What changed, and when.

New

• Busy links show sooner on the map. A link now turns yellow at 50% of the port speed, amber at 60% and red at 80% (was amber at 70%, red at 90%), on the Map and the dashboard mini-map alike. The moving dots speed up at the same points, the Map legend shows the colour key, and the colour follows the 30-second average, so a short spike does not flash it. With Turn off animations the dots stay still but the colours still change.
• Linux packages. .deb for Ubuntu and Debian, .rpm for RHEL, AlmaLinux, Rocky and Fedora, for amd64 and arm64. Installing one sets up the service, its own account and a private data folder, and starts it; upgrading restarts it on the new version with your data; removing keeps your data unless you purge it.
• Device diagnostics: help us support your switch. Devices › Troubleshoot › Device diagnostics (admins only) logs in to one device and runs only the read-only commands in its command pack; a device NetRiva has no pack for gets a short probe of at most four fixed version commands (such as show version). Passwords, secrets, SNMP communities, keys, hashes, certificates and email addresses are removed, and host names, addresses and user names too unless you untick them. You see the whole result first. Save to file sends nothing; Send to NetRiva support uploads exactly that text, with an optional note and email, to api.net-riva.com. Nothing is sent unless you press Send.
• Config backups, on screen. Settings › Backup › Config backups lists every stored configuration per device, with when it last changed and was last checked (a failing backup shows in red with the reason). View one, compare any two, or restore one: the plan shows exactly what would change and every command it will send, and Apply asks you to type the device name. A restore goes in one line at a time, stops at the first line the switch rejects, never saves to startup after a failure, and reads the configuration back afterwards. Restore is offered for Cisco IOS / IOS XE and Arista EOS (and Aruba / HP chosen as Backup / console type); other devices say why not. Read-only accounts see the list of versions, not the configurations.
• NetRiva works out what each device is. It combines the SNMP identity, what neighbouring switches report, the SSH banner and, with an SSH login saved, up to four harmless version commands to find the make, OS, version and model. It runs when you save a login or add a device with SNMP, when you press Detect now, and once a day in the background (one device every five minutes, never against a device that is down, never again with a refused password until you change it). A weaker overnight result never replaces a stronger one, and the daily check skips the login when you chose the Make / OS yourself. It can be switched off in Settings › Device logins.
• Make / OS in the device editor and in Device logins. The field shows what was detected and how sure NetRiva is (“Auto (detected: Cisco IOS XE 17.9 — from login: show version, high)”), with a Detect now button. You can pick the make and OS yourself; your choice always wins, with a warning if a confident detection disagrees. The old “Vendor / OS” field is now “Backup / console type” and, left blank, follows the Make / OS. A device that was never detected shows as Unknown, not Cisco IOS.
• AI command packs for 17 device families. The assistant works from a read-only command pack per family: Cisco IOS and IOS XE, Arista EOS, MikroTik RouterOS 7, Dell OS6 and OS10, Huawei VRP, Extreme ExtremeXOS, TP-Link JetStream, NETGEAR, D-Link (DES/DGS-3000-style and DGS-1510/3130-style), Zyxel, Ubiquiti EdgeSwitch, Ubiquiti UniFi switches, pfSense and OPNsense. It lists what the device supports, runs a recipe such as a health check or a port diagnosis in one login, or runs one pack command. It picks the pack from your Make / OS or the detected family, and asks you to press Detect now rather than guess. Packs are marked as not yet checked on every model. A device set to the old “D-Link” choice needs its Make / OS picked again.
• The AI only uses commands the vendor documents as display commands. Every pack command carries the vendor’s own description; a pack that names an action such as configure, clear, reset, reload or save is rejected as a whole. Free-typed commands are off by default: “Allow free-typed read commands” in Settings › Device logins turns them on per device, and a fixed list of dangerous commands (configure, write, copy, reload, clear, debug, shells and their abbreviations) is refused whatever the setting.
• The assistant can look at a switch, and cannot change one unless you let it. With a login stored and access switched on for that device, the AI can run commands such as show interface instead of guessing from ping times. Access is off until you turn it on, per device, and read-only unless you untick that too. Read-only is enforced in NetRiva itself: configuration mode, shell escapes and chained commands are refused before anything reaches the device. Settings shows how to create a read-only account on Cisco, Juniper, MikroTik, Aruba and HPE equipment.
• The assistant can investigate problems on its own. Tick a box and, when a device goes down or a problem starts, the AI looks into it once and attaches what it found to the alarm. It can only look, runs only show-type commands from the pack on devices whose login you have shared, is off by default and has limits per hour and per day. Every instruction the assistant receives can be read and edited in Settings › AI Assistant; instructions cannot give it permission to change devices.
• Controllers & APIs (read-only). A new Settings tab connects NetRiva to a UniFi Network application (API key preferred, or a local read-only user), and to MikroTik RouterOS 7 (REST) and Arista (eAPI) devices. NetRiva sends only fixed read requests (devices, firmware, uptime, uplinks, ports with link, speed, PoE and errors, clients and events) and matches them to your devices by IP, MAC and name. Certificates are verified by default; you can pin one or, explicitly, allow a self-signed one. The AI can use a connection through api_query once you tick “Let the AI use this”.
• SNMPv3. Everywhere NetRiva used SNMP (Discover, interface and bandwidth polling, CPU/memory/disk, the SNMP test tool) it can now use v3: authentication MD5 or SHA up to SHA-512, privacy DES or AES-128/192/256 (including Cisco’s AES-192C/256C). Choose it in the Discover prompt or under Non-standard SNMP on a device. Passphrases are stored with your other logins and never shown again or sent to the browser or the AI. Setups with just a community keep working as v2c. The UniFi SNMP guide in Help gives the current menu path.
• Auto link. Map › Edit map › Auto link logs in once to each switch with a saved login (Cisco IOS, IOS XE, Arista EOS), reads LLDP/CDP neighbours and the ARP and MAC tables, and proposes the lines with their ports. Nothing is drawn until you tick it, and only read-only show commands are sent, only when you press the button.
• Suggest connections. In Edit map, NetRiva asks your switches, router and firewall over SNMP which device sits on which port (LLDP and CDP neighbours, forwarding tables, ARP) and proposes the links with their ports and a reason for each. Ports can be picked from a list of the device’s interfaces and changed on an existing link without redrawing it, and a connection can be drawn by pulling a line from one device to another.
• Live traffic on the map. Links show moving traffic in the direction it flows, faster the busier the link, at one of five speeds: teal normally, amber from 70% of the port speed, red from 90%. It needs the port on at least one end, which discovered links have and hand-drawn links can be given, and Bandwidth ticked on that device. Turn it off with the Traffic button.
• A fuller label on every link. Two lines: the link’s name and the traffic each way with utilisation, then port speed, duplex, round-trip time and, if you want them, errors, port uptime and PoE draw. Choose for each item whether it shows always, on hover or never, for all links under Settings › Notifications › Noise control or for one link in its settings. Errors above a threshold you set make the label pulse red. Figures a device does not report are left out.
• Live traffic on the dashboard mini-map. The mini-map shows the same moving dots, colours and labels as the Map (“⇅ 218/163 kb/s · 0.02%”, with port speed and latency underneath) wherever they fit, busiest links first. Links set to no animation or no label on the map stay that way here.
• A map that shows what is happening. A device flashes green when it comes back; when it goes down, the link to it turns red with a slow moving dash. Device frames fade to their new colour, pulse gently while down (more softly once acknowledged, not at all when muted), and blink a small dot each time a check gets an answer. A link grows thicker as latency gets worse, and the Up, Lossy and Down counts roll like an odometer. All of it stands still with “Turn off animations” (below) or when your system is set to reduce motion.
• Turn off animations. Settings › General has a new “Turn off animations” box for everyone who prefers a still screen: nothing on any page moves, fades or blinks (the down-device pulse, the recovery flash, the moving traffic dots, the rolling numbers, the alarm-path dashes, hover fades). It applies to every user and browser of the instance, takes effect at once in every open tab, and pages are drawn still from the very first moment. States are still shown by colour and text. A computer set to reduce motion in its own accessibility settings gets the same, whether the box is ticked or not.
• A device card on the map. Pointing at a device on the Map or the mini-map shows its status, latency and loss with a short graph, how long it has been up or down (kept across restarts), its type, Make / OS and tags, and the traffic on each of its links. Click to open it on the Devices page; on a touch screen, tap once for the card and again to open it.
• Names, tags and settings for every link. A cog on each link sets which port each end uses, colour, dashed or solid, width, animation and label. Links can have names, and devices and links can have tags: filter the Devices page, highlight a tag on the map, filter the Event log, Active alarms, Latency and Reliability widgets by tag, and silence interface warnings for a tag. The assistant sees names and tags too.
• Zoom and pan on the map. Pinch and drag on a touch screen, or the mouse wheel and drag, plus +, − and Fit buttons. The legend folds away and the hint can be dismissed.
• Phones and tablets. On a phone the header is one slim bar with the page name, the bell and a Menu button; on larger screens it fits on one row from 1200 pixels wide. Dialogs fit the screen, controls are big enough to tap, Delete on a touch screen is inside the edit dialog, nothing that showed only on hover is out of reach, and form fields no longer make an iPhone zoom in.
• A dashboard that fits your screen. On a new install the widgets fill the window in as many columns as fit. Once you move a widget, nothing else moves; dropping one on another pushes that one straight down. “Reset layout” returns to the automatic arrangement. A layout made on a wide monitor is shown in fitting columns on a smaller screen, without changing it.
• A friendlier first start. A new install opens with an “Add a device” / “Scan a network” card, every empty widget says what to do next, and the Map and mini-map show an example office floor plan with 15 devices, clearly labelled as an example, until you add your own.
• Scan network. Type any subnet to scan, including another VLAN or a site over a VPN. A Found by column says whether a device answered ping, ARP or both, uptime has its own column, suggested names come from DNS first, VMware machines are no longer guessed as access points, and there is a UPS role. Silent addresses get a second, slower try, so scans give the same result each time.
• Desktop notifications. With a NetRiva tab open, a device going down or coming back, a configuration change, a new unknown device, a failing service check, a proposal waiting for approval or a new version can pop up on your screen. Choose which in Settings › Notifications and switch them on once per computer.
• Fewer, better notifications. A lasting problem is announced once when it starts and once when it clears. A device has to stay down for a minute before anyone is told, a device that keeps dropping in and out sends one “flapping” notice, and interface error warnings have their own threshold and are off by default.
• Do not disturb. From the bell on any page: silence pop-ups, the siren and, if you like, email, ntfy and webhooks for an hour, four hours, until morning or until you switch it back. Everything is still recorded, and you get one summary when it ends.
• Update now. When a newer signed release is out, Settings › Updates shows its version, size and release notes, and admins get an Update now button next to Check now. It asks first (from which version to which, and that your data is kept), then downloads with a progress bar, checks the download against the signed release and only then installs: a Windows service install runs the new installer silently with the same choices and restarts the service; a portable copy replaces its program and restarts. If anything fails (no connection, a bad signature, a download that does not match, a full disk) nothing is changed and the old version keeps running; a new version that does not stay up is replaced by the previous one automatically. Every step is in the event log. Linux services and .deb/.rpm installs show the commands to run instead. Nothing is ever installed without the click.
• You are told when a new version is out. The dashboard shows a small banner and the bell gets an entry, once per version; tick a box in Settings › Updates to send it to your notification channels as well.
• Add devices by host name, and devices that do not answer ping. A name is looked up again every few minutes, so a device that moves is followed, and a name that will not resolve shows as a monitoring fault, not the device being down. A device that ignores ping can be checked with a TCP connection to a port you choose, or not polled at all and kept only for its configuration backups (shown in blue).
• You stay signed in through a restart or update. Sign-ins are kept on the machine (without the sign-in codes themselves) and still end after 30 days, when you sign out, or when a user is demoted or deleted. The first update to this version signs everyone in once.
• A better-looking Windows installer. Setup opens on a NetRiva welcome page that says what is being installed, shows the NetRiva logo on every page, and draws its pictures sharply at every display scale from 100% to 250%. The uninstaller carries the same look. Setup’s file properties now name the product, version and publisher, and Apps & features links to the website, the documentation and the download page.
• Choose how dates and times are shown in the new General tab: ISO, day first, month first or written out, 24- or 12-hour, on every page.

Vendors

• pfSense and OPNsense. Detect names the firewall and its version (for example pfSense 2.7.2-RELEASE, OPNsense 26.7), also from SNMP; config backup stores the whole config.xml and shows when it changed; the AI and Device diagnostics can read interfaces, routes, ARP, the packet filter’s status, rules and NAT, load, disks and the system log. NetRiva never types into the console menu: it reads over SSH exec, and only a fixed list of read-only commands can be sent, exactly as written. A login that lands in the menu is recognised in under a second instead of after 45. Passwords, keys, certificates, pre-shared keys, API keys and SNMP communities in config.xml are removed before anything reaches the AI or a diagnostics report; the stored backup keeps them. Restore is not offered. Log in as admin (pfSense) or root (OPNsense).
• Cisco switches that need enable work everywhere. Detect, Console Feed, the live switch log, config backup and the AI log in, send enable with the enable password you save (or the login password if you save none), then read. Detect does the same on NETGEAR, Ubiquiti EdgeSwitch and Dell OS6 when show version is refused at the > prompt, and says when an enable secret is missing or refused. Console Feed no longer fails with “unexpected packet in response to channel open”.
• No enable to devices that have none. NetRiva never sends enable to a MikroTik, Huawei/H3C, Junos, ExtremeXOS or other non-Cisco prompt, where it broke the session, and recognises the prompts of Huawei, MikroTik, Dell, Zyxel, D-Link, TP-Link and NETGEAR switches, so answers no longer hang or cut off.
• MikroTik RouterOS: Detect, device commands and the AI log in again. RouterOS asks the terminal about itself before showing a prompt, so Detect timed out after 45 seconds. NetRiva now logs in as user+ct511w (MikroTik’s options for no colours, no terminal detection and a wide terminal); a login name that already has options after a + is used as typed. Found in NetRiva’s new virtual device lab.
• Dell OS10: a refused command no longer hangs for 30 seconds. OS10 rings the terminal bell in front of its prompt after an error, which NetRiva did not see as a prompt; the device’s own error now comes back at once.
• ExtremeXOS: the model without SNMP, and cleaner answers. Detect also reads show switch when SNMP has not named the model (still at most four commands), “%% Invalid …” replies are recognised as errors, and the counting prompt (X465.2 #) no longer ends every output the AI reads or makes every backup look like a change.
• More switches detected without SNMP. Ubiquiti EdgeSwitch is no longer taken for NETGEAR and its model is read (for example ES-48-500W); older D-Link (DES/DGS-3000-style) is read past the first page of show switch; Dell N-series (OS6) takes its version from the image table; TP-Link JetStream answers show system-info; Huawei switches branded Quidway show their model (for example S7706). Detection now sends at most four version commands.
• The right backup command per vendor. Huawei VRP gets display current-configuration, ExtremeXOS show configuration and the D-Link DGS-3000 family show config current_config, as their manuals give, once Detect or Make / OS has named the switch; it used to be show running-config for all.
• Backups no longer hang on “More” pages. NETGEAR gets 48-line pages (it refuses terminal length 0), Zyxel and Huawei VRP have their pager answered, and the pager text and the blanks the switch writes over it are removed. A backup that does not finish gives up with a clear failure after 30 seconds or 256 KB.
• UniFi switches are not logged in to for a backup. Their configuration lives in the UniFi controller, and the message says to back up the controller.
• Command pack versions. The Dell OS6, ExtremeXOS, Huawei VRP, NETGEAR and Ubiquiti EdgeSwitch command packs, changed by the detection and error-handling fixes above, are now version 2026.10.2; the new pfSense and OPNsense packs start at 2026.10.1. Device diagnostics reports name the pack version.
• Better brand detection by SNMP. Juniper was shown as Ubiquiti, and Aruba, Aerohive and TP-Link were wrong or missing; the vendor list now matches the official IANA registry. A blank Vendor no longer implies Cisco once detection has found nothing.

Fixed

• The portable zip keeps everything in its own folder. Settings, logins, keys, history and logs go in the data folder next to netriva.exe, locked to your account, instead of %ProgramData%\NetRiva. Delete the folder to remove it, move it to another drive or PC and it keeps working, replace netriva.exe to update. It never touches an installed NetRiva’s data, stops with a clear message in a folder it cannot write to, and refuses to be installed as a service (use the installer).
• Re-adding a device you already monitor at a full licence now says the device may already exist instead of asking you to move up a tier, and a batch that is mostly devices you already have is no longer refused when the new ones fit.
• Event floods are counted correctly. When the alarm watcher or notifier falls far behind, the safety limit on events held for it is no longer doubled, and the service log says it caught up only once it really has.
• Linux installs work as the docs say. In the archive, netriva is now executable and owned by root. The install and service steps were tested in fresh Ubuntu, Debian and AlmaLinux machines and corrected: the first run no longer stops with permission denied, the service steps put the binary in place, and the docs now cover reaching the service from your network, upgrading and uninstalling.
• Ping works on Ubuntu and Debian. They switch off unprivileged ping, so every device showed as down. NetRiva now falls back to a raw socket when it has the capability (the service has it), and when it has neither it says so at start, in the event log, with the one command that fixes it.
• Your data folder stays private on Linux. NetRiva makes its data folder readable by its own account only each time it starts, as it already did on Windows; a folder made with the old instructions was readable by every account on the machine.
• The in-app update says how to upgrade a Linux service. Under systemd it can't (and shouldn't) replace its own program, so instead of failing half-way it shows the three commands that do it.
• A device is identified as soon as you save its login. Adding a device starts a detection straight away, before it has an SSH login; saving the login a minute later was ignored as “just checked”, so the device stayed “Not identified” until the next day’s re-check or a press of Detect now. A new or changed login now always leads to a detection that uses it.
• Dashboard: a widget dragged to the right edge stops there. It could be left hanging over the edge, after which the dashboard said it was “arranged on a wider screen” and would not let you move or resize anything in that same window.
• Saving a layout no longer fails now and then. Dragging on the dashboard or the map saves several times in a row; two saves at once could collide and one was lost with an error. Layouts, drawn links, background images and alarm sounds are now written the same safe way as the settings.
• Several NetRiva tabs share one live connection on plain http too. Tabs hand one event stream around so a handful of open tabs cannot use up the browser’s connections and stall the pages; that only worked on https or on the computer NetRiva runs on. Opened by its network address, every tab opened its own again. It now works however you open NetRiva.
• Console Feed lists Ethernet ports. A Cisco switch whose ports are called Ethernet (Et0/1) showed “0 port(s)”; every Cisco port name is now recognised, with its neighbour from CDP.
• The live switch log only logs in to Cisco switches. It speaks Cisco (terminal monitor), but a switch whose Backup / console type was blank was streamed even when Detect had named it ExtremeXOS, Dell OS10, Huawei or another make: NetRiva sent it Cisco commands (and enable to Huawei), and ExtremeXOS’s numbered prompt showed up in the Console Feed as messages. Such switches are now left alone.
• Read-only accounts: no more refused requests behind the scenes. Settings asked for the AI instructions and the Map tried to save its layout, both of which a read-only account may not do; the pages now leave them alone.
• Settings › Users: no Remove or role switch on your own account, so you cannot end your own session half-way through by accident. Another admin can still do it.
• Screen readers: the date and time format lists and the password fields in Settings now have proper labels.
• Map: two cables between the same two devices are two links. Discover, Auto link and the map kept one link per pair of devices, so a second uplink disappeared and could even lend its “confirmed” to the other. Each cable is now its own link, with its own ports, drawn side by side on the map and the dashboard mini-map, with its own live traffic. A link you draw by hand on other ports is another cable; one on the same ports as a discovered link is that link.
• Map: discovered links are still there after a restart. The links Discover found were kept in memory only, so after a restart (or simply reopening the Map) only hand-drawn links showed until someone pressed Discover again. They are now saved and shown at once. A cable a device no longer reports disappears at the next Discover; a link whose devices could not be asked (switched off, unreachable) stays, drawn faint, with when it was last seen, for up to 30 days.
• Map: a Cisco router is drawn as a router. Every Cisco IOS device was drawn as a switch. NetRiva now also reads what the device announces over LLDP and CDP (router, switch, phone, access point), so an IOS router gets the router icon while a layer-3 switch stays a switch.
• Map: a device you named yourself gets its links. Neighbours report a device by the name it gives itself (its LLDP / CDP name), and the map only matched that against the name in NetRiva. A device added by its IP address or as “Edge router” showed up twice: once with no links, and once as an unmonitored neighbour carrying all of them. Discover and Auto link now also match the device’s own name (SNMP sysName) and its address. A link is now marked as confirmed only when both of its devices report it, and a Cisco switch that runs LLDP and CDP no longer reports each neighbour twice, so a CDP entry left over from a neighbour’s old name no longer draws a ghost device. Found in NetRiva’s new multi-device lab.
• The installer asks for realistic disk space. The folder page now counts room for your data (config backups, vendor list, logs) as well as the program, about 115 MB in all, instead of only the program file.
• The Windows service log no longer grows for ever. service.log is capped at 10 MB; older lines move to service.log.1 to .4, so it never takes more than 50 MB.
• After updating, open the map once. If devices look to be in different places, press Save layout once. Positions you saved in a different window size are now scaled to fit the window you are in, and Save layout stores them for this one.
• Config backup no longer stores an error message as the configuration. A switch’s refusal (“Error: Unrecognized command”, a list of available commands, “not found”) used to be saved as a new version. Anything that does not look like a configuration is now a failed backup, shown in red with the reason, and the versions you have are left alone.
• Restore is only offered where NetRiva can restore. The Plan restore button followed the Backup / console type field, so a switch with that field blank was offered a Cisco-style restore (which then failed safely). It now follows the Make / OS, and the server refuses a plan for any other device before it connects.
• Long model names are shown in full. Models keep commas and up to 128 characters (a MikroTik CHR showed as “CHR QEMU Standard PC (i440FX + PIIX 1996”), and the scan’s Model column shows the whole text in its tooltip.
• Your AI key and logins are kept. Uninstalling asks whether to delete your NetRiva data, and keeps it by default; it used to delete everything. Every save keeps the previous credentials file and restores it if the file goes missing, only “Clear stored key” removes an AI key, and an unreadable credentials file says so instead of looking as if no key was saved.
• NetRiva always starts. A config naming an AI provider this version does not have turns the AI off with a clear message; the whole service used to refuse to start.
• Clearer AI. The AI page says what is actually set up (no provider, ready, no key, or a key NetRiva cannot read), and when the AI cannot use a device it says what to do next.
• Quieter switch logs. AI commands to the same device a few seconds apart share one login, the live switch log stays connected past the switch’s idle timeout, and a login that keeps failing is retried less and less often (up to every 30 minutes).
• Saving device logins works as it says. Saving only an enable password keeps the stored password (it failed silently), the AI tick boxes save as soon as you change them, and the saved SSH port is shown and kept.
• Switches that log in through TACACS+, RADIUS or AAA now connect. The stored password is also offered as “keyboard-interactive”, which many of them require; it used to look exactly like a wrong password.
• Long device output is cut off cleanly. One command returns at most 256 KB and says when it was cut, and a device that stops answering is given up on after 30 seconds.
• The map after a restart. Moving traffic dots come back by themselves once the first figures are in, and the first reading is “not measured yet”, not “0 b/s”.
• Links show their status even without traffic figures. A link to a device that is up but has no figures is solid teal instead of grey, its label shows “—” instead of a false “0 b/s”, and only the link to a down device turns red; healthy links further along keep their colour, dots and label.
• One guessed port, one link. A guessed port’s traffic could be drawn on several links at once; now those links say “Port unknown” (and whether the port belongs to another link) until you pick the port. A port you named always keeps its traffic.
• Links stay in sync. An open map picks up links drawn, edited or removed in another browser within a few seconds, except while you are editing.
• The map keeps what you drew. Joining two devices that were already joined, or adding a suggested link for them, no longer repaints the link grey and resets its settings. Device names are no longer cut off in map badges, traffic appears within seconds, and the link cog stays put while you move to it.
• Traffic figures from Windows PCs, printers and small switches. Devices with only 32-bit counters showed 0 Mb/s; they now show real figures. Windows’ virtual adapters are hidden and no longer raise interface warnings, and a link with no port uses the device’s only (or busiest) active connection.
• Settings take effect when you save them, and save what you set. Syslog, notifications, rogue-device detection, configuration backup and update checks no longer need a restart. Rogue-device and config backup settings were dropped on every save, a saved syslog receiver was switched off by the next save, and an empty mail password field cleared the stored one; all fixed.
• Alerts you set up are sent, and alarms clear when they should. Notifications configured after start-up were not sent until a restart, interface warnings could become a “down” alarm that never cleared, service-check alarms stayed after recovery, a switch reboot produced impossible traffic figures, and a hanging mail server held up other notifications.
• Fewer false alarms. A device is Degraded from 5% packet loss (it was any loss; change it in Settings › General), and a device checked by TCP goes Down after about two and a half minutes of failures, not the first one.
• Muted means muted. A muted device shows its real colour but raises no alarm and sends no notification, and the “all devices up” health check names it without failing.
• A problem on the monitoring machine no longer looks like your network going down. If NetRiva could not send pings at all, every device turned Down; a check that could not be made never marks a device Down now, and just after a restart a device shows Unknown until there is enough to judge.
• The dashboard tells you when it loses contact with the service, with a red bar and when the figures were last updated, and pages where you were editing no longer jump to the sign-in screen.
• Interface traffic is only polled for devices with Bandwidth ticked. Devices that could already show traffic were ticked for you on upgrade.
• Configuration backups of similarly named devices no longer mix. “SW 1” and “SW_1” shared one history; each device now has its own, and an already-mixed history is kept aside in a legacy-… folder. A restore is refused if the switch changed since it was planned.
• Syslog is filed on this machine’s clock, so a device in another timezone no longer has its messages filed hours in the future, and old files are removed by the day they arrived.
• Checking a device on port 22 no longer fills its log. TCP checks run at most every 30 seconds (it was about 25,000 log lines a day per device).
• Opening the map no longer undoes your SNMP settings.
• Your licence shows the date you have paid to, not the five-week lifetime of a renewal token.
• After an update, your browser gets the new pages instead of stale ones from its cache.
• Many open tabs no longer stall. All NetRiva tabs in a browser share one live connection; Settings and the Event log behave in a new tab; the Start menu entry is simply “NetRiva”, with its icon.
• Smaller fixes. Editing one device shows its own category; notification channels no longer say “restart needed”; the map logs no error without a floor plan; sortable tables work from the keyboard; server errors are shown as text instead of “Unexpected token”; a damaged rogue-device list no longer stops the service; the dashboard console widget is no longer blank after visiting another page; the map no longer covers the assistant’s answer; command output shows as the switch printed it; the read-only account help can be closed; the help page says correctly that passwords are kept in credentials.yaml.

Security

• New passwords need at least 8 characters. The first-run password change, adding a user, resetting one and changing your own all accepted a one-letter password. Passwords you already have keep working.
• Signing in only ever takes you to a NetRiva page. A sign-in link with ?next= pointing at another website sent you there after you signed in; it now goes to the dashboard instead.
• An independent review of the whole product — the app, the licence service and the website — was fixed in this release. The changes you can notice are below and under Fixed; the rest you should never see.
• Another website could take control of NetRiva through your browser. A page you visited could reach the dashboard on your network and, while the default password was in use, act as you. NetRiva now answers only on its own address or this machine’s name and refuses requests from other sites. If you reach it by a name it does not recognise, add that name to allowed_hosts in config.yaml.
• The default password has to be changed. Signing in with admin/admin asks for a new password first, repeated wrong passwords are slowed down, and demoting or deleting a user signs them out everywhere.
• Connections to your switches check who is answering. The first SSH connection records the device’s key and every later one checks it; if it changes, NetRiva refuses to connect and says why. SSH keys work as well as passwords.
• Passwords never go to the AI. Anything a device prints that looks like a password, secret, SNMP community (including one quoted in a MikroTik log line or saved by ExtremeXOS), pre-shared key or private key is replaced with “<redacted>” before the AI or a diagnostics report sees it.
• AI permissions are no longer reset by other login forms. Saving a login from the Console Msg page or “apply to all devices” switched it from read-only to “may configure” for the AI; both now keep the current setting, and a save that does not say otherwise is read-only.
• Browsers no longer fill your NetRiva login into device fields. A saved NetRiva password could land in a switch’s SSH password field and be stored as its login; device, SNMP, email and API credential fields are now marked so password managers leave them alone.
• Read-only accounts see less. They no longer receive SNMP communities, saved switch configurations or the exact commands the assistant proposed.
• Your data is no longer open to every account on the PC. The installer used to give all local users write access to the data folder, and the settings file and saved configurations were readable by any local user; NetRiva now locks them down. Deleting a device also removes its stored login.
• Syslog is matched to devices by the address it comes from, not the name the sender claims, so a spoofed message cannot be blamed on one of your switches.
• Updates are safer. The update information is signed with its release date and an expiry date, an update can never move you to an older version, and if a new version will not start, the previous one is put back.
• What this version sends has not changed, but two defaults have. The daily update check, and the anonymous install count that travels with it, are on for new installs: a random install ID, the version, the platform and whether the install is on a trial or a licence, and nothing about your network. If you switched either off, it stays off. The check now asks api.net-riva.com, which counts it and sends you on to the signed release file. Switch it off in Settings › Updates; the privacy page has the detail, including Device diagnostics, which sends only what you review and send yourself.

• Your mail server’s password could be sent unencrypted. The setting that chose encryption had only two positions, and the off position meant “encrypt if the server offers it” — if it did not, AI NetRiva carried on and sent your username and password in readable form, without saying so. You now choose explicitly between STARTTLS, TLS, and none, and STARTTLS refuses to send rather than quietly falling back. Existing setups keep working exactly as they did; nothing changes until you pick a setting.
• Mail server presets for Microsoft 365, Gmail and Google Workspace, SendGrid, Mailgun and Amazon SES. Each fills in the server, port and encryption, and tells you the one credential detail that provider gets asked about most — SendGrid wants the literal word “apikey” as the username, Amazon SES needs SMTP credentials rather than an AWS key, Microsoft 365 needs SMTP AUTH switched on for the mailbox.
• Back up and restore your own configuration. Settings, Backup. Downloads a plain zip holding your devices, thresholds, notification settings, map and dashboard layout and any floor plan or alarm sound you uploaded — enough to rebuild this install on another machine. Stored credentials are left out unless you tick the box. Restoring keeps a copy of everything it replaces, so a wrong file is not the end of it. The old “Config backup” tab, which saves the configs of the switches you monitor, is now called “Monitored devices’ configs” — it does the same as before.
• Notes on devices, and a way to delete them. Write anything worth remembering against a device — which cabinet it is in, who owns it, who to ring before power-cycling it. Devices can now be deleted, one at a time or several at once, which was previously only possible by hand-editing the configuration file.
• Three layouts on the Devices page. Cards as before, plus List and Table for sites with more devices than fit on a screen. Your choice is remembered.
• Passwords now have a confirmation box everywhere they are set: your own, a new user’s, and when an administrator resets someone else’s. A mistyped password used to lock the person out with no warning. Users can also have an email address recorded against them.
• Deleting a device could silence its neighbours. If other devices were set to depend on the deleted one, they kept pointing at something that no longer existed, and AI NetRiva read that as “their upstream is down” — so it stopped alerting on them. Affected 1.0.0 onwards, but only if you removed a device by editing the configuration file, which was the only way to do it before this release.
• Saving mail settings and then reloading the page showed an empty form, as though the save had been thrown away. It had not been, but there was no way to tell.

• “Check for updates” now actually checks. The button reported “up to date” whatever the release server said — it reused a result cached when the app started, then read the answer from the wrong fields. Both fixed. On 1.0.0–1.0.3 that button will keep telling you the same thing until you install this build: the fault is in the older program, not the server.

• The Windows service could not start on any machine where AI NetRiva had been run by hand first. The credentials file is locked to its owner, which also locked out the system account the service runs under; it failed at startup and Windows retried until it gave up. The service showed as installed and monitored nothing. It now grants the system account access as well — ordinary users still have none.

• Run as a Windows service, offered by the installer and ticked by default. A monitor that only runs while you are logged in is not monitoring. Uninstalling removes the service cleanly.
• Service status in Settings → Updates — whether it is installed, running, and starting at boot, with the exact command to change it.
• Update checking works on a fresh install. The release source had no default, so new installs had checking silently switched off.

• Somewhere to enter your licence. Settings → Licence. The program accepted licences all along but had no screen to paste one into, so a purchase could not be activated.
• Update checking became possible at all. 1.0.0 shipped with a verification key whose counterpart had never been created, so no release could ever have satisfied it. 1.0.0 installs cannot update themselves and must be replaced by hand.

First public release — the build that had been running in production for a year, made generally available.

• ICMP polling with latency history, subnet discovery, the topology map, SNMP interface and host metrics.
• Syslog receiver with retention, SSH console capture, configuration backup with diffs and restore.
• Service and port monitoring — HTTP status and content, TCP ports, TLS certificate expiry. The step from “is it pingable” to “is it working”.
• Alarms with acknowledgement and escalation, multi-user accounts, and the AI assistant.
• Device-type icons and OS indicators inferred from vendor, model and SNMP sysDescr, with a manual override when the guess is wrong.
• Troubleshooting tools in the browser — ping, traceroute, port check, DNS lookup, SNMP walk — and a one-click diagnostic bundle, redacted before you see it.