Docs Get started
How Lantern works
The collector, what it reads from your devices, where data is kept, and the network ports involved.
The collector
The Lantern collector is a single program (netmap.exe on Windows, netmap on Linux) with the web UI built in. Run it on a machine that can reach your switches, routers and firewalls over SNMP. It:
- Polls each device over SNMP v2c or v3 on a schedule (every 5 minutes by default in the example configuration).
- Discovers neighbours: devices it finds through LLDP or CDP whose management address is inside your discovery subnets are added automatically, up to three hops per cycle.
- Listens for syslog on UDP 514. Syslog carries the MAC-flap and link-up messages that confirm a loop and point at where it started, as they happen, whatever the poll interval. Without it, Lantern can only show possible loops.
- Builds the topology: links, link aggregation, stacks, VLAN membership, where every endpoint is plugged in, and what changed since the last poll.
- Serves the web UI and the API that the UI uses, behind sign-in.
What it reads
| Data | Where it comes from |
|---|---|
| Identity | System MIB, entity MIB (model, serial, software) |
| Ports | Interface tables (64-bit counters when present), duplex, link aggregation |
| Neighbours | LLDP, and CDP where LLDP is missing |
| VLANs | Bridge and VLAN MIBs (and Cisco's VLAN tables) |
| MAC tables | Bridge forwarding tables, per VLAN on Cisco |
| Spanning tree | Port states, root bridge, topology changes |
| Layer 3 | IP addresses and ARP |
| Health | CPU, power supplies and PoE budgets where the device reports them |
Each cycle is about 60 SNMP walks per device. Polling runs in the background with at most two requests at once per device.
Where data is kept
Everything lives in the collector's data folder: data\ next to the program when you run it by hand, C:\ProgramData\Lantern when installed as a Windows background task, and /var/lib/lantern on Linux.
| File | What it holds |
|---|---|
snmp.json |
Collector configuration: SNMP credentials, devices, discovery subnets, syslog |
credentials.key |
Key that encrypts the secrets in snmp.json |
auth.json, auth.key |
Sign-in settings (LDAP, cloud providers); secrets encrypted with auth.key |
users.json |
Accounts: local accounts (password hashes) and directory or cloud accounts that have signed in |
auth-audit.log |
Sign-in activity |
monitoring.db, monitoring.key |
Monitors, their history and alerts; notification secrets encrypted with the key |
checks.json |
This site's best-practice check settings |
ssh/ |
Recorded SSH sessions and the SSH host key |
Keep each key with its data and never copy keys between customers. See Backups and updates.
Network ports
| Port | Direction | Purpose |
|---|---|---|
| TCP 8000 (or your choice, e.g. 8443 for HTTPS) | Browsers → collector | Web UI and API |
| UDP 161 | Collector → devices | SNMP polling |
| UDP 514 | Devices → collector | Syslog (needed to confirm loops) |
| TCP 2222 | Technician PCs → collector | SSH session broker for PuTTY (optional) |
| TCP 443 | Collector → identity provider | Cloud sign-in only: discovery, keys and token exchange |
| TCP 636 or 389 | Collector → domain controller | LDAP sign-in only |
By default the web UI and the SSH broker listen on 127.0.0.1 (this machine only). Make them reachable from other computers when you install the collector; see Serve Lantern over HTTPS.