1. What NetMon does
NetMon watches a network and tells you when something changes. Install one small agent on any machine on that network and it will find every connected device, check each one continuously, scan them for known vulnerabilities, and warn you when an unrecognised device appears.
It is built for two jobs in particular:
- • Knowing when something breaks — before the client rings you.
- • Knowing what is actually on the network — including things nobody told you about.
Everything runs from one dashboard. If you manage several client networks, each is a site and you switch between them from a dropdown.
One agent per network, not per device
The agent scans the local subnet, so a single install covers everything on that network. You only need a second agent for a physically separate network.
2. Getting started
Sign in with Google at portal.angstep.co.uk. On first sign-in you will be asked for your company name and to accept the terms. NetMon then creates your organisation, your first site, and the credentials your agent needs.
New accounts start on the FREE plan — no card required.
Installing the agent (Windows)
- 1. From the dashboard, select your site and click Agent Config. This shows your install token and the exact command to run.
- 2. Download the agent package (a
.zip) and unzip it on the machine that will do the monitoring. - 3. Open PowerShell as Administrator in that folder and run the command shown.
./install_agent.ps1 -ApiKey "nm_xxxxxxxx" -SiteId "your-site-id" -Networks "192.168.1.0/24"Change -Networks to match the network you want monitored. Run ipconfig to check. The installer registers a Windows service that starts automatically at boot. Devices appear in the dashboard within about a minute.
Requirements
Windows 10 or Server 2016 and later, Python 3.10+, and administrator rights. The agent uses under 30 MB of memory and only makes outbound connections — it opens no inbound ports.
Installing the agent (Linux)
There is no packaged Linux installer yet, but the agent is Python and the manual install takes about ten minutes. Become root first and stay root — ARP and ICMP discovery need raw socket access, and several steps write to root-owned locations.
1. Prerequisites
sudo -i\n\napt-get update && apt-get install -y python3 python3-venv python3-pip unzip arp-scan\n\npython3 --version2. Copy the agent package across
scp netmon-agent.zip youruser@LINUX_IP:/tmp/\nmkdir -p /opt/netmon && cd /opt/netmon\nunzip netmon-agent.zip3. Virtual environment and dependencies
cd /opt/netmon\npython3 -m venv /opt/netmon/venv\n/opt/netmon/venv/bin/pip install -r /opt/netmon/requirements-agent.txt4. Configuration
NETMON_API_URL=https://portal.angstep.co.uk\nNETMON_API_KEY=your-token\nNETMON_SITE_ID=your-site-id\nNETMON_NETWORKS=192.168.1.0/245. Test and install the service
/opt/netmon/venv/bin/python /opt/netmon/main.py\nsystemctl enable --now netmon-agent\nsystemctl status netmon-agent --no-pagerDevices appear in the dashboard within about a minute. Type exit to stop being root when you are finished. Tested on Ubuntu 22.04.
3. The dashboard
The dashboard is the main view. Across the top:
| Control | What it does |
|---|---|
| Site switcher | Choose which network you are looking at. Appears once you have a site. |
| + Add Site | Create another client network and get its agent configuration. |
| Agent Config | Show the install token and command for the selected site. |
| Remote Access | Open MeshCentral for your organisation. PRO/MSP |
| Plans | View plans, upgrade, or manage your subscription. |
| Account | Email preferences and a record of what you have agreed to. |
| Topology | Visual map of how devices connect. |
| Vulnerabilities | CVE and exposed-port findings for the selected site. |
Below that are counters for total, online and offline devices and active alerts, then the alerts list and the device grid.
4. Working with devices
Device status
| Status | Meaning |
|---|---|
| Online | Responding normally, acceptable latency, no packet loss. |
| Warning | Reachable but degraded — usually latency above 100ms or some packet loss. |
| Offline | Not responding to repeated checks. Powered off, unplugged or faulty. |
| Unknown | Discovered but not yet checked. Normally clears within a minute. |
Actions
PING · DETAIL · EDIT
Check a device immediately, inspect latency and packet-loss history, or set a friendly name, type, location or tags.
CONNECT · REBOOT · WOL
Remote desktop, shell, restart and Wake-on-LAN actions require the appropriate PRO/MSP access and device agent.
TRUST DEVICE
Shown on rogue devices. Confirms that a newly detected device belongs here and clears the alert.
5. Security features
NetMon combines live monitoring with vulnerability scanning, known-exploit prioritisation, exposed-service detection and a documented risk-acceptance workflow. Findings are written in plain language so your team can act quickly and explain the result to a client.
- • Live CVE and actively-exploited threat matching.
- • Risky exposed-service detection for remote desktop, file sharing and databases.
- • Rogue-device detection learned from each network's baseline.
- • Required notes when a known risk is accepted.
- • Client-ready PDF reports with clear recommendations.
6. Alerts, tickets and email
Alerts are raised when a device goes offline, degrades, flaps or presents a security concern. Auto-ticketing can turn those changes into a support conversation before a customer notices an issue. Manual tickets remain available when a technician needs to record a task directly.
Configure email preferences from the Account area. Use the site switcher first when working across multiple client networks so an alert is always attached to the right organisation.
7. Remote access
Remote Access opens MeshCentral for your organisation. Connect and reboot actions appear only on devices that have the MeshAgent installed. Wake-on-LAN is shown on offline devices where the MAC address is known.
8. Sites and organisations
A site is a physically separate network. Install one agent per site rather than one agent per device. MSP plans can separate client organisations so each team sees the networks and reporting context that belong to them.
9. Plans and billing
New accounts start free with up to 20 devices and one site. Pro adds remote access and multi-site management. MSP adds unlimited client organisations and the full platform for consolidating a monitoring and security stack. Prices exclude VAT.
Compare plans →10. Account and privacy
The Account area includes email preferences and a record of what you have agreed to. Keep live API keys and agent configuration files root-only, and rotate credentials if a configuration file is exposed.
11. Troubleshooting
If devices do not appear, check that the agent is running as the expected user, the network range is correct, and outbound connections are permitted. Check the startup lines and service logs before reinstalling.
Still stuck?
Contact the Angstep team and include the site name, agent ID, operating system and the relevant service log. Get in touch →