51 terms defined the way an operator meets them, with what FreeSDN actually does about each one. Where support is partial, the entry says so.
A device that bridges wireless clients onto a wired network, usually powered over Ethernet and managed by a controller rather than individually.
In FreeSDN: Access points are inventoried per site with their controller, radio band, channel and connected-client count. FreeSDN reads them from the vendor controller (Omada, UniFi, OpenWrt) rather than talking to each AP directly.
See also: Controller, PoE, SSID, WLAN
A notation that writes an IP range as an address plus a prefix length, such as 10.10.0.0/16, replacing the older fixed class A/B/C split.
In FreeSDN: Sites carry their subnets in CIDR form, and discovery scans take a CIDR range as their input. The prefix length bounds how many addresses a scan will touch.
A vendor's own management system for a fleet of its devices: an Omada OC300, a UniFi console, an OPNsense firewall, a Proxmox cluster.
In FreeSDN: FreeSDN sits in front of controllers rather than replacing them. You register a controller once with its credentials, and every device behind it is discovered, normalised and presented alongside devices from other vendors.
The protocol that hands a device an IP address, gateway and DNS servers when it joins a network, instead of each device being configured by hand.
In FreeSDN: DHCP scopes and static reservations are read and staged through the firewall and gateway adapters (OPNsense, pfSense, MikroTik, OpenWrt). Writes go through the staged-change path like every other device mutation.
See also: DNS, Staged write, Subnet
The system that resolves names to addresses. On a managed network it also covers local overrides, split-horizon views and blocklists.
In FreeSDN: DNS records and overrides are read and staged on the gateway adapters. FreeSDN also resolves hostnames before contacting any operator-supplied host, so a name cannot be used to reach an address the SSRF guard would refuse.
A vendor-neutral protocol in which devices advertise their identity and capabilities to directly-connected neighbours, making physical topology discoverable.
In FreeSDN: LLDP neighbour tables are one of the inputs to topology discovery, which is what lets FreeSDN say which switch port a given camera or phone is plugged into.
See also: Topology, Switch, Access point
A flow-export protocol in which a router or switch summarises each conversation, recording source, destination, ports and byte counts, then ships those records to a collector.
In FreeSDN: The Observability module runs a NetFlow v5 collector. Flow records feed traffic analytics and per-application breakdowns; deep packet inspection rules classify them further.
See also: Observability, Syslog, SNMP
Delivering electrical power over the same cable that carries data, so cameras, phones and access points need no separate power supply.
In FreeSDN: Switch pages show per-port PoE state and the budget consumed against the switch's total. Toggling PoE on a port is a staged write, because power-cycling a port takes the attached device offline.
See also: Switch, Staged write, Access point
A long-established protocol for polling device counters and receiving asynchronous traps. Still the lowest common denominator for hardware that exposes nothing better.
In FreeSDN: Used by the Observability module for polling and trap reception where a device has no modern API. Community strings are stored encrypted like any other credential.
See also: Observability, NetFlow, Syslog
The broadcast name of a wireless network. One physical access point commonly serves several, each mapped to its own VLAN and security policy.
In FreeSDN: SSIDs are read per controller with their band, security mode and VLAN binding. Creating or changing one is a staged write; the pre-shared key is redacted on every read.
See also: WLAN, VLAN, Access point, Secret redaction
A contiguous block of IP addresses treated as one broadcast domain, written in CIDR notation and usually paired one-to-one with a VLAN.
In FreeSDN: Sites declare their subnets, which scopes discovery scans and lets FreeSDN place a discovered device at the right site automatically.
A device that forwards Ethernet frames between ports within a network. A managed switch adds VLANs, port security, link aggregation and PoE control.
In FreeSDN: Switches expose per-port status, VLAN membership, PoE state and port security. Renaming a port, changing its VLAN or toggling PoE all go through staged writes.
A standard for shipping log messages from devices to a central collector over UDP or TCP, with a severity and facility on every message.
In FreeSDN: The Observability module runs a syslog collector that parses, indexes and correlates device messages against inventory, so a log line resolves to a known device rather than a bare IP.
See also: Observability, NetFlow, SNMP
The map of what is physically or logically connected to what: which port feeds which access point, and which uplink carries which VLAN.
In FreeSDN: Built from LLDP neighbours, controller data and MAC address tables, then rendered as an interactive map. It is what makes cross-module correlation possible.
A logical network carved out of shared physical switching, so traffic in one VLAN is isolated from another without separate cabling.
In FreeSDN: VLANs are first-class: defined once, then distributed to multiple controllers at once through the Network Distribution Engine, which is one of the few genuinely cross-vendor write paths in the product.
See also: Subnet, Switch, SSID, Staged write
An encrypted tunnel that carries private traffic across an untrusted network, joining remote sites or remote users to an internal network.
In FreeSDN: WireGuard, OpenVPN and Tailscale overlays are supported for reaching remote sites. Imported configurations are encrypted at rest, private key included.
See also: Site, Edge agent, Encryption at rest
The wireless portion of a network: the access points, the SSIDs they broadcast, and the radio settings behind them.
In FreeSDN: WLAN configuration is read across Omada, UniFi and OpenWrt and normalised into one shape, so band, channel and security settings are comparable between vendors.
See also: SSID, Access point, VLAN
A memory-hard password hashing function, winner of the Password Hashing Competition, designed so that cracking attempts cost attackers RAM as well as CPU.
In FreeSDN: Argon2id hashes every local user password. Passwords are never stored reversibly.
An append-only record of who did what, when, and to which resource. It is distinct from application logs, which record how the software behaved.
In FreeSDN: Every mutation records actor, action, resource, org, site, IP and outcome. Entries carry the actor's email as well as their id, so the trail still identifies the person after the account is deleted.
See also: RBAC, Staged write, Site grant
An attack where a site you are logged into is made to act on a request originating from a different site, using your session automatically.
In FreeSDN: State-changing requests require a CSRF token alongside the httpOnly session cookie, so a cookie alone is not enough to act.
Encrypting stored data so that reading the database file, a backup or a disk image does not yield the plaintext.
In FreeSDN: Device credentials, API keys, VPN profiles and SNMP community strings are Fernet-encrypted in the database. A full .fsdnvault backup is sealed with a passphrase and re-keyed on restore.
See also: Secret redaction, Vault backup, VPN
A signed, self-describing token carrying claims about a session. Its weakness is revocation: a signed token is valid until it expires unless something tracks it.
In FreeSDN: Access and refresh tokens are JWTs delivered as httpOnly cookies, with a jti revocation list so a session can be terminated before its natural expiry.
Requiring a second proof of identity beyond a password, most commonly a time-based one-time code from an authenticator app.
In FreeSDN: TOTP multi-factor authentication is available per user and enforceable per organization.
Serving multiple independent organizations from one deployment, with data isolation between them enforced by the application rather than by trust.
In FreeSDN: Organization scoping is applied at the application layer and fails closed, not through Postgres row-level security. FreeSDN's stated threat model is a single-tenant self-hosted appliance; multi-org support is for MSPs running their own instance.
See also: RBAC, Site grant, Site
Granting permissions to roles rather than to individuals, so access is a property of a job function instead of an accumulated list of exceptions.
In FreeSDN: Five roles across multi-org tenancy, with strict-lower assignment: a role can never create an account more powerful than itself. Site grants narrow further within a role.
See also: Site grant, Audit log, Multi-tenancy
Stripping credentials out of data before it leaves the system, so passwords and keys never reach a log line, an API response or an error message.
In FreeSDN: Redaction runs centrally on every adapter read, so a vendor API that returns a PSK or SIP secret in its payload does not pass it through to the client.
See also: Encryption at rest, Audit log
A per-user restriction limiting which sites an account can see and act on, applied underneath its role rather than instead of it.
In FreeSDN: Grants are enforced through a request-scoped context so deep service fan-outs do not have to thread the current user through every call. A user with no grants is unrestricted within their role; a user with grants is confined to them.
See also: RBAC, Multi-tenancy, Site
Authenticating against a central identity provider so accounts, joiners and leavers are managed in one place rather than per application.
In FreeSDN: OIDC and LDAP are supported, with SAML available. Role mapping is configured per provider.
An attack that makes a server fetch a URL of the attacker's choosing, typically to reach internal services or a cloud metadata endpoint the attacker cannot reach directly.
In FreeSDN: Any operator-supplied host is validated before a socket opens: hostnames are resolved first, loopback and link-local addresses are refused, and cloud metadata addresses are blocked. RFC1918 targets stay allowed, because on-premise gear lives there.
An appliance that records streams from IP cameras to local storage and serves playback, as opposed to a DVR which digitises analogue feeds.
In FreeSDN: NVRs are registered as controllers. Their channels, recordings and playback URLs are read through the camera adapters, and stream concurrency is pooled so one NVR is not overwhelmed.
See also: ONVIF, RTSP, Controller
A vendor-neutral standard for IP cameras covering discovery, streaming, PTZ control and events, letting one client speak to cameras from many manufacturers.
In FreeSDN: The ONVIF adapter is the fallback for cameras with no first-party integration, giving discovery, snapshots, streaming and PTZ where the camera implements the profile.
A camera whose orientation and zoom can be driven remotely, usually with named presets and sometimes patrol tours between them.
In FreeSDN: PTZ movement and presets are exposed per camera where the adapter supports them. A command the camera refuses is reported as a failure rather than an acknowledgement.
The control protocol used to negotiate and steer live media streams from cameras, typically carrying H.264 or H.265 video over RTP.
In FreeSDN: RTSP URLs are resolved per camera and can be restreamed for browser playback through the optional restreaming profile, so a browser never needs the camera credentials.
See also: ONVIF, NVR, Secret redaction
An external phone number routed to a specific internal destination, letting one trunk serve many published numbers.
In FreeSDN: DIDs and inbound routes are read from the PBX per system. Trunk writes are not supported by the FreePBX API and report 501 rather than pretending.
An internal endpoint on a phone system, comprising a number, its SIP credentials, a voicemail box, and the device registered to it.
In FreeSDN: Extensions are synced from the PBX and can be bound to a discovered phone, so the inventory shows which physical handset serves which extension.
See also: PBX, SIP, Zero-touch provisioning
The phone system that routes calls internally and to outside lines, now almost always software speaking SIP rather than dedicated switching hardware.
In FreeSDN: FreePBX is the supported PBX. Reads are mature across extensions, trunks, queues, IVRs, DIDs and call logs, while configuration writes depend on which API the PBX exposes.
See also: Extension, SIP trunk, DID, Zero-touch provisioning
The signalling protocol that sets up, changes and ends voice and video calls. It negotiates the session; the media itself travels over RTP.
In FreeSDN: SIP registration state is read per extension and per phone. SIP secrets are redacted on read and never returned in an API response.
See also: PBX, Extension, Secret redaction
A SIP connection to a telephony provider that carries calls to and from the public telephone network, replacing physical ISDN or analogue lines.
In FreeSDN: Trunks are read from the PBX with their registration state, and their credentials are redacted. Trunk creation and modification are not available through the FreePBX API.
Configuring a device automatically on first boot by having it fetch a config file keyed to its MAC address, instead of an operator entering settings by hand.
In FreeSDN: Grandstream phones fetch a generated config over the provisioning endpoint. A phone that refuses a config write is reported as refused, and the phone is rebooted afterwards so the new config actually takes effect.
Software that runs virtual machines on physical hardware, allocating CPU, memory, storage and network to each guest.
In FreeSDN: Proxmox VE is supported. Nodes, guests, storage and backup state are read live; write operations are staged and gated, and read-only monitoring is the default posture.
See also: Virtual machine, ZFS, Controller
A complete emulated computer running its own operating system on shared physical hardware, isolated from its neighbours.
In FreeSDN: QEMU guests and LXC containers are both inventoried, with node placement, resource usage and backup age. Clone, migrate and resize are staged operations.
See also: Hypervisor, Staged write
A combined filesystem and volume manager with checksummed data, copy-on-write snapshots, and pool-level redundancy that detects and repairs silent corruption.
In FreeSDN: TrueNAS pools, datasets, snapshots and capacity are read over the WebSocket JSON-RPC API. Pool capacity warnings surface as alerts.
See also: Hypervisor, Vault backup
The translation layer between one vendor's API and FreeSDN's normalised model, so the rest of the product does not know or care which vendor a device came from.
In FreeSDN: Thirteen adapters ship today. Each carries a maturity label split between reads and writes, and the label cannot claim live validation without a recorded cassette proving it.
See also: Controller, Maturity label, Staged write, Plugin SDK
Finding devices on a network automatically, by scanning address ranges, reading controller inventories, and listening to discovery protocols.
In FreeSDN: Scans are scoped to a site's subnets and can run from the core or from an edge agent. Discovered hosts are matched against known devices before being offered for adoption.
See also: Edge agent, Subnet, Topology, CIDR
A small program deployed inside a remote network that performs discovery and proxying locally, so the central system does not need a route to every device.
In FreeSDN: The agent is MIT-licensed and ships as a signed binary for Windows, Linux and macOS. It reports discovered hosts back to the controller and can bridge to devices with no route from the core.
A published statement of how well-proven a given integration is, kept separate for reading and for writing because the two carry very different risk.
In FreeSDN: Maturity is the project's defining discipline. Reads are proven against real hardware; no adapter currently claims live-validated writes, and a continuous-integration ratchet prevents anyone raising a label without recorded evidence.
See also: Adapter, Staged write
Being able to tell what a system is doing from the signals it emits, meaning metrics, logs and flow records, rather than by logging into each device.
In FreeSDN: The Observability module collects syslog, SNMP and NetFlow, correlates them against inventory, and stores time-series data in TimescaleDB.
A typed interface for extending a platform in-process, with a declared manifest of what the extension is allowed to touch.
In FreeSDN: The MIT-licensed Python SDK exposes device, alert, event and HTTP interfaces. Plugin permissions are declared in a manifest and enforced, including for tools exposed to the AI assistant.
See also: Adapter, Edge agent
A physical location in the hierarchy, such as a campus, branch or datacenter, owning its own subnets, devices and controllers.
In FreeSDN: Organization contains Site contains Device. Sites are the unit that per-user grants restrict, and the unit that discovery scans and analytics are scoped to.
See also: Site grant, Subnet, Multi-tenancy, Discovery
Recording an intended change, showing exactly what it will do, and applying it only on a separate explicit confirmation, rather than writing to hardware the moment a form is submitted.
In FreeSDN: Every device mutation flows through one staging chokepoint and is applied behind two gates: a platform-wide write flag, and a per-request confirmation. It is the single most important safety property in the product.
See also: Adapter, Audit log, Maturity label
A backup that includes secrets, sealed with a passphrase so the archive is useless without it, as distinct from a configuration-only export.
In FreeSDN: A .fsdn file carries configuration with no secrets. A .fsdnvault carries everything including the credential vault, passphrase-sealed and re-keyed on restore, and can rebuild an instance from a fresh install.
See also: Encryption at rest, ZFS
The live demo is the real interface with sample data, read-only and with no signup.