Documentation

Every tool, explained plainly.

The same guides that ship inside the app. Each tool explains what it does, whether it can cause harm, and how to read its results — plus real-world playbooks engineers actually run. New to networking? Start with the walkthrough below.

Start here

Tools

Home (dashboard)

shows your machine's network at a glance — hostname, local IPs, gateway, DNS servers, and a live check of your own gateway.

Project

groups related work — hosts, sites, and notes — under one project, so a site visit or a customer engagement stays together instead of scattered across tools.

Ping

sends ICMP echo requests and times the replies — the fastest "is it up and how far away?" check.

Trace (traceroute)

shows the step-by-step path your traffic takes to reach a destination — every router ("hop") in between, in order.

Path ping

like Traceroute, but it then sends a burst of pings to EACH hop and measures how much gets lost and how slow each one is.

Path map

the same per-hop data Path ping already collects (address, loss %, average latency), drawn as a left-to-right hop chain from you to the destination instead o…

Ports (port scanner)

checks which "doors" (ports) are open on a device — each open port is a service it's offering (web, SSH, mail, …).

Monitor

watches several hosts at once, pinging each on a repeating interval and showing it as a live tile (up/down, response time, packet loss).

Routing table

shows THIS machine's IP routing table — the rules the OS uses to decide where each packet goes.

DHCP lease

shows how THIS machine got its IP address.

Local servers — which IP do devices point at?

the Local servers tool stands up test servers on THIS machine (Syslog, SNMP-trap, TFTP, HTTP, FTP, DNS, DHCP, RADIUS, TACACS+) so your gear can point at your…

Console (SSH / Telnet / Serial)

connects over SSH (encrypted), Telnet (plaintext), or a local serial/COM port straight into a device's console — the pre-network way in for factory-fresh gea…

Runbook

a named sequence of steps you run with one click — a repeatable checklist that actually gathers data instead of just telling you what to go do.

Posse (multi-agent network sweep)

sends a POSSE of specialist agents to sweep your whole local network as a team.

Capture (live packet analyzer)

a simple live packet analyzer — like a lightweight Wireshark built into the toolkit.

Drift (baseline vs live)

captures a baseline of who's on your network (a sweep + the ARP cache, recording each host's IP, DNS name, MAC, and vendor), then on a later "Check drift" co…

Deputy (AI assistant, powered by Claude)

The Deputy is SubnetSlinger's own AI assistant, powered by the Anthropic Claude API with your own key — it is NOT Microsoft Copilot or GitHub Copilot, and ha…

Security (type-7, hashes, host keys)

three security checks in one place.

File transfer (SFTP / SCP / TFTP)

pushes a file to a device or pulls one back.

Quick console

your saved SSH / Telnet / Serial connections for one-click login — like the host list in any SSH client, so you never retype an address.

Vault

a local, encrypted store for the secrets you don't want sitting in plain text — passwords, keys, notes.

Discovery

finds the devices on your local network.

Topology

sweeps the subnet and draws a node map around the local network, with a per-device icon guessed from MAC vendor (OUI) + hostname — switches, routers, APs, pr…

ARP table

shows the IP-address ↔ hardware-address (MAC) pairs your computer has recently talked to on the local network, and labels each MAC with the hardware maker (i…

MAC / OUI lookup

turns a MAC (hardware) address into the company that made the device.

Wi-Fi scan

lists nearby wireless networks with signal, channel, and security, using the operating system's own scanner (Windows netsh, Linux nmcli) — plus two analyses …

L2 neighbors (LLDP)

reads a switch's LLDP-MIB over SNMP and lists its neighbors — for each of the switch's ports, the connected device's system name, port, and chassis ID.

Path MTU

finds the largest packet that reaches a target WITHOUT being fragmented — the real end-to-end MTU.

NTP check

asks an NTP server for the time (SNTP over UDP/123) and reports how far off this machine's clock is, plus the server's stratum.

Local connections

lists what THIS machine is listening on and the connections it currently has open — the same data the Deputy's local_sockets tool uses, as a first-class table.

Wake-on-LAN

sends a Wake-on-LAN 'magic packet' (broadcast UDP) to power on a machine by its MAC.

Speed test

measures your internet connection's download speed, upload speed, and latency by moving test data to and from Cloudflare's servers.

Config Builder

builds a device configuration for you from a template — you fill in a short form (hostname, IP, VLANs, and so on) and it writes out the full config text for …

Provisioning

applies the same change — a set of commands, or a password rotation — across MANY devices at once over SSH, instead of logging into each by hand.

Lab Testing

three lab-shakeout tools in one — a throughput test (iperf3) to measure real bandwidth between two machines, a chaos/latency monitor that watches a link over…

CLI wrappers

What it does (Linux only): puts a friendly form over command-line network tools you already have installed — nmap, curl, openssl, dig, mtr, tcpdump, and more.

Field Kit

a bundle of quick, on-the-spot checks for when you walk up to a problem — Wi-Fi/AP health from where you're standing, an interface comparison, a plain-langua…

Subnet Slinger (game)

a lighthearted arcade break — subnets rain from the sky and you sling the right answer before they hit the dirt.

Inventory

a persistent list of devices, filled automatically by Discovery or added by hand.

Incidents

a work log of incidents with timestamped notes, severity, and export to Markdown OR a print-friendly page (Print / PDF) — your record of what you did and found.

Activity log

an automatic audit trail — what ran, when, by whom, and the result.

Files

a shortcut to the folder where SubnetSlinger writes the things you export or capture — packet captures (.pcap), CSV exports, saved topology PNGs, and reports.

Theme

customize how the app looks — colors and accent — so it's comfortable for your eyes and your setup.

SNMP

SNMP is the standard way to ASK network gear (switches, routers, printers, APs) about themselves — this tool sends those read-only questions and shows the an…

DNS

looks up the records behind a domain name — the "phone book" of the internet.

Subnet calculator

does the math of a subnet for you — given a network, it tells you the address range it covers, the first and last usable addresses, the broadcast address, th…

SSL / TLS audit

fetches the live TLS certificate and audits the connection — subject/issuer, validity dates and days remaining, the negotiated TLS protocol and cipher suite,…

HTTP headers

asks a web address for its response and shows the status code, the response headers, and how long it took — without downloading the whole page.

WHOIS / RDAP

looks up WHO is behind a domain, IP address, or network — the registration record.

IP info / GeoIP

tells you where an IP address is and who runs it — rough geographic location, the ISP/organization, and its ASN (the network's ID number).

API (REST / NETCONF / gNMI client)

a built-in client for talking to network gear and controllers through their APIs — REST/RESTCONF, NETCONF, and gNMI — instead of scraping the CLI.

Use cases

API & MCP reference

How MCP fits together

New to MCP?

AI models & token usage

The Deputy and the Posse call your chosen AI provider with YOUR key — you pay that provider directly, no SubnetSlinger subscription and no markup.

Run the AI where you want — cloud, local, or your own servers

The Deputy and Posse are provider-agnostic — the SAME features run wherever you point them.

Ollama — run the AI locally (no cloud, no cost)

The Deputy and Posse can run on a LOCAL model via Ollama instead of the Anthropic cloud — pick the provider in the Deputy's "AI" dropdown (Anthropic, OpenAI-…

Juniper junos-mcp-server

official Juniper MCP server — connects to Junos over NETCONF/PyEZ to fetch config, run show/operational commands, and get device facts.

Cisco pyATS_MCP

wraps Cisco's pyATS/Genie testing framework — runs show commands over SSH, parses them into structured data, and can 'learn' and diff device state.

Cisco Catalyst Center / SD-WAN MCP

MCP servers over Catalyst Center (DNA Center) for inventory/health/assurance, and over Catalyst SD-WAN (vManage) for policies, device health, and templates.

NetBox MCP (source of truth)

the official netboxlabs server queries NetBox — sites, devices, IPs, prefixes, VLANs, cables — READ-ONLY by default (deliberately hard to misuse; a write for…

netclaw (agentic-ops orchestrator)

an open-source agent that orchestrates dozens of MCP servers (pyATS, Junos, F5, Catalyst Center, ISE, NetBox, ServiceNow, GitHub) behind ONE agent with an au…

F5 / Arista via MCP

community MCP servers wrapping F5 iControl REST (BIG-IP LTM/GTM) and Arista CloudVision (CVP).

NETCONF / RESTCONF

model-driven device APIs.

gNMI (streaming telemetry)

gRPC Network Management Interface — Get for on-demand snapshots, Subscribe for streaming telemetry (push updates as values change).

SNMP OIDs (poll)

poll device OIDs.

Operational show commands

the CLI data that laptop-side ping/trace can't see.

API tokens & auth-first

REST and MCP-backed APIs authenticate with tokens — Bearer, X-API-Key, or OAuth.

Running on Linux