Every tool, explained plainly.

SubnetSlinger is a network engineer's toolkit that runs on your machine.

SubnetSlinger 1.3 has 71 tools on Windows and 79 on Linux (macOS counts its own list — 60+ on every desktop).

Most tools are passive and safe to run anywhere: Ping, Trace, Path ping, DNS, Subnet, SSL, HTTP, WHOIS, IP info, ARP, MAC lookup, Monitor, and SNMP read.

Color and icon mean the same thing everywhere (and never rely on color alone — there's always a label).

The same row of actions sits under every tool's output: copy, save, add to a case, and more.

This page lists what SubnetSlinger needs installed (almost nothing), and how to update or remove it.

The toolkit itself is light — the one thing that drives a bigger machine is running the AI LOCALLY (Ollama).

SubnetSlinger keeps three separate records, all on THIS machine (nothing is sent anywhere): the Activity log, Incidents and the MCP server audit.

A switch that swaps your real data for a realistic sample network, so you can show the app to someone without showing them your actual network.

Choose how the Home screen looks — the Original dashboard stays the default; the other styles show the same tools.

Two separate things people assume are one.

SubnetSlinger keeps your work on THIS machine and nowhere else (see "Your account, your license, and your data").

Shows your machine's network at a glance — hostname, local IPs, gateway, DNS servers, and a live check of your own gateway.

Names the job you're on.

Sends ICMP echo requests and times the replies — the fastest "is it up and how far away?" check.

Shows the step-by-step path your traffic takes to reach a destination — every router ("hop") in between, in order.

Like Traceroute, but it then sends a burst of pings to EACH hop and measures how much gets lost and how slow each one is.

Checks which "doors" (ports) are open on a device — each open port is a service it's offering (web, SSH, mail, …).

Watches several hosts at once, pinging each on a repeating interval and showing it as a live tile (up/down, response time, packet loss).

Runs the same command (one line or several) on many devices at once over SSH and shows the results side by side, so you can compare a whole group in one pass…

How THIS computer is connected, in three tabs — Routes, DHCP lease and Interfaces (it was two tools — Routing table and DHCP lease).

The Local servers tool stands up test servers on THIS machine (Syslog, SNMP-trap, TFTP, HTTP, FTP, DNS, DHCP, RADIUS, TACACS+, plus SFTP/SCP receive through …

Connects over SSH (encrypted), Telnet (plaintext), or a local serial/COM port straight into a device's console — the pre-network way in for factory-fresh gea…

A named sequence of steps you run with one click — a repeatable checklist that actually gathers data instead of just telling you what to go do.

Sends a POSSE of six agents — five specialists and a coordinator — to sweep your whole local network as a team.

A simple live packet analyzer — like a lightweight Wireshark built into the toolkit.

Captures a baseline of who's on your network (a sweep + the ARP cache, recording each host's IP, DNS name, MAC, and vendor), then on a later "Check drift" co…

The Deputy is SubnetSlinger's own AI assistant.

Four security tools in one place — Cisco type-7 decode, hash verify & watch, SSH host-key checks, and SSH key generation.

Pushes a file to a device or pulls one back.

A local, encrypted store for the secrets you don't want sitting in plain text — passwords, keys, notes.

Finds the devices on your local network.

Sweeps the subnet and draws a node map around the local network, with a per-device icon guessed from MAC vendor (OUI) + hostname — switches, routers, APs, pr…

Shows the IP-address ↔ hardware-address (MAC) pairs your computer has recently talked to on the local network, and labels each MAC with the hardware maker (i…

Turns a MAC (hardware) address into the company that made the device.

Lists nearby wireless networks with signal, channel, and security, using the operating system's own scanner (Windows netsh, Linux nmcli) — plus two analyses …

Reads a switch's LLDP-MIB over SNMP and lists its neighbors — for each of the switch's ports, the connected device's system name, port, and chassis ID.

Finds the largest packet that reaches a target WITHOUT being fragmented — the real end-to-end MTU.

Asks an NTP server for the time (SNTP over UDP/123) and reports how far off this machine's clock is, plus the server's stratum.

Lists what THIS machine is listening on and the connections it currently has open — the same data the Deputy's local_sockets tool uses, as a first-class table.

Sends a Wake-on-LAN 'magic packet' (broadcast UDP) to power on a machine by its MAC.

Measures your internet connection's download speed, upload speed, and latency by moving test data to and from Cloudflare's servers.

Builds a device configuration for you from a template — you fill in a short form (hostname, IP, VLANs, and so on) and it writes out the full config text for …

Applies the same change — a set of commands, or a password rotation — across MANY devices at once over SSH, instead of logging into each by hand.

Four lab-shakeout tools in one — throughput, a chaos/latency monitor, a connectivity matrix and a raw socket.

(Linux only) puts a friendly form over command-line network tools you already have installed — nmap, curl, openssl, dig, mtr, tcpdump, and more.

Seven quick, on-the-spot checks for when you walk up to a problem — AP diagnostic, Interfaces, Path analyzer, TLS profiler, Network Experience, Captive porta…

A persistent list of devices, filled automatically by Discovery or added by hand.

One host on one page — its Inventory record, the last result from every tool, and every next action.

A work log of incidents with timestamped notes, severity, and export to Markdown OR a print-friendly page (Print / PDF) — your record of what you did and found.

An automatic audit trail — what ran, when, by whom, and the result.

A shortcut to the folder where SubnetSlinger writes the things you export or capture — packet captures (.pcap), CSV exports, saved topology PNGs, and reports.

Customize how the app looks — colors and accent — so it's comfortable for your eyes and your setup.

SNMP is the standard way to ASK network gear (switches, routers, printers, APs) about themselves — this tool sends those read-only questions and shows the an…

Looks up the records behind a domain name — the "phone book" of the internet.

Does the math of a subnet for you — given a network, it tells you the address range it covers, the first and last usable addresses, the broadcast address, th…

Fetches the live TLS certificate and audits the connection — subject/issuer, validity dates and days remaining, the negotiated TLS protocol and cipher suite,…

HTTP — two tabs. Request — asks a web address for its status code, response headers and timing, without downloading the whole page. Auth check (formerly the …

Looks up WHO is behind a domain, IP address, or network — the registration record.

Tells you where an IP address is and who runs it — rough geographic location, the ISP/organization, and its ASN (the network's ID number).

When code didn't change but a run started failing, work in this order — authentication first, then connectivity.

A device showed up that shouldn't be there (placed on purpose or by accident).

A setting keeps changing back.

Data-center and edge handoffs have their own failure modes.

"The internet is slow" is often a local or wireless problem wearing a bandwidth costume.

MCP lets the Deputy call tools in another program.

The Deputy and the Posse call your chosen AI provider with YOUR key — you pay that provider directly, no SubnetSlinger subscription and no markup.

The Deputy and Posse are provider-agnostic — the SAME features run wherever you point them.

The Deputy and Posse can run on a LOCAL model via Ollama instead of the Anthropic cloud — pick the provider in the Deputy's "AI" dropdown (Anthropic (cloud),…

These are the servers offered in the Deputy under 'MCP servers ▸ Add from catalog'.

Official Juniper MCP server — connects to Junos over NETCONF/PyEZ to fetch config, run show/operational commands, and get device facts.

Wraps Cisco's pyATS/Genie testing framework — runs show commands over SSH, parses them into structured data, and can 'learn' and diff device state.

MCP servers over Catalyst Center (DNA Center) for inventory/health/assurance, and over Catalyst SD-WAN (vManage) for policies, device health, and templates.

The official netboxlabs server queries NetBox — sites, devices, IPs, prefixes, VLANs, cables — READ-ONLY by default (deliberately hard to misuse; a write for…

An open-source agent that orchestrates dozens of MCP servers (pyATS, Junos, F5, Catalyst Center, ISE, NetBox, ServiceNow, GitHub) behind ONE agent with an au…

Community MCP servers wrapping F5 iControl REST (BIG-IP LTM/GTM) and Arista CloudVision (CVP).

Model-driven device APIs.

The gRPC Network Management Interface — Get for on-demand snapshots, Subscribe for streaming telemetry (push updates as values change).

Poll device OIDs — the system group (sysDescr/sysName/sysUpTime) and the ifTable (ifOperStatus, ifInErrors, ifInOctets…).

The CLI data that laptop-side ping/trace can't see.

REST and MCP-backed APIs authenticate with tokens — Bearer, X-API-Key, or OAuth.

SubnetSlinger on Linux is the same app as on Windows — the same tools, the same layout, the same free tier that needs no account and sends no telemetry.

SubnetSlinger ships on Linux as a single self-contained tarball you download from subnetslinger.com.

Everything SubnetSlinger saves — your inventory, incidents, logs, runbooks, saved hosts, and the Vault — stays on your machine.

On Linux, sending a real ICMP echo (a ping) traditionally needs elevated privileges, because it uses a raw socket.

On Linux, SubnetSlinger can read a lot about your own machine straight from the kernel — no extra tools, no root.

SubnetSlinger is one app across platforms, but a handful of things are handled the way each operating system does them best.