How your servers really connect. Drawn by them, and proved wire by wire.

Every team has an architecture diagram, and it is wrong: drawn once, by hand, from memory. The NOC is the other kind. Drop your servers on a canvas and Vigia reads each box's own firewall and its live connections and draws the wires itself. Then it proves them — not from your computer, which knows nothing about whether one server can reach another, but from the box each wire starts at. What works goes quiet. What is broken turns red and says why.

A NOC diagram in LockFlare Vigia: ten servers, all 73 WireGuard wires talking, with one server lit to show the connections it shares in both directions — Ten servers, all 73 wires talking, one box lit to show who it talks to — and who talks back.

A diagram you do not draw

Drag servers from the tree, one or a whole group, and each lands as a box with its address and an icon for what it is, read from what it listens on. You can wire them by hand — drag from a port on one box to another, click the chip to set the port. Or press Discover and let the boxes describe themselves.

Discover asks two witnesses on every box and merges what they say. The firewall: an allow rule on B for a port from A's address is the wire A to B — the topology as it was intended, written down in the one place that decides. And the connections: an established connection on B from A is the same wire — the topology as it is right now. A wire both saw is the strongest kind. One only the firewall saw is a door nobody walks through, and one only the connections saw is traffic no rule expected. Both are said in words on the wire, because those are the findings.

10servers dropped on the canvas

187wires found, from the boxes' own firewalls and connections

4ports in the picture: WireGuard, Redis, Sentinel, MariaDB

Ten servers dropped from the tree onto a new NOC diagram in LockFlare Vigia, each a box with its address and ports to wire from — Ten servers dropped from the tree. Nothing drawn yet.

LockFlare Vigia discovering how ten servers connect: 187 wires drawn from their own firewalls and connections, tagged by port, with the proof starting from each box — Discover: 187 wires, tagged by port, and the proof already running from each box.

Three facts per wire, proved where the traffic starts

A wire says KEEN-2 talks to KEEN-1 on 3306. That is a claim. Check all proves it, every box proving its own wires at once, and each fact is said in a sentence — the failing one first.

Reach

The source opened a connection to the destination's port. It is a probe run on the source box, over the shell Vigia already has there — the only place that question can honestly be answered.

Listen

Something on the destination listens on that port, on an address the source dials. Loopback only is the classic: the service is up, the wire is down, and every dashboard on the box is green.

Allow

The destination's firewall lets the source's address in — the Firewall screen's own reading of that box, not a guess from outside.

A NOC diagram of three servers in LockFlare Vigia with 21 wires found between them on ports 3306, 6379, 26379 and 51820, each labelled with what the firewall allows — Three servers, 21 wires, four ports — each wire labelled with its port and what was found about it.

One port at a time, and the broken ones loud

A real fleet is a hairball, so the ports in the picture are chips across the top, each with its count: press one and the diagram is about that and nothing else. A saved diagram opens in Run, where the rule is reversed from drawing: everything that works is barely there, and a broken wire is red.

Here Redis alone: 54 wires, 18 of them broken, found in the time it took to open the diagram. Each red wire says which of its three facts failed. The usual story behind a batch like this is a firewall still letting a port in that nothing answers on any more — the kind of thing nobody finds until the day it matters. Then MariaDB alone: three boxes, six wires, all talking: the replication built earlier that day, drawn without anyone drawing it.

A NOC diagram in LockFlare Vigia filtered to Redis on port 6379: 54 wires, 18 of them broken and drawn in red, while all ten servers prove their wires at once — Redis only: 54 wires, 18 broken — red, and found without anyone looking for them.

The same NOC diagram filtered to MariaDB on port 3306: three servers, all six wires talking — MariaDB only: three boxes, all six wires talking.

Light a box, and ask it a question

Click a server and its traffic is lit hard while the rest recedes. Click again to let it go; several can be lit at once.

Inbound: the wires arriving at it. Outbound: the ones leaving it. Each with its count, tagged like the ports.
Mutual is the third question: the wires where the lit box talks to a peer and that peer talks back on the same port. That is the shape of a replica set, a cluster, a mesh — and the quickest way to see who is really in one.
A box or a wire opens beside the canvas with its three facts in words, and Ask Themis opens her chat for that server with the box's wires and their verdicts already in front of her: with a broken wire she is asked for the reason.

A NOC diagram in LockFlare Vigia filtered to WireGuard on 51820/udp with one server lit: its eight inbound and eight outbound wires drawn bright while the rest of the mesh recedes — WireGuard only, one box lit: eight wires in, eight out, the rest of the mesh receding.

Saved, and proved again every time it opens

A diagram is saved with its boxes and wires, stamped with your key and holding no secret. Opening one is not looking at a picture from last month: it opens in Run and proves itself, every box checking its own wires at the same time, so ten servers take as long as the slowest one. A broken wire costs its source a few seconds of waiting and nobody else anything. The head says what it found — all 73 wires talking, checked just now — or how many are broken and which.

Saved NOC diagrams in LockFlare Vigia: one of ten servers and 187 wires, one of three servers and 21 wires, each with Open and Forget — Two saved diagrams: the whole fleet, and the three boxes of one database pair.

What people use it for

After a firewall change

Open the diagram and it says, within seconds and from the boxes themselves, whether everything that talked before still does. The one wire you closed by accident is the red one.

Finding the rules nobody uses

"Allowed, not seen" is an allow rule with no connection behind it: a door nobody walks through. Some are standbys waiting for their day. The rest are what is left of servers and services that went away years ago.

Finding traffic no rule expected

The other direction: a connection seen talking that no firewall rule names, because the port is open to anywhere or there is no firewall at all. Said on the wire, in those words.

Before building on top of it

A replica set, a database pair, a Sentinel set, a private network: every one of them is a set of wires. The builders in Vigia prove theirs before they write anything, and the NOC is where you see them all at once afterwards.

The WireGuard mesh

Questions people ask

Does it scan my network?

No. Nothing is scanned and nothing is probed from your computer. Discover reads each server's own firewall rules and established connections over the login you already have, and Check tries only the wires that are on the diagram, each from the server it starts at.

What makes a wire broken?

One of three facts failed, and the wire says which, first: the source could not open the connection, nothing on the destination listens on that port on an address the source dials, or the destination's firewall does not let the source in.

What does "allowed, not seen" mean?

The destination's firewall has a rule letting the source in on that port, and no established connection was seen using it when Vigia looked. It is the topology as it was intended rather than as it is: a standby path, or a rule left behind by something that no longer exists.

Does it need an agent on the servers?

No. It reads what the server already knows — its listening sockets, its connections, its firewall — over SSH, and the probe is an ordinary connection attempt from the source box. A diagram only holds servers Vigia can log in to, which is what makes every wire provable.

Is the diagram kept up to date?

It is proved again every time it is opened, and whenever you press Check all, so what you see is never older than your last look. Discover can be run again to pick up wires that have appeared since.

Where are diagrams stored?

On your computer, with the rest of your map, stamped with your key and carried by its encrypted backup. A diagram holds boxes, wires and ports and no secret; nothing about your network is sent to LockFlare.

See what your servers say about each other

Vigia is free for 10 servers. Nothing is installed on them to try it.

Download Vigia