy answer out. The detail behind each step is below.
The gap you live with

The diagram was wrong before you saved it.

The Visio is two years stale, the spreadsheet was wrong before lunch, and an out-of-band change is sitting in production right now with no ticket behind it. When something breaks you burn an afternoon guessing, and when an auditor asks what is connected to what, you sweat. CrossConnect keeps a live model of the real network by reading the gear itself, on the schedule you set, so the answer is already there, current, with the record behind it.

How it collects

Read-only, fast-timeout, and named down to the protocol.

No agents on your devices and no config changes. CrossConnect reads the gear the same way you would from a jump box, on the protocols the gear already speaks, with short timeouts so a slow or dead host never stalls a run. Point it at a seed range or a list, give it read-only credentials, and it walks the network from neighbor to neighbor.

  • SNMP v2c and v3: system, interfaces, ARP, LLDP-MIB and entity tables, plus the bridge FDB where the device exposes it
  • LLDP, CDP, and FDP adjacencies to build the L2 topology from the switches themselves
  • SSH / CLI for running config, software version, and the facts SNMP will not give up, including the FDB where it is not cleanly exposed over SNMP
  • ARP and MAC address tables to place endpoints on the exact switch and port they land on
  • Credentials held in an encrypted vault, scoped read-only, never echoed back to the UI

Want the full per-protocol breakdown of every OID and field? It is in the Data Collection Reference.

SourceWhat it yieldsMode
SNMP v3interfaces, FDB, ARP, LLDP, entityread-only
LLDP / CDPL2 neighbor adjacenciesread-only
SSH / CLIrunning-config, OS versionread-only
ARP / FDBendpoint → switch + portread-only
ImportIPAM, CSV, prior CMDBpreviewed
The live map

Discovery draws the map, and keeps it drawing itself.

From what the switches report, CrossConnect assembles the full Layer 2 and Layer 3 topology and refreshes it on every run. No Visio to maintain, no diagram going stale the week you saved it. Follow any connection from a port through the cabling, and find any device by address in a single lookup.

Self-drawing topology

L2 adjacencies from LLDP, CDP, and FDP, L3 from the routing it reads, redrawn on every run. The map is never the stale one from last quarter.

L2 + L3, current

Follow any path

Trace a connection the whole way: from a switch port, through the cabling, out to the carrier handoff. The path is read from the gear, not redrawn by hand.

port to carrier

Find any device

Type a MAC or an IP and land on the exact switch and port it plugs into, learned from the switches themselves, with what it is and whether it quietly moved ports.

MAC / IP → port
Golden config & drift

Set the standard once, and catch every deviation from it.

Define a golden config for a role, an NTP block, an SNMP ACL, an AAA stanza, and CrossConnect diffs every device against it on each run. Drift surfaces the moment it appears: a missing time-sync line, a relabeled interface, a new local account, a config that changed since yesterday with no ticket behind it. You get the line, the device, and the minute it landed.

  • Per-role golden templates, diffed line by line against running-config
  • Drift scored and ranked, so the dangerous deltas float to the top
  • Compliance scoring against CIS and NIST control families, evidence attached, refreshed as the benchmarks update
  • Software inventory matched against known-CVE and end-of-life feeds, refreshed on a schedule
cor-hq-02 · drift since last run
ntp
server stanza missing vs golden
DRIFT
interface Gi1/0/12
description changed · 11:40pm
CHANGED
software
known critical CVE · end-of-life train
CVE
Change forensics · the network black box

"It worked yesterday." Now you can prove what changed.

CrossConnect snapshots config and reachability over time. When a path breaks, instead of guessing from symptoms it computes reachability formally across the relevant config snapshots, isolates the exact stanza whose change altered the forwarding outcome, and shows you the before and after as the proof. This is config-delta analysis on a forwarding model, not a ping in a loop.

NETWORK BLACK BOX10.20.10.0/24 → 10.10.20.5 : tcp/4440
🔎
Reachable on 7 Jun, blocked on 8 Jun. The forwarding outcome changed at cor-bb-01: an ACL line added to AV-EGRESS now drops the flow.
isolated across 2 snapshots
cor-bb-01 · 7 Jun · permits flow
ip access-list extended AV-EGRESS permit ip any any ! interface Gi0/1 ip access-group AV-EGRESS out
cor-bb-01 · 8 Jun · drops flow
ip access-list extended AV-EGRESS deny udp any 10.10.20.0 0.0.0.255 eq 4440 permit ip any any ! interface Gi0/1 ip access-group AV-EGRESS out
↑ this line flips reachability from permit to deny

Formal reachability covers the vendors with full config models; everything else falls back to config-level and cloud analysis. The exact maturity per vendor is in the Vendor Support Reference.

The assistant, grounded

Ask in English. Get an answer tied to the record, or an honest "I don't know."

The conversational layer queries the same live source of truth you do. Every answer cites the records behind it. If the data cannot support a claim, it says so instead of inventing a device, an address, or an adjacency. It honors the asker's role, logs every prompt and retrieved record, and it advises only: it will point at the offending stanza and hand you the command, but it never touches a device.

  • Cites the exact records, or returns "I don't know"
  • Never fabricates a device, IP, circuit, or relationship
  • Honors RBAC: it cannot surface data the asker is not cleared for
  • Advice only, no execution, not even confirm-before-commit
assistant
Why can't the Studio A controller reach the DSP since last night?
An ACL line added to AV-EGRESS on cor-bb-01 at 11:40pm now drops udp/4440 to 10.10.20.5. Here is the diff and the platform command to remove it. I will not apply it. grounded on: config snapshot cor-bb-01 · reachability run #2 · logged
Deploy footprint

It runs on your servers, and you can read every listener it opens.

One Java service and a PostgreSQL system of record, on-prem or in your own cloud account. Scale out to multiple replicas behind a load balancer when you need availability. Nothing leaves your network except the egress paths you switch on yourself.

Self-hosted, Postgres-backed

Spring Boot service plus PostgreSQL as the system of record. Docker for a single-node install, multi-replica for HA. Your data stays in your account.

on-prem · your cloud

Every listener documented

Each network listener, its bind, and its default is documented, alongside the full runtime service surface. No mystery ports. Read the Services & Listeners Reference.

no mystery ports

Sized for your rollout

Capacity and throughput numbers for a planned deployment, with the measured methodology behind them. See Performance & Capacity Planning.

measured, not modeled

Webhooks & automation out

Push the facts it finds, drift, and alerts to your ticketing and ops tooling, each payload HMAC-signed so the receiver can verify it.

signed payloads
Read the engineering, not the brochure

The references that answer the next question.

Every claim on this page has a document behind it, written in protocol and port. Lift the answers straight into your evaluation.

Stop guessing what is on your network. Start knowing.

Bring the network that keeps you guessing. We will run CrossConnect against one like it, read-only, and show you the live map, the drift, and the change nobody logged. Walk out with a source of truth that matches the wire, so the next time someone asks what is really connected to what, the answer is already on your screen with the record behind it. It is in operator preview: young, but everything here is built and running against a real network today.