docs/npm/README.md
Network Performance Monitoring (NPM) in Netdata covers your network devices and the traffic between them — metrics, topology, flows, events, and logs — collected by the Netdata Agent and visualized per second in Netdata dashboards and Netdata Cloud.
The Network Monitor dashboard brings devices, topology, flows, and trap events together on one page in Netdata Cloud.
Device metrics (SNMP) — poll routers, switches, firewalls, access points, UPSs, and PDUs. Netdata matches each device to a vendor profile by its sysObjectID and collects interfaces (traffic, errors, discards, operational state), system and host resources, and vendor-specific hardware, environmental, and protocol metrics. Every metric is a chart you can alert on, with interactive per-interface and per-device tables.
Topology — see how your network connects. Netdata builds Layer 2 maps (LLDP, CDP, MAC/FDB, STP) and Layer 3 maps (BGP, OSPF, ARP), plus the Netdata streaming hierarchy and virtual infrastructure (VMware vSphere, Cato).
Application dependencies — see how your software connects. On monitored hosts (Linux, FreeBSD, and macOS), Netdata reads the kernel's live socket table and maps what each process is talking to; on Linux each one is also attributed to the container, image, systemd unit, or Kubernetes pod that owns it — with no instrumentation and no sidecars. A standard host install needs nothing configured; running the Agent in a container needs a few extra privileges.
BGP monitoring — peer state, advertised and received prefixes, and session health on your routers, with an interactive peer table and alerts on session changes.
Licensing — license state, entitlements, and expiry on devices that report them (Cisco Smart Licensing, Fortinet, Check Point, and others), so a feature never silently stops.
Network flows — collect NetFlow, sFlow, and IPFIX. See who is talking to whom, how much, and over which ports and protocols, enriched with geolocation, ASN, and IPAM data, in Sankey, time-series, and map views.
SNMP traps — receive and decode the events your devices report (thousands of trap definitions across hundreds of vendors) into structured, searchable journal entries with severity and category, queryable in Netdata Logs and forwardable to your SIEM.
Syslog from network devices — ingest device syslog through the OpenTelemetry Collector into Netdata Logs.
Netdata ships profiles for hundreds of device and trap vendors. Each capability lists exactly what it covers under its Integrations submenu: if your device is there, Netdata collects it out of the box; if it isn't, you can add a custom profile. Start from Device Metrics to check coverage and add devices.