This is an old revision of the document!
NAV features at a glance
Network Administration Visualized is an advanced software suite to
monitor large computer networks. It automatically discovers network
topology, monitors network load and outages, and can send alerts on
network events by e-mail and SMS, allowing for flexible configuration
of alert profiles.
Development of NAV started in 1999 at the Norwegian University of Science and Technology (NTNU). It originated as a collection of scripts used internally at NTNU's ITEA Network group. In 2001 UNINETT became interested in its development. In 2006 the development of NAV was moved from NTNU to UNINETT. NAV is used at nearly all universities and university colleges in Norway and many places elsewhere.
As of 2004 NAV is made freely available under the GNU General Public License.
NAV runs on a unix platform, software packages are currently available
for Debian, RHEL/Centos, Suse and FreeBSD.
The figure below gives an overview of NAV. As shown, the NAV database is the heart of the system (background processes are on the bottom of the figure, foreground web tools are on the top).
With reference to the figure, and in summary, NAV contains the following
A postgreSQL database, NAVdb
, (1) modelling the running network. An SNMP collector
(3) collects data from the network. The physical interconnection of devices is auto detected, as well as the vlan topology.
A status monitor
(3) that detects network outages. For severe cases where many devices are down NAV will try to pinpoint the root cause of the problem (i.e. distinguishing between devices down and devices in shadow)
(2,20) for all “intersections” in the network; i.e. all router and switch ports. Octet, packet and error counters are collected, along with CPU and memory statistics, temperature sensors (and more). Use the "ranked statistics"
(19) to present a list of interfaces with most traffic, the highest error counts, etc. The traffic statistics collection uses RRDTool
. NAV automatically builds the Cricket configuration tree for you.
A machine tracker
(12) where you can search for machines and where they currently are connected in the network, or where they have been connected earlier. Search for mac addresses, IPv4 or IPv6
A Mac Watch tool
that let you set up a watch list for mac addresses that will trigger alarms if watched mac addresses appear on the network.
If you use 802.1X authentication in the wired or wireless network (i.e. eduroam), use NAV's radius-base usertracker
(12) to search for authenticated users.
A machine detention tool (11: Arnold
) lets you detain machines from the network, either by blocking the access switch port, or change the vlan to a quarantine vlan. A back-end script that easily integrates with external system can run automated detention jobs.
A network weather map (18, Netmap
) that displays the layer 3 and layer 2 topology and current traffic conditions. Dropdown menues give detailed information and links to the traffic statistics.
A geographical map (18, Geomap
) that shows network topology and traffic on an OpenStreetMap
. You can view the current traffic conditions or you can step back in time.
A network explorer
(17) giving a graphical tree-structured display of the network on layer 2, also showing spanning tree states. You may for instance search for a particular server and the network explorer will expand the relevant switches to show a network trace to the server.
(13) that lists the inventory of routers and switches in the network. Information on software version, equipment type, location etc. Also detailed information of router and switch ports with data on IP address / prefixes, vlans, port speed and duplex etc. Includes a subnet matrix that gives a good overview of your allocated IPv4 and IPv6 prefixes.
An IP device info tool
(15) that serves as a dashboard presenting all collected information about a device. For switches and routers this includes a graphical layout of all ports showing link speed, duplex, vlan and status. A separate view displays the link history of switch ports.
A device histoy tool
(14) that displays all occurred events for a physical device (a given serial number).
A threshold monitor
(7) that gives alarms based on high load / high error rates or severe CPU load etc. The threshold monitor is highly configurable through the Threshold Manager web interface
. The monitor understand states and will prevent alarm flapping by using hysteresis.
A service monitor
(6) that reports on service outages. Support the most important services; ssh, http(s), imap(s), pop, smtp, smb, rpc, dns, smb, dc, rpc, dhcp, ftp, smb, mysql, postresql, oracle, radius. Can easily be expanded to support more services.
A general event system
(8) that processes all events, including alarms from external systems.
A flexible alert system
(9), where each NAV user can adjust his own profile (using the tool alert profiles
, 21) with fine-grained control options. Currently support for sending email, SMS and jabber alerts. The profiles can be made to adjust the volume and types/severities of alarms wanted, this as a function of time and day of the week.
A status page
(22) that shows the current status of all events.
A switch port configuration tool, portAdmin
(10), that lets the NAV user change interface description and vlan values of switch ports. The tool uses SNMP write to perform its job.
A message system
that displays operational messages to IT support staff and end users.
A maintenance tool
to put devices on maintenance for a planned time period and thus suppress alarms.
A general mechanism for authentication and authorization of NAV users. Use the user adminstration tool
to manage users and on a group level set the appropriate authorization level.
NAV answers your questions
NAV is developed by network engineers with years of experience in operating large campus networks. NAV development has been going on for more than 12 years. Our priority has always been; implement the feature we lack most first. The overall objective has been indisputable:
To illustrate how NAV might help you in your work environment, here are some questions you might ask yourselves. NAV can answer them for you:
What type of network equipment do we have in our network? What kind of switches and routers, how many of each, where are they located? What software and hardware versions are they running? How many modules are there in the various stacked and chassis based switches? Are there any free, or almost free, modules? Help me get the overall picture, I need to expand switch Z and are looking for spare parts…
NAV does not cover everything...
NAV helps you with many things, but not with everything (surprised?). You will always need a set of tools, no tool will cover every aspect of network management. And, of course, above all, you need knowledge of how to design and configure your network, how to troubleshoot etc.
Here are some areas where NAV does not help you:
NAV does not give you end-to-end traffic data. NAV gives you traffic load for each interconnection in your network, but does not know the origin of the traffic nor where it is going. This means no end-to-end information with IP-addresses and TCP/UDP port numbers. Netflow or RMON2 may help you more with this. We recommend that you complement NAV with a netflow analysis tool; i.e. NfSen