No. The connection map reads kernel socket tables via NETLINK_INET_DIAG and /proc on Linux, and works with or without eBPF. eBPF monitoring is a separate, complementary feature that adds deeper kernel-level network metrics.

The connection map (network-viewer.plugin) shows live TCP/UDP socket relationships between processes, containers, and endpoints. The SNMP device topology (snmp_topology) maps physical and logical relationships between network devices using protocols like LLDP, CDP, BGP, OSPF, and STP. Both share the same topology schema and render in the same dashboard.

The connection topology graph refreshes approximately every 5 seconds from live socket tables. The underlying socket table is available live, on demand.

No separate configuration is needed beyond setting up the SNMP collector. The topology engine automatically reads whatever devices the SNMP collector is already monitoring.

Yes. Connection actors are enriched with container names, Kubernetes pod names, namespaces, and workload labels on Linux. Grouping by container turns the connection map into a live service-dependency view for containerized workloads.

LLDP, CDP, OSPF, and BGP links represent confirmed adjacencies. Some links inferred from FDB and STP data are marked as probable. The map offers selectable confidence levels (lldp_cdp_managed, high_confidence_inferred, all_devices_low_confidence) so you always know what is confirmed versus inferred.

The SNMP topology view is fully tunable. Identify device nodes by management IP or by MAC / chassis ID; switch the map between managed LLDP/CDP, high-confidence inferred, and all-devices views; choose how unmanaged links are inferred (FDB minimum-knowledge, FDB pairwise, STP parent-tree, STP+FDB correlated, or CDP+FDB hybrid); focus on a specific device; and limit hop depth to isolate exactly the part of the network you need.

Netdata’s ML anomaly detection runs on all metrics across the platform, including network metrics associated with the devices and connections shown in the topology. The AI Co-Engineer and blast radius detection use this metric data to accelerate troubleshooting alongside the topology view.

Yes. Both topology engines emit the same shared schema (netdata.topology.v1), which Netdata Cloud or Netdata Parents aggregate into a fleet-wide unified map. This is the intended architecture for distributed visibility.