Network Config Visualizer
Drop in the configs you already have and the topology draws itself: every device becomes a node, every interface and VLAN hangs off it, and every IP subnet becomes a node of its own. Drop in several configs at once and the shared subnets connect them — which is how you find out what actually talks to what, without trusting a diagram someone drew two years ago.
Six vendors in one place: Mikrotik RouterOS (v6 and v7), Cisco IOS, IOS-XE and NX-OS, Fortinet FortiOS, Juniper JunOS in both syntaxes, VyOS, and Huawei VRP. A mixed-vendor network goes into one graph instead of six different converters.
Secrets are masked on screen before you share it. The parser never reads a password, PSK, or SNMP community in the first place — it only recognises the handful of directives listed below — but the config box still shows them, and that box ends up in screenshots. So they are replaced with dots there, with the key left visible so you know what was hidden.
Nothing is uploaded, and that is the point. A router config carries your addressing plan, your VLAN layout, and often a comment about which link is fragile — the kind of file a security team is right to refuse to paste into a stranger’s server. This one has no server to paste it into.
How to use it
- 01
Load the sample
The page opens with five devices already drawn across all four vendors — Mikrotik core and distribution, a Cisco access switch, a FortiGate firewall, and a Juniper edge router — wired together through shared transit subnets.
- 02
Drop your configs
One file per device, several at once, and they can be from different vendors. Or paste a config straight into the box. The parser auto-detects the vendor from syntax unique to each; override it if a trimmed-down file guesses wrong.
- 03
Read the graph
Click any node for its details: a device shows its interface list, an interface shows its addresses and VLAN, and a subnet shows every device attached to it. Export as PNG, SVG, or JSON when it looks right.
What it reads from your config
Only these directives are parsed — everything else in the file is ignored, so a full production export works without being trimmed first.
| Field | Required | Notes |
|---|---|---|
| /system identity | Optional | Mikrotik. Becomes the device name. Falls back to the filename when absent. |
| hostname | Optional | Cisco. Same role as /system identity. |
| /interface … | Yes | Mikrotik bridge, vlan, ethernet, wireless, bonding, and tunnel types. Renamed ports are followed through [ find default-name=… ]. |
| interface … | Yes | Cisco interface blocks, including description, shutdown, VLAN, and VRF lines inside them. |
| /ip address | Yes | Mikrotik. address=… interface=… — the prefix comes straight from the CIDR. |
| ip address A B | Yes | Cisco. The dotted mask is converted to a prefix; non-contiguous masks are rejected rather than guessed. |
| /interface bridge port | Optional | Mikrotik. The only place a .rsc states L2 membership, so bridge members are drawn as such. |
| config system interface | Yes | Fortinet. Each edit block becomes a port — including ports with no address, which is usually what you are looking for. Reads set ip, alias, vlanid, interface, status, type, and vdom. |
| interfaces { … } | Yes | Juniper, brace syntax. Addresses live on units, so ge-0/0/0.0 is the node — merging units into the parent would hide that they sit on different subnets. |
| set interfaces … | Yes | Juniper, "| display set" output. Same fields, flat syntax; the style is detected automatically. |
| set interfaces ethernet | Yes | VyOS. Values in single quotes are unwrapped, vif becomes eth0.100, and address dhcp is recorded without inventing an IP. |
| sysname / interface | Yes | Huawei VRP. Reads ip address in both forms — dotted mask and bare prefix (ip address 10.0.0.1 24). |
| show cdp/lldp neighbors | Optional | Optional. Paste the output alongside the config and devices get a direct dashed link. |
How it works
Links are inferred from shared subnets
A config file does not say what it is plugged into — that is runtime state. But two devices holding addresses in the same subnet can reach each other on it, and that is a fact the config alone proves. Each subnet becomes a node, and the devices attached to it hang off the same point.
Neighbour tables are optional, not required
If you paste `show cdp neighbors` or `show lldp neighbors` output along with the config, those links are drawn dashed — marked apart, because they come from the live device rather than from the file.
A high-level view, not just the raw dump
A core switch with 48 ports and 300 VLANs produces 649 nodes — accurate, unreadable, and heavy enough to stall a browser. The high-level switch drops interfaces and every subnet touching only one device, leaving the devices and the subnets that actually link them. That is the picture people draw by hand in Visio, except this one is derived from the configs rather than from memory.
Drag a node and it stays there
Dragging pins a node where you put it, marked with an amber ring. Without that, the physics engine drags it back a second later and the tool ends up fighting the person using it. Physics also switches itself off above 250 nodes, because at that size the simulation freezes the tab rather than merely slowing it.
SVG is rebuilt, not screenshotted
The graph is drawn on a canvas, which has no vector shapes to export. So the SVG button redraws the diagram from the final node coordinates instead: it scales without blurring and opens as editable objects in Figma or Illustrator.
Questions
- Is my router config uploaded anywhere?
- No. The CSV is parsed by JavaScript inside your browser tab and drawn straight to a canvas. There is no upload endpoint in this tool, so the file never reaches a server — mine or anyone else’s. You can confirm it yourself: open the Network tab, load a file, and watch that nothing leaves.
- Which vendors are supported?
- Six: Mikrotik RouterOS (both the v6 space syntax and the v7 slash syntax), Cisco IOS / IOS-XE / NX-OS, Fortinet FortiOS, Juniper JunOS in both its brace and "| display set" forms, VyOS, and Huawei VRP. Extensions do not matter — a .txt holding any of them is read the same way. Files from other vendors come back empty and the tool says so, rather than drawing a misleading half-diagram.
- Does it show my passwords and PSKs on screen?
- No. Passwords, pre-shared keys, SNMP communities, and $1$/$9$ hashes are replaced with dots in the config box, with the directive name left visible so you can see what was hidden. The parser never reads them regardless — it recognises only the directives listed above — so masking changes what is on your screen, never what is drawn.
- Can a security team verify the no-upload claim?
- Yes, in about ten seconds, and that is the only kind of privacy claim worth making. Open DevTools, go to the Network tab, then load a config: no request appears. Stronger still — save the page to disk and open it with your network cable unplugged. It keeps working, because there is nothing on the other end to call.
- Can it draw a topology from a single config?
- Yes, but it will only show that one device with its interfaces and subnets. The links between devices come from subnets two configs share, so drop in all of the configs you want to see connected.
- Why does my config show fewer interfaces than I expect?
- Interfaces are created from the directives listed above. A port that is never renamed, never bridged, and never given an address does not appear in a Mikrotik export at all — there is nothing in the file to read. Turn off "hide interfaces with no IP" to see everything that was found.
- Do I need an account?
- No account, no email, no trial limit. The tool is a static page; there is nothing to sign up to.