NetMon User Manual

How to install, configure and use NetMon — network monitoring, vulnerability scanning, rogue device detection and remote access for IT teams and MSPs.

1. What NetMon does

NetMon watches a network and tells you when something changes. Install one small agent on any machine on that network and it will find every connected device, check each one continuously, scan them for known vulnerabilities, and warn you when an unrecognised device appears.

It is built for two jobs in particular:

• Knowing when something breaks — before the client rings you.
• Knowing what is actually on the network — including things nobody told you about.

Everything runs from one dashboard. If you manage several client networks, each is a site and you switch between them from a dropdown.

2. Getting started

Sign in with Google at portal.angstep.co.uk. On first sign-in you will be asked for your company name and to accept the terms. NetMon then creates your organisation, your first site, and the credentials your agent needs.

New accounts start on the FREE plan — no card required.

Installing the agent (Windows)

1. From the dashboard, select your site and click Agent Config. This shows your install token and the exact command to run.
2. Download the agent package (a .zip) and unzip it on the machine that will do the monitoring.
3. Open PowerShell as Administrator in that folder and run the command shown, which looks like:

.\install_agent.ps1 -ApiKey "nm_xxxxxxxx" -SiteId "your-site-id" -Networks "192.168.1.0/24"

Change -Networks to match the network you want monitored. Run ipconfig to check. The installer registers a Windows service that starts automatically at boot.

Devices appear in the dashboard within about a minute.

Installing the agent (Linux)

There is no packaged Linux installer yet, but the agent is Python and the manual install takes about ten minutes. Become root first and stay root — ARP and ICMP discovery need raw socket access, and several steps write to root-owned locations.

1. Prerequisites

sudo -i

apt-get update && apt-get install -y python3 python3-venv python3-pip unzip arp-scan

# The agent needs Python 3.10 or later - check before continuing
python3 --version

If python3 is older than 3.10, install a newer version and use it explicitly in step 3. arp-scan is optional; discovery is faster with it.

2. Copy the agent package across

The download button needs a browser login, so download the zip on your workstation and copy it over.

# On your WORKSTATION
scp netmon-agent.zip youruser@LINUX_IP:/tmp/

# Then ON THE LINUX MACHINE, as root
mkdir -p /opt/netmon && cd /opt/netmon
mv /tmp/netmon-agent.zip .
unzip netmon-agent.zip && mv netmon-agent/* . && rmdir netmon-agent
ls -la

You should see main.py, requirements.txt and several directories. If not, the unzip did not work — do not continue.

3. Virtual environment and dependencies

cd /opt/netmon
python3 -m venv /opt/netmon/venv
/opt/netmon/venv/bin/pip install --upgrade pip
/opt/netmon/venv/bin/pip install -r /opt/netmon/requirements-agent.txt

4. Configuration

cat > /opt/netmon/environment.env <<'EOF'
NETMON_API_URL=https://portal.angstep.co.uk
NETMON_API_KEY=your-token
NETMON_SITE_ID=your-site-id
NETMON_AGENT_ID=linux-agent-01
NETMON_NETWORKS=192.168.1.0/24
EOF
chmod 600 /opt/netmon/environment.env

Get the token and site ID from Agent Config in the dashboard. Set NETMON_NETWORKS to the subnet you want monitored — ip -4 addr will show it. The file holds a live key, so keep it root-only.

If you are not root, cat > will fail with permission denied even under sudo, because the redirect happens as your own user. Use sudo tee /opt/netmon/environment.env instead, or become root properly with sudo -i.

5. Test before installing the service

/opt/netmon/venv/bin/python /opt/netmon/main.py

6. Install the service

cat > /etc/systemd/system/netmon-agent.service <<'EOF'
[Unit]
Description=NetMon Monitoring Agent
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
User=root
WorkingDirectory=/opt/netmon
ExecStart=/opt/netmon/venv/bin/python /opt/netmon/main.py
Restart=always
RestartSec=15

[Install]
WantedBy=multi-user.target
EOF
systemctl daemon-reload
systemctl enable --now netmon-agent

7. Confirm it is working

systemctl status netmon-agent --no-pager
journalctl -u netmon-agent -f

Devices appear in the dashboard within about a minute. Type exit to stop being root when you are finished.

Tested on Ubuntu 22.04. To remove the agent: systemctl disable --now netmon-agent && rm -rf /opt/netmon /etc/systemd/system/netmon-agent.service

3. The dashboard

The dashboard is the main view. Across the top:

Below that are counters for total, online and offline devices and active alerts, then the alerts list and the device grid.

4. Working with devices

Device status

Actions

5. Security features

Rogue device detection

When an agent first starts, NetMon treats everything it finds as legitimate and learns that as the baseline. Once the network has been stable for a while, the baseline locks. From then on, any device that appears is flagged as rogue and raises a critical alert.

If the device is legitimate — a new laptop, a visitor's phone, a replacement printer — click TRUST DEVICE. It joins the baseline and the alert closes. If it is not something you recognise, that is exactly what the feature is for.

Vulnerability scanning

The Vulnerabilities page checks each device two ways:

• Known vulnerabilities (CVEs) — matched against the National Vulnerability Database using the vendor, model and firmware NetMon has discovered. Anything listed in CISA's Known Exploited Vulnerabilities catalogue is highlighted, because those are being exploited in the wild right now.
• Exposed services — risky open ports such as Telnet, RDP, VNC, SMB and unauthenticated databases, each with an explanation of why it matters.

Scanning takes a few minutes and runs in the background. Results are grouped so failing devices appear first.

Acknowledging a risk

Some findings are accepted risks — a legacy device that has to stay, a port that must be open. Add a note to acknowledge a finding and it stays visible but marked, recording who accepted it and when. That record is useful evidence in an audit or a client report, and considerably better than a spreadsheet nobody updates.

6. Alerts, tickets and email

Alerts appear in the dashboard immediately. Depending on what NetMon detects, it may also raise a support ticket automatically and, separately, send an email — each runs on its own timing, for its own reason, and neither waits for the other.

Email alerts

Email works differently from the dashboard, and deliberately so.

Alert emails go to organisation administrators. Each person can turn them off under Account. They are part of the monitoring service, so they are controlled separately from marketing preferences and are not affected by them.

Automatic tickets

For a small set of issues judged serious enough not to need a "let's see if it clears up" wait, NetMon raises a support ticket automatically — nobody has to notice the alert and raise one by hand. It appears immediately in Support for the organisation, and in the admin Tickets queue, with a system-generated first message explaining what was detected.

Unlike email, tickets are not held for ten minutes. NetMon raises one as soon as it has confirmed the issue — normally within about two minutes of it first happening.

7. Remote access PROMSP

Remote access is provided through MeshCentral, built into NetMon. Each organisation gets its own isolated device group and its own scoped account, so you only ever see your own devices.

Two ways in:

• Remote Access in the header opens MeshCentral with your full device list.
• CONNECT on a device card opens a session for that machine.

Both need the MeshAgent installed on the target device. When you upgrade to Pro or MSP, remote access is set up automatically and is usually ready within a minute.

8. Sites and organisations

A site is one network — typically one client, or one office. Each site has its own agent, its own devices and its own vulnerability results.

An organisation is your account. It owns your sites, your users and your subscription. MSP customers can have multiple client organisations.

To add a site, click + Add Site, name it, and install the agent using the configuration shown. Site limits depend on your plan.

User roles

9. Plans and billing

Prices exclude VAT. Pro is billed per site, so the cost follows the number of sites you actually have. Upgrade or change plan from Plans; payment is handled by Stripe and NetMon never sees your card details.

What happens when you reach a limit

• Device limit — existing devices keep working. New ones beyond the limit are not added, and the dashboard tells you.
• Site limit — adding another site is blocked with an upgrade prompt.
• Remote access on Free — the option is not shown.

Nothing is deleted and no monitoring stops. Upgrading lifts the limit immediately.

10. Account and privacy

The Account page holds your preferences and consent record.

• Marketing emails — optional product updates and tips. Off unless you chose otherwise at signup, and you can change it at any time. Nothing about your service depends on it.
• Alert emails — operational notifications about your network. Separate from marketing, and on by default because they are the service you signed up for.
• Agreements — which version of the terms you accepted and when.

If you withdraw marketing consent, your details are removed from our marketing system on the next sync. If you want a copy of the data we hold, or your account deleted, contact us and we will action it within one month.

Data is stored in the EU. The agent makes outbound connections only.

11. Troubleshooting

No devices appear after installing the agent

• Check the service is running: Get-Service NetMonAgent on Windows, or systemctl status netmon-agent on Linux.
• Check NETMON_NETWORKS matches the network the machine is actually on. This is the most common cause.
• Check the API key and site ID were pasted correctly — a truncated key fails silently from the agent's point of view.
• Allow a full minute. First discovery takes longer than subsequent scans.

A device shows as offline but is clearly working

Many devices block ping by default, particularly Windows machines with the firewall on and some network appliances. If a device is genuinely fine, this is usually why.

The same device keeps going offline and coming back

That is a connection problem rather than a failing device — check cabling, wifi signal strength, PoE budget or the switch port. NetMon will report it as an unstable connection rather than repeatedly telling you it is down.

Everything shows as rogue

The baseline locked before discovery had finished, which can happen on a large or slow network. Trust the legitimate devices and it will settle. If there are a great many, contact support and we will reset the baseline.

Remote access will not connect

• The target device needs the MeshAgent installed — NetMon's own agent is not the same thing.
• Remote access requires Pro or MSP.
• After upgrading, allow a minute for provisioning to complete.

I am not receiving alert emails

• Check your spam folder and mark the message as not spam — the first email from a new sender is often filtered.
• Check alert emails are enabled under Account.
• Only organisation administrators receive them; viewers do not.
• Remember the ten-minute delay — brief outages are filtered deliberately.

I didn't get a ticket for an offline device

Tickets are only raised automatically for a printer or router going offline, a rogue device, or a response-quality alert on an RMM-managed, NAS, VOIP, printer or router device — see Automatic tickets. An ordinary device (a laptop, phone, or anything without RMM) going offline is by design covered by the email alert only, not a ticket.