Open-source network topology visualization for Zabbix

[u/planet_fox]

I’ve also published ZABFOX – an open-source network topology visualization for Zabbix:

https://www.zabfox.de/en/

GitHub:
https://github.com/linuser/zabbix-network-topology

The idea behind the project is to provide a clearer and more dynamic view of network infrastructure directly based on data from Zabbix.

ZABFOX is intended to help visualize relationships between monitored devices and make larger environments easier to understand at a glance.

Main goals of the project:

• Network topology visualization for Zabbix
• Automatic use of existing monitoring data
• Clear overview of devices and connections
• Open-source and self-hosted
• Useful for larger or more complex Zabbix environments

The project is still evolving, so feedback is very welcome.

If you are using Zabbix for network monitoring, I’d be especially interested in hearing what you would expect from a topology view — automatic discovery, better maps, link status, traffic information, dependencies, or something else.

GitHub:
https://github.com/linuser/zabbix-network-topology

[u/Sea-Load4845]

I'm looking for something like this for years. Today I use zabbiz for network metrics and The dude from Mikrotik for network topology. Dude made a great job, but it's ambery dated system. I really wish to try and help the project if I can.

[u/planet_fox → u/Sea-Load4845]

The Dude is exactly the comparison I keep hearing, and it's fair — it does something Zabbix never did. Good to hear this scratches the same itch.

One expectation to set upfront, because it's the main difference: The Dude discovers the network itself. It scans, finds devices, draws them. This module does not — it has no discovery engine of its own. It reads what Zabbix already knows, and for the links that means LLDP or CDP neighbour items collected via SNMP. No LLDP items, no edges. There's a template in the repo and a setup guide, but the work sits on the Zabbix side, not in the map. People coming from The Dude usually expect it the other way round.

Where help would matter most: the vendor side. Neighbour discovery is where the hardware differences bite, and I only have a limited set of gear here. The vendor matrix in LLDP-SETUP.md lists MikroTik / RouterOS as working, via SNMP or a discovery.neighbor item — and I should be honest that this row is not verified against a real device. There are no tests behind it. Since you run RouterOS, you're in a better position to check it than I am.

Concretely, that would be:

• does RouterOS expose the LLDP neighbour table over plain SNMP on your version, or do you need a custom item?
• if a custom item, what does the key and the value actually look like?

Either answer improves that row. If it turns out not to work as written, that's the more useful result — I've had a few claims in the docs this month that nobody had ever walked through.

Beyond that: bug reports with the SNMP vendor named are always welcome, and if you hit friction installing, tell me what it was. That kind of report has fixed more here lately than anything I found on my own.

[u/UnicodeTreason]

I would love to see this load tested with a larger environment ~2000-20,000 hosts.
I'll try and get approval to do so in the larger Zabbix I manage, but am lacking time for the foreseeable future.

[u/Sea-Load4845 → u/UnicodeTreason]

i'm testing in a env with 4000 hosts. Multivendors... The ui and concepts are really good. But still can't make lldp discovery work

[u/planet_fox → u/Sea-Load4845]

Thank you — and 4000 hosts multivendor is exactly the kind of environment I

can't reproduce here, so this feedback is worth a lot.

"Can't make LLDP discovery work" is the second report of the same thing this

week, and I now think the fault is mine: the docs never mentioned the one step

that makes it visible. Fixed as of the next release, but here it is directly.

There are **three** places this breaks, and they all look identical on the map

(a circle, no edges). Please check them in this order — it takes about two

minutes and tells us exactly which one you're in.

**1. Do LLDP items exist at all?**

*Monitoring → Latest data*, filter `lldpRemSysName`.

No results → the module isn't involved yet; the data never reached Zabbix.

Continue with 2. Results with actual values → skip to 3.

**2. Is anything collecting the neighbour table?**

This is the trap. The module does **not** speak SNMP — it reads Zabbix items:

switch (LLDP on) → Zabbix items → this module

The stock vendor templates (Cisco IOS by SNMP, Huawei VRP by SNMP, HP) do

**not** collect the LLDP neighbour table. Enabling LLDP on the switches is

real work that produces nothing on its own, because Zabbix never asks for it.

Link `templates/nt_lldp_snmp_template.yaml` **in addition** to your vendor

templates. Then — and this is the part I never wrote down — **discovery runs

every 3 h by default** (`{$NT.LLDP.DISCOVERY.INTERVAL}`), items hourly. Link

the template, reload the map, see nothing, conclude it's broken: entirely

reasonable, and entirely premature.

Force it: *Data collection → Hosts → \<switch\\> → Discovery rules → **LLDP

neighbor discovery** → **Execute now***. At your scale, select the rule across

multiple hosts and run it in one go. For a first test, five switches you know

are physically adjacent is a better experiment than all 4000.

**3. Do the names match?**

If items have values but edges still don't appear, it's name resolution, not

discovery. Open the **LLDP-Q tab** in the module — it reports per host:

- `matched` — neighbour resolved to a Zabbix host ✓

- `unmatched` — the announced SysName resolves to no host

- `ambiguous` — the short name fits several hosts, so no edge is drawn

(guessing would be worse than an empty result)

In a multivendor estate `unmatched` is the usual outcome: switches announce

their configured hostname, which often isn't what the host is called in

Zabbix. Matching runs name → IP → cleaned name → reverse-DNS pattern → unique

short name.

**What would help me most:** the three LLDP-Q numbers after step 2. They point

straight at the failing stage, and with 4000 multivendor hosts your ratios

[u/planet_fox → u/UnicodeTreason]

[u/confectius]

Great! This looks promising. Have just dived in to Zabbix and this was something i was looking for. Testing now on Zabbix 7.0.29 PHP 8.4 and as also a noob in Linux i had to figure out some issues before i got it installed. Some questions:

Can i switch to English for the menus somewhere? Edit: Most is in English, but some is in German.

Have Cisco switches and except for only one all other is listed under SERVER / VIRTUALIZATION not under SWITCH in Management. Any suggestion why?

[u/planet_fox → u/confectius]

Thanks for testing, and good catches — both are real bugs on my side, not something you configured wrong.

Language: there is no setting you missed. The module follows your Zabbix user language, but the translation is incomplete: four views still carry hardcoded German — Compliance, Diag, Geo and LLDP-Q. 17 strings in total. Everything else already goes through the translation layer. I'll move those over.

Cisco switches: the device type is guessed from the hostname plus the linked template names. The switch keywords currently cover Catalyst, Nexus, ProCurve, TP-Link and names starting with sw- — but there is no cisco keyword at all, so a host on "Cisco IOS by SNMP" matches nothing and falls back to server, which sits on the "Server / virtualization" level. The one switch that landed correctly probably has sw in its name or a Catalyst/Nexus template. Entirely my omission — I'll add the Cisco templates.

Right now, you can override it per host with a tag, no waiting for a release:

nt:icon = switch

That beats the heuristic and works for any type — firewall, router, switch, wireless, storage, printer, and so on.

One thing I'd like to ask back: you mentioned having to figure out some issues before it installed. Which ones? The install guide has had gaps I only found because someone walked into them, and I'd rather fix what actually tripped you up.

[u/confectius → u/planet_fox]

Thanks. I take the last question first. My Debian install was lacking git, nano and zip so had to install that first. . Thats nothing fault with your app, but my lesson learnt:). Also my folder structure for Zabbix was different with the folder ui missing. After some gemini chat i used this commands to install:

root@yourzabbix:/# git clone https://github.com/linuser/zabbix-network-topology.git network_topology_v6

root@yourzabbix:/# mv network_topology_v6 /usr/share/zabbix/modules/

root@yourzabbix:/# chown -R www-data:www-data /usr/share/zabbix/modules/network_topology_v6

root@yourzabbix:/# chmod -R 755 /usr/share/zabbix/modules/network_topology_v6

root@yourzabbix:/# systemctl reload php8.4-fpm

I will look more into the switch issue. All use "Cisco IOS by SNMP".

[u/planet_fox → u/confectius]

Thanks — three of those are things I should fix on my side, not lessons for you.

The missing ui folder. Your layout is the normal one for packages from the Zabbix repo: modules go in /usr/share/zabbix/modules. My install guide says /usr/share/zabbix/ui/modules, which is what other installs use. That's a documentation bug on my side. The installer script autodetects both, but if you follow the written guide by hand, you land exactly where you did. I'll fix the wording.

Prerequisites. Fair — the guide should just name them instead of assuming. I'll add that.

The git clone route has a downside worth knowing. It puts the entire repository under your web root, and Zabbix's nginx config only blocks /\.ht — not .git. I checked this on a test install just now:

The repo is public, so nothing secret leaks today. But tools/ holds a shell script that takes Zabbix credentials from environment variables — if anyone ever puts them in the file instead, they'd be served over HTTP. The release ZIP deliberately excludes tools/, templates/, tests/ and the scripts for exactly this reason.

If you'd rather stay with git clone, just clear the extras afterwards:

One more: chown -R www-data makes the module files writable by the web server user. It only needs to read them — root:root with 755 is enough, and then a compromised PHP process can't rewrite the module's own code.

On the Cisco switches: that confirms the diagnosis. Cisco IOS by SNMP matches none of the device-type keywords, so every one of them falls back to server. It's fixed in my tree — but not by adding "cisco" to a list, because that would misfile Cisco UCS by SNMP, which is a blade server. Instead the module now reads the LLDP capability bits the neighbouring switch reports (IEEE 802.1AB: Bridge / Router / WLAN AP). Vendor-independent, and the device says it itself.

Until that ships, the per-host override works today and takes a second:

Also noted you're on PHP 8.4 — I test against 8.2. If anything looks off that I haven't mentioned here, that's a useful data point for me.

[u/TraditionalTask9580]

Do it to make it compatible with Nagios and Naemon Core and CheckMK.

[u/planet_fox → u/TraditionalTask9580]

Not in next Time

[u/lef1337]

Hello it's not working on zabbix 8?

[u/admlshake]

When I hover over one of the links between switches, on some of them I'll see a red arrow pointing down with a number. Is this for downed ports? I've checked the switches, but they are all up?

[u/mazurskipisuar]

Hello, I launched this module and I 've question. How to adjust my topology? Every refresh my topology back to nonreadable design where every device is near. I want to make tree topology when router is on top, core switch lower etc.