NetBox vs NacTrack: the network you documented, and the one your devices report
NetBox is an open source source of truth, under the Apache 2 licence, that models the intended network: sites, racks, cables, prefixes, VLANs, circuits. Its documentation asks for data to be checked by a person before it goes in, and strongly discourages automated import of live network state. NacTrack starts from the other end: it reads your devices over SSH, read-only, and derives inventory, topology, configuration compliance, CVE exposure and end of support. NetBox Labs also offers discovery and drift detection; here is what they cover, and when NacTrack answers the question you are actually asking.
- Sources read on 30 October 2026, against NetBox 4.7.4 (released 27 October 2026) and NetBox Labs' public documentation; what is said of NacTrack comes from its product pages. Sources are listed at the bottom of the page.
Why choose NacTrack
Five reasons, each with the page that shows it.
Does NetBox discover the network?
NetBox itself, no. The project's repository states that it does not interact with network nodes directly [3], and the introduction to its documentation strongly discourages automated import of live network state: NetBox is meant to represent the intended state, checked by a person, and then feed monitoring and provisioning [2].
NetBox Labs, whose platform is built around NetBox [3], does sell discovery. NetBox Discovery relies on an agent, orb-agent, under the Apache 2 licence, which probes the network over ICMP, TCP, UDP and SSH and sends what it finds to Diode, the ingestion service that updates NetBox [7][9]. The agent has several modes: an NMAP sweep that returns IP addresses, a device discovery that logs in with NAPALM (48 drivers for more than 17 vendors, including Arista, Juniper, Palo Alto, Fortinet, Huawei and MikroTik), an SNMP discovery and a gNMI subscription [9]. Device discovery returns the device, its interfaces, type, platform, site, addresses, prefixes, VLANs and VRFs, and its modules [9].
On NetBox Cloud, discovery is managed for you; on NetBox Enterprise it comes preconfigured; on the community edition you install the Diode server, the NetBox plugin and the agent yourself [8]. The Diode server is distributed under the NetBox Limited Use License 1.0, not Apache 2, and needs NetBox 4.2.3 or later [10]. Detecting drift between the documented and the real network, NetBox Assurance, is an option of NetBox Enterprise and NetBox Cloud and is not available for the community edition [11].
What discovery fills in is NetBox objects. Configuration compliance, CVE exposure and end of support are not among them [9], and that is where NacTrack sits: it reads the configuration text and the exact version, and derives those three answers from them.
Comparison table
| Criterion | NacTrack | NetBox |
|---|---|---|
| What the tool represents | The state read off the devices at the last collection, dated [N1][N12] | The intended state of the network, entered and checked by a person [2] |
| Discovery | Included: recursive from one device over CDP and LLDP, plus an address-range sweep [N3] | Not in NetBox [3]. NetBox Labs' NetBox Discovery: NMAP sweep, NAPALM, SNMP, gNMI, through Diode [7][9]; self-built on the community edition [8] |
| Access to devices | Read SSH account, no agent; nothing is written to the device [N1][N8] | None for NetBox [3]; discovery goes through orb-agent, over SSH, NETCONF, vendor APIs, SNMP or gNMI depending on the mode [9] |
| Topology | Rebuilt on every collection from CDP, LLDP, MAC and ARP tables [N1] | Documented cables, with sanity checks [6]; no documented discovery mode sends cables [9] |
| IP addressing | Addresses carried by interfaces and seen in ARP tables, observed utilisation; no reservations [N11] | Prefixes, ranges, addresses, VRFs, VLANs, FHRP groups, AS numbers [1]: the reference addressing plan |
| Data centre | Not modelled: no racks, power or passive cabling | Regions, sites, racks, devices and modules, cables, power distribution, circuits, virtual machines [1][6] |
| Configuration compliance | Named rules per platform; every failure cites the rule and the config extract; waivers supported; custom rules not yet open [N4] | Configuration management is outside NetBox's scope [2]; NetBox renders configurations from Jinja2 templates, without applying them [5] |
| CVE | Matched to the exact version (NVD, Cisco PSIRT, KEV, EPSS); SMUs not evaluated; no findings for Huawei VRP yet [N5] | Not described in the official documentation [1][9] |
| End of life | Hand-curated catalogue, "no data" shown as such [N6] | Not described in the official documentation [1][9] |
| History | Configuration kept on every collection, diff between two collections, export as text and .patch [N7] | Change log: a copy of each object before and after, with the time and the user [13] |
| API and extensions | No open REST API and no NetBox connector; a read-only MCP endpoint for an AI assistant; CSV, Excel, PDF exports [N7] | REST API, read-only GraphQL API, webhooks [4]; custom fields, event rules, plugins [1] |
| Vendors | 8 vendors collected over SSH (Cisco, Huawei, Aruba, Dell, Fortinet, F5, Infoblox, Forcepoint), Juniper and Palo Alto by import; Arista EOS not collected [N2] | Not applicable to manual entry; NAPALM discovery: 48 drivers, more than 17 vendors [9] |
| Deployment | Appliance on your hardware (NacTrack ISO or Ubuntu VM), 4 vCPU, 13 GB, 50 GB minimum, single machine [N8] | Self-hosted community edition [3]; NetBox Cloud, hosted and managed by NetBox Labs [12]; NetBox Enterprise, with an air-gap edition [12] |
| Licence and price | Commercial, subscription per device per year; no per-user cost; quote [N10] | Community edition under Apache 2, free [1][3]; Cloud (Starter, Professional, Premium) and Enterprise with no published price, through sales [12] |
When NetBox is the better fit
- You need to document what cannot be read off a switch: racks, rack positions, passive cabling, power distribution [1][6]. NacTrack does not model them.
- You keep a reference addressing plan, with reservations and assignments that exist on no device yet [1]. NacTrack only shows the addresses the network already carries.
- Your automation reads from and writes to a source of truth over a REST API, and renders configurations from templates [4][5]. NacTrack has no open REST API.
- You want a free, open source tool [3], or your estate has fewer than about eighty devices: our pricing page says that at that size buying NacTrack stops being obvious.
Frequently asked questions
Is NacTrack an alternative to NetBox?
For part of the job only. If you use NetBox as the device inventory and data entry can no longer keep up, NacTrack gives you that inventory read off the network, plus compliance, CVE and end of support. To document racks, cabling, circuits or a reference addressing plan, NetBox remains the right tool: NacTrack models none of those.
Doesn't NetBox Discovery do the same thing?
It overlaps on the inventory part: it reads devices, interfaces, addresses, VLANs and modules, and feeds them into NetBox [9]. Configuration compliance, CVE matching and end of support are not among what it returns. On the NetBox community edition you also set up the Diode server, its plugin and the agent [8], and drift detection, NetBox Assurance, is not available [11].
Can NetBox and NacTrack run together?
Yes. NetBox says what should be, NacTrack says what the devices report at the last collection, and the gap between the two is where forgotten devices and conflicting addresses hide. There is no connector between them today: NacTrack's lists export to CSV or Excel, with their filters applied, and can be compared with a NetBox export.
Is NacTrack open source like NetBox?
No. NacTrack is commercial software sold as a subscription, per device per year, published by Yuften Services. The NetBox community edition is under the Apache 2 licence. The NacTrack subscription includes updates and vendor support, and a one-day, read-only network audit is offered free of charge so you can judge NacTrack on your own estate.
What access does NacTrack need?
A read account, reached over SSH from the management network. No agent is installed and nothing is written to the device. The flows that leave the appliance, with their setting and their limit, are listed on the what leaves your server page.
Other comparisons
SolarWinds NCM alternative
A SolarWinds NCM alternative, function by function: config backup, change detection, compliance, CVE, licensing, offline use, and where NCM fits better.
ProductNetdisco alternative
Netdisco alternative: inventory and topology, plus configuration audit, CVE by exact version and end of support, all read-only over SSH.
ProductIPAM software: subnets and addresses read off the network
An IPAM tool that reads addresses off your devices: subnet utilisation, the switch port of an IP, conflicts. Compared with phpIPAM, NetBox, Infoblox.
Sources
- 1. NetBox documentation, home: features and Apache 2 licence, read 2026-10-30
- 2. NetBox documentation, introduction: intended state and what NetBox is not, read 2026-10-30
- 3. NetBox GitHub repository, release 4.7.4 of 27 October 2026, read 2026-10-30
- 4. NetBox documentation, API and integration, read 2026-10-30
- 5. NetBox documentation, configuration rendering, read 2026-10-30
- 6. NetBox documentation, devices and cabling, read 2026-10-30
- 7. NetBox Discovery documentation, read 2026-10-30
- 8. NetBox Discovery, getting started (Cloud, Enterprise, Community), read 2026-10-30
- 9. orb-agent: repository (Apache 2 licence), network discovery, device discovery, supported platforms, SNMP discovery, gNMI discovery, read 2026-10-30
- 10. Diode GitHub repository (licence and prerequisites), read 2026-10-30
- 11. NetBox Assurance documentation, read 2026-10-30
- 12. NetBox Labs pricing, read 2026-10-30
- 13. NetBox documentation, change logging, read 2026-10-30
- N1. NacTrack, home
- N2. Vendors and coverage matrix
- N3. Discovery
- N4. Compliance
- N5. Vulnerabilities
- N6. End of life
- N7. Integrations
- N8. Installation and operations
- N9. What leaves your server
- N10. Pricing
- N11. IP address management
- N12. Inventory
Trademarks are cited for identification only; NetBox, NetBox Discovery and NetBox Assurance are trademarks of their owner.
Compare your source of truth with what the network says
A one-day, read-only network audit is offered free of charge, and the 30-day trial runs on your network.