Guardian Flow

Guardian Flow visualizes your network as a graph — your monitored devices, the Guardian hub, and other devices your agents discover nearby, all connected by the links between them.

Views

Switch views from the top of the page:

Map — a force-directed graph. Toggle between Force (physics-based, nodes settle into place) and Rack/Site (a static grid grouped by the site and rack you’ve assigned each device to in Asset Inventory).
Physical — a switch → port → device tree, built from real switch-port and LLDP data your agents collect two ways: an SNMP-MIB walk (any agent promoted to coordinator), and passively — every agent listens for the LLDP/CDP broadcasts switches already send, no configuration needed, on Linux, macOS, and Windows alike.
Subnets — devices grouped by IP subnet.
List — a plain sortable table, useful for scanning or exporting.

Reading the map

Node color — blue is the hub, green is an online registered agent, red is offline, amber is a discovered (non-agent) device.
Node border — colored by department, if the device belongs to a group.
Link style — a solid line is a confirmed connection; a dashed line is inferred, not yet confirmed.
Animated links — a moving dash pattern marks an active, confirmed connection to an online device.

Interacting with the graph

Click a node to see its full detail panel.
Drag a node to reposition and pin it in place (Force view).
Right-click a node to pin or unpin it without moving it.
Click a department in the legend, or click a cluster node directly, to collapse that department into a single node — useful for decluttering a large fleet. Click the cluster again to expand it.

Locating a device

From a device’s detail panel, use Locate This Machine to trigger a beep or on-screen alert on that device — see Locate a Device.

Incident mode and blast radius

When one or more devices go offline, a red Incident mode panel appears above the map. It names the probable root causes: offline devices that have no offline device above them in the physical topology. Devices that went offline beneath a failed switch are treated as symptoms, so one switch outage is one finding, not twenty. Each line says how many devices sit beneath the failure, how many of those are also offline, and how many are still reporting (they may have a second path).

Click Show blast radius (or select any switch or device and use the Blast radius section of the side panel, then Highlight on map) to ring the failed device in red and the devices beneath it in amber, while everything unrelated is dimmed. Clear highlight restores the normal view. Highlighting works in both the Map and Physical views and never resets your pan or zoom.

Blast radius is calculated from the physical links Guardian has discovered (SNMP switch ports and LLDP). It does not yet know about application or service dependencies, and it says so on screen. A device that has no discovered links is reported as an independent failure with nothing beneath it.

Windows and switch-topology discovery

Passive LLDP/CDP listening on Windows needs Npcap — a free, separate driver you install yourself (Guardian never bundles or silently installs it). Without it, a Windows agent still does everything else (ARP, mDNS, SNMP, the active SNMP-MIB walk if promoted to coordinator) — it just won’t passively pick up LLDP/CDP broadcasts the way a Linux or macOS agent does. Install Npcap with its default options and restart the agent service to pick it up; no other configuration needed.

Physical-view topology (switch ports, LLDP neighbors) is discovered automatically by your agents. To watch a specific value on an SNMP device instead — a UPS battery level, a specific interface counter — see SNMP Watches.