--- title: "Network maps" description: "How Outpost draws a live map of each client's network from discovery, agents, and SNMP, what its views and link types mean, and where to go next." url: "https://support.outpostplatform.com/network-maps/" product: "depot" type: "concept" status: "draft" ai_summary: "Outpost network maps: a live map per client built from network discovery, LLDP and CDP reported by agents, and SNMP from managed switches. Combined, Physical (L1), Data link (L2), and Network (L3) views. Confirmed and inferred links. Daily snapshots, styles, link details, documented diagrams with drift checks, a built-in diagram editor, exports, and racks. Every plan; discovery:read to view." availability: plans: ["home-lab", "essentials", "enterprise", "msp"] permission: "discovery:read" preview: false source: "https://gitlab.com/outpostplatform/docs/-/edit/main/src/content/docs/network-maps/index.md" license: "CC BY 4.0" --- # Network maps The network map shows how a client's firewalls, routers, switches, access points, servers, and workstations connect, drawn by Outpost from what your agents and network discovery already collect. Technicians use it to find where a device is plugged in and trace a path. Owners and managers use it to keep an up-to-date drawing of each client's network, with revisions, drift alerts, and exports for Visio and draw.io. Network maps are included on every plan. The map is on **Endpoints** > **Network map**. On the MSP plan, select the client first. ## Where the map comes from Outpost builds the map each time you open it, from data in the client's own database. Nothing extra is sent across the network to draw it. | Source | What it adds | What it needs | | --- | --- | --- | | [Network discovery](/endpoints/network-discovery/) | Devices on trusted networks, their subnets, and each network's gateway. | Discovery turned on and at least one trusted network. | | Agents (LLDP and CDP) | The switch and port at the other end of each endpoint's own network link. | `discovery.link_neighbor_collection` turned on in a profile. It is off by default, and the built-in **Network Discovery** profile does not turn it on. On Linux and macOS the agent must run as root. | | SNMP | Switch-to-switch links, which switch port each host is on, and, with a recent agent, link speed, media, link aggregation, and trunk VLANs. | Managed switches with SNMP enabled, tracked in Outpost with scheduled SNMP monitoring on. See [Monitor a device over SNMP](/endpoints/network-discovery/#monitor-a-device-over-snmp). Switch links need agent 0.6.0 or later on the polling endpoint. | | Endpoint network adapters | The link speed and media of the endpoint's own connection. | A recent agent. Windows and Linux report speed. macOS and BSD do not. | | Your link details | Media, speed, cable ID, and a label you set by hand. | `network_map:edit`. See [Edit link details](/network-maps/link-details/). | The more of these sources a network has, the more of its links are confirmed. A network with discovery alone draws every host connected to its gateway, because that is all Outpost can know about it. ## Confirmed and inferred links Every link on the map is either confirmed or inferred. The link details panel says which, and why. | Link | Drawn | Evidence | | --- | --- | --- | | Confirmed | Solid line | A device announced the link over LLDP or CDP, from an agent or from SNMP, or the link comes from documentation or a drawing. | | Inferred | Dashed line | Outpost worked the link out from a switch's MAC address table, or from the default gateway when nothing better is known. | | Not seen recently | Dashed line | The evidence is more than 7 days old. These are shown by default. Clear **Show devices and links not seen recently** to hide them. | An inferred link is usually right about which devices connect. It can be wrong about the path in between, such as an unmanaged switch Outpost cannot see. When one matters, add a cable ID or a label in its details, or put the switch under SNMP monitoring. ## Views The map draws one layer at a time, the way a network drawing set does. Choose it under **View** on the map page. | View | Shows | | --- | --- | | **Combined** | Everything: sites, subnets, devices, and every link. | | **Physical (L1)** | Cables and ports only. Each link is styled by its media and speed, a link aggregation is one line labeled with its members (such as "Po1 2×10G SMF"), and port names are shown. | | **Data link (L2)** | Switches, access points, firewalls, and routers, inside VLAN boxes. Hosts fold into cards such as "+12 workstations" per VLAN and switch. Trunks are labeled with their VLANs, such as "Trunk 10-12,20". | | **Network (L3)** | Firewalls, routers, and gateways, with each subnet as a box holding one card for its hosts. Each subnet's card links to its gateway, labeled with the gateway's interface address. WAN and VPN links are kept. | Hosts of one kind are grouped into one card when a group holds more than 12 of them. Select the card to show every host, and **Group hosts again** to fold them back. ## What else the map does - **Trace a path** from one device to another, or to the internet, hop by hop. See [Use the network map](/network-maps/use-the-map/). - **See what changed.** Outpost keeps a snapshot of the map on each day it changes, for 90 days, and compares any two. - **Style it** with your practice's link colors and widths and your own device icons. See [Set map styles and icons](/network-maps/map-styles/). - **Keep documented diagrams** that Outpost checks against the live network, with revisions, proposed updates, and drift alerts. See [Keep documented network diagrams](/network-maps/documented-diagrams/). - **Edit diagrams in the console** with the built-in diagram editor. See [Edit a diagram in the diagram editor](/network-maps/diagram-editor/). - **Export** to draw.io, Visio, PDF, PNG, SVG, yEd, Mermaid, and D2. See [Export network maps and diagrams](/network-maps/export/). - **Record racks** and what is mounted where. See [Record rack elevations](/network-maps/racks/). - **Ask Pioneer AI** to read, trace, compare, or draw the network. See [Network maps with Pioneer AI and MCP](/network-maps/pioneer-and-mcp/). ## Who can see and change it Viewing the map, diagrams, and racks needs `discovery:read`, the same permission as network discovery. Devices that are endpoints also need `endpoint:read`. Without it, an endpoint is shown as the discovered device it matched, or left out. Editing diagrams, links, and racks needs `network_map:edit`, and changing styles and icons needs `network_map:manage`. See [Network map permissions](/network-maps/permissions/). ## Related - [Use the network map](/network-maps/use-the-map/) - [Network discovery](/endpoints/network-discovery/) - [Track unmanaged devices](/endpoints/unmanaged-devices/)