Documentation
Every tool, explained plainly.
The same guides that ship inside the app. Each tool explains what it does, whether it can cause harm, and how to read its results — plus real-world playbooks engineers actually run. New to networking? Start with the walkthrough below.
Getting started
Read the full walkthrough →Start here
SubnetSlinger is a network engineer's toolkit that runs on your machine.
Most tools are passive and safe to run anywhere: Ping, Trace, Path ping, DNS, Subnet, SSL, HTTP, WHOIS, IP info, ARP, MAC lookup, Monitor, Discovery, and SNM…
Color and icon mean the same thing everywhere (and never rely on color alone — there's always a label):
SubnetSlinger keeps three separate records, all on THIS machine (nothing is sent anywhere):
What it is: a switch that swaps your real data for a realistic sample network, so you can show the app to someone without showing them your actual network.
Two separate things that people reasonably assume are one:
SubnetSlinger keeps your work on THIS machine and nowhere else (see "Your account, your license, and your data").
Tools
shows your machine's network at a glance — hostname, local IPs, gateway, DNS servers, public IP/ISP, and a live uplink check.
groups related work — hosts, sites, and notes — under one project, so a site visit or a customer engagement stays together instead of scattered across tools.
sends ICMP echo requests and times the replies — the fastest "is it up and how far away?" check.
maps the route to a destination hop by hop using increasing TTL.
traces the path, then sends a burst of pings to each hop to measure per-hop packet loss and average latency.
the same per-hop data Path ping already collects (address, loss %, average latency), drawn as a left-to-right hop chain from you to the destination instead o…
tries a TCP connection to each port and lists which are open, with the common service name.
continuously pings a set of hosts on an interval and shows each as a live tile (up/down, RTT, loss).
connects over SSH (encrypted), Telnet (plaintext), or a local serial/COM port straight into a device's console — the pre-network way in for factory-fresh gea…
a named sequence of steps you run with one click — a repeatable checklist that actually gathers data instead of just telling you what to go do.
sends a POSSE of specialist agents to sweep your whole local network as a team.
a simple live packet analyzer — like a lightweight Wireshark built into the toolkit.
captures a baseline of who's on your network (a sweep + the ARP cache, recording each host's IP, DNS name, MAC, and vendor), then on a later "Check drift" co…
The Deputy is SubnetSlinger's own AI assistant, powered by the Anthropic Claude API with your own key — it is NOT Microsoft Copilot or GitHub Copilot, and ha…
three security checks in one place.
pushes a file to a device or pulls one back.
stores saved connections (name, host, port, user, protocol).
a local, encrypted store for the secrets you don't want sitting in plain text — passwords, keys, notes.
ICMP-sweeps a /24, lists live hosts with reverse-DNS names, and auto-adds them to Inventory.
sweeps the subnet and draws a node map around the local network, with a per-device icon guessed from MAC vendor (OUI) + hostname — switches, routers, APs, pr…
reads your machine's local ARP cache (IP↔MAC pairs) and tags each MAC with its OUI vendor.
turns a MAC address into its vendor (from the OUI), with format variants and flags.
a persistent list of devices, filled automatically by Discovery or added by hand.
a work log of incidents with timestamped notes, severity, and Markdown export — your record of what you did and found.
an automatic audit trail — what ran, when, by whom, and the result.
a shortcut to the folder where SubnetSlinger writes the things you export or capture — packet captures (.pcap), CSV exports, saved topology PNGs, and reports.
customize how the app looks — colors and accent — so it's comfortable for your eyes and your setup.
three poll types.
looks up DNS records (A, AAAA, MX, TXT, …) over DNS-over-HTTPS, so it works from any network.
offline CIDR/VLSM math — network, broadcast, usable host range, mask, and class.
fetches the live TLS certificate and audits the connection — subject/issuer, validity dates and days remaining, the negotiated TLS protocol and cipher suite,…
sends a GET and shows the response status, headers, and timing.
registration data for a domain, IP, or ASN via RDAP.
geolocation, ASN, and ISP for an IP (blank = your own).
a built-in client for talking to network gear and controllers through their APIs — REST/RESTCONF, NETCONF, and gNMI — instead of scraping the CLI.
Use cases
When code didn't change but a run started failing, work in this order — authentication first, then connectivity:
Goal: a device showed up that shouldn't be there (placed on purpose or by accident).
Symptom: a setting keeps changing back.
Data-center and edge handoffs have their own failure modes:
"The internet is slow" is often a local or wireless problem wearing a bandwidth costume.
API & MCP reference
New to MCP?
The Deputy and the Posse call the Anthropic Claude API with YOUR key — you pay Anthropic directly for what you use.
The Deputy and Posse can run on a LOCAL model via Ollama instead of the Anthropic cloud — pick the provider in the Deputy's "AI" dropdown (Anthropic (cloud) …
official Juniper MCP server — connects to Junos over NETCONF/PyEZ to fetch config, run show/operational commands, and get device facts.
wraps Cisco's pyATS/Genie testing framework — runs show commands over SSH, parses them into structured data, and can 'learn' and diff device state.
MCP servers over Catalyst Center (DNA Center) for inventory/health/assurance, and over Catalyst SD-WAN (vManage) for policies, device health, and templates.
the official netboxlabs server queries NetBox — sites, devices, IPs, prefixes, VLANs, cables — READ-ONLY by default (deliberately hard to misuse; a write for…
an open-source agent that orchestrates dozens of MCP servers (pyATS, Junos, F5, Catalyst Center, ISE, NetBox, ServiceNow, GitHub) behind ONE agent with an au…
community MCP servers wrapping F5 iControl REST (BIG-IP LTM/GTM) and Arista CloudVision (CVP).
model-driven device APIs.
gRPC Network Management Interface — Get for on-demand snapshots, Subscribe for streaming telemetry (push updates as values change).
poll device OIDs.
the CLI data that laptop-side ping/trace can't see.
REST and MCP-backed APIs authenticate with tokens — Bearer, X-API-Key, or OAuth.