Drift

What it does: captures a baseline of who's on your network (a sweep + the ARP cache, recording each host's IP, DNS name, MAC, and vendor), then on a later "Check drift" compares the live network to that baseline and flags what changed. It's the intended-state-vs-actual-state idea: your saved snapshot is the source of truth, no external database required.

Findings: NEW HOST and MAC CHANGED are worth attention; HOSTNAME and MISSING are informational. NEW HOST — something is on the network that wasn't in the baseline (a possible rogue). MAC CHANGED — same IP, different MAC than before (IP↔MAC drift): a device swap, a DHCP reassignment, or MAC spoofing. HOSTNAME / MISSING — a name changed, or a baseline host isn't responding now (moved, off, or firewalled).

Safe to run: yes — it only sweeps and reads the ARP cache (same as Discovery + ARP). It changes nothing on any device. Warn-level findings (NEW HOST, MAC CHANGED) also open an Incident so the investigation is logged.

Reading results: red tags need a look; gray tags are informational. A NEW HOST or MAC CHANGE is the cue to run the rogue-device playbook — identify the vendor, locate the switch port, verify building/closet, then contain ON the switch (SubnetSlinger never shuts a port for you). Re-capture the baseline once you've accounted for the change.

Golden config: config compliance — checks device configs against a golden baseline you save, giving PASS/FAIL per device. It's read-only: it compares text and never connects to or pushes anything to a device. Save the baseline (paste or load a config file) with optional rules, one per line: "must: <line>", "must-re: <regex>", "must-not: <line>", "must-not-re: <regex>", "section: interface Gi0/1" (the whole indented block must match the baseline) or "section-re: ^line vty". Leave the rules empty to require every baseline line and section. Add devices from Multi-host run's last results (run "show running-config" there), or paste / load a config. Run gives PASS/FAIL per device, the failed rules, and a +/− diff against the baseline (a big compare runs in the background — Cancel stops it); export the results as CSV or Markdown (you choose where to save). Secret values (enable/user secrets, SNMP communities, keys) are masked as ****** before anything is shown, saved, exported or logged, so a changed password value isn't flagged — its line still is.