Uplivra horizontal light
How the server, collectors and MSP routers connect
September 2026

Uplivra architecture

Every traffic path, port and direction. Arrows point the way each connection is opened. The SVG files are in the diagrams folder for slides and proposals.

In short: collectors only connect out on HTTPS 443. Devices send logs, traps and flows to a collector on your network. The server's only internet connections are out: monthly license check-in (counts only), alerts you turn on, and cloud APIs you connect.

One site: what talks to what

The Uplivra server (with its built-in collector) on your network: what it asks devices, what devices send it, and the few connections it makes out to the internet.

One site: what talks to what The Uplivra server runs on your network with its own collector. Arrows point the way each connection is opened. YOUR NETWORK INTERNET Your firewall: nothing needs to come in from the internet Devices you monitor Routers and firewalls SNMP, NetFlow, syslog Switches ports, LLDP/CDP, traps Servers and VMs Windows, Linux, services Wi-Fi and APs controllers, clients Printers and UPSs toner, battery, runtime Websites and apps HTTPS, certificates Uplivra server Web interface, database, alerts Built-in collector for this site Your data stays here Monitoring Logs Flows AI Your team Browsers and phones Internal DNS server Names for IP addresses (PTR records) Uplivra asks: ping, SNMP UDP 161, TCP and web checks Devices send: syslog 514, traps 162, flows 2055 / 6343 HTTPS 443 DNS UDP 53 licensing.uplivra.com Monthly check-in: counts only Signed updates Alerts Email, Teams, Slack, PagerDuty, webhooks Cloud accounts AWS, Azure, Microsoft 365 read-only APIs Out only: HTTPS 443 (email alerts: SMTP 587) KEY Uplivra asks devices Devices send to Uplivra People Name lookups Out to the internet

Many sites: collectors connect out

Collectors at branches, data centers and cloud networks connect out to the server on HTTPS 443. Nothing connects in to a branch.

Many sites: collectors connect out Put a collector at each site. It checks local devices and reports to the server over one outbound HTTPS connection. HEAD OFFICE Uplivra server Web interface, alerts, reports Receives every collector on HTTPS 443 Your team Browsers, phones, wall screen HTTPS 443 Head office devices Checked by the server's built-in collector SNMP, ping, checks Head office firewall: allow TCP 443 in to the server only BRANCH OFFICE Collector Behind NAT, dynamic IP is fine Management page (optional) Local devices Checked and heard by this collector DATA CENTER Collector Collector per data center or VLAN Management page (optional) Local devices Checked and heard by this collector CLOUD NETWORK Collector Collector VM in AWS or Azure Management page (optional) Local devices Checked and heard by this collector HTTPS 443, out from each site TLS 1.3, pinned certificate Remote access SSH and Remote Desktop to site devices ride inside the same connection. Off by default. KEY Collector to server (opened by the collector) Checks and device data People

Logs and SNMP traps, with DNS names

Devices send syslog and traps to a collector, which looks up names in your internal DNS and keeps both the IP and the name.

Logs and SNMP traps, with DNS names The collector keeps the sender's IP address and, when your DNS knows it, the name, in separate columns. YOUR NETWORK Firewalls 10.0.0.1 fw1.corp.example Switches 10.0.10.5 sw-core.corp.example Servers 10.0.20.14 file01.corp.example UPS and printers 10.0.30.8 (no PTR record) Syslog UDP/TCP 514 · Traps UDP 162 Collector Receives, parses and stores logs and traps (encrypted) Looks up names for the sender and for IPs inside messages Names cached 1 hour Internal DNS server Reverse zones with PTR records e.g. 10.in-addr.arpa Must know your internal devices PTR lookups, DNS UDP 53 Uplivra server Search in plain words Alerts on log patterns HTTPS 443 Needed for names: an internal DNS server with PTR records Point the collector at a DNS server that knows your internal devices (usually your domain controllers). Create reverse lookup zones and PTR records for the devices, or turn on automatic PTR updates (DHCP/DDNS). No PTR record? The IP address is still shown; the DNS name column is just empty. HOW A SEARCH SHOWS IT Time Type Source IP DNS name Device Message 09:41:07 Syslog 10.0.0.1 fw1.corp.example Firewall 1 Deny tcp 203.0.113.9 → 10.0.20.14:3389 09:41:12 Trap 10.0.10.5 sw-core.corp.example Core switch linkDown Gi1/0/24 09:42:30 Trap 10.0.30.8 — UPS closet 2 upsOnBattery Search examples: "errors from fw1 last hour" · "traps on sw-core not linkUp" · "denied 3389 today" KEY Devices send logs and traps Name lookups To the server

MSP: one server, many customers

A multi-tenant server and master collectors in the MSP's data center. Customers connect out; staff see only what their role and each customer allow.

MSP: one server, many customers Customers' collectors connect out to your master collectors. Each customer is a separate tenant, and each customer controls your access. CUSTOMER A controls MSP access Collector HTTPS 443 out LAN 192.168.1.0/24 Their devices CUSTOMER B controls MSP access Collector SSH out (HTTPS blocked) LAN 192.168.1.0/24 Their devices CUSTOMER C controls MSP access Customer's firewall No collector: router hand-off LAN 10.20.0.0/16 Their devices YOUR DATA CENTER (MSP) MSP firewall: in to the masters only (443, SSH 2222, IPsec) Master collector 1 Relays customer collectors Fingerprint or your CA Master collector 2 Second master for failover Collectors switch by themselves Master in router mode VRF per customer, NAT, GRE over IPsec, BGP/static (see the router diagram) HTTPS 443 fails over SSH 2222 GRE/IPsec UDP 500/4500 Uplivra server MSP multi-tenant module One tenant per customer Separate data, sites, people Per-customer reports Tenant A Tenant B Tenant C HTTPS 443 Your staff Engineers, technicians, NOC Sign in with your AD/LDAP HTTPS 443 What staff can see Access profiles per role: NOC watches, technicians fix, engineers change settings. Then each customer's policy: full, limited or locked out. KEY Collector to your masters and server (opened outward) Tunnel to a customer's router Staff

MSP router mode: what each firewall sees

Per-customer VRFs, GRE over IPsec, BGP or static routes, and NAT into an external network each customer chooses, so overlapping networks just work.

MSP router mode: what each firewall sees Two customers use the same 192.168.1.0/24. Each chooses an external network; your monitoring traffic is translated into it. YOUR DATA CENTER (MSP) Uplivra server Monitoring network 10.200.0.0/24 Master collector in router mode VRF c-acme NAT 10.200.0.0/24 → 100.64.10.0/28 BGP AS 65010 VRF c-bravo NAT 10.200.0.0/24 → 100.64.20.0/28 static routes Stateful firewall per VRF: only what monitoring needs. Router pairs share state (keepalived, conntrackd). Checked before applying; rolls back if Uplivra can't be reached for 3 minutes. HTTPS 443 and checks MSP firewall Sees IPsec to the customers' public IPs CUSTOMER ACME Acme firewall GRE over IPsec BGP advertises 100.64.10.0/28 LAN 192.168.1.0/24 Switches, servers, printers What Acme's firewall sees From 100.64.10.1 (their chosen external network) to 192.168.1.20 UDP 161 (SNMP), ICMP, TCP checks Never your 10.200.0.0/24, never the other customer CUSTOMER BRAVO Bravo firewall GRE over IPsec Static route to 100.64.20.0/28 LAN 192.168.1.0/24 Switches, servers, printers What Bravo's firewall sees From 100.64.20.1 (their chosen external network) to 192.168.1.20 UDP 161 (SNMP), ICMP, TCP checks Never your 10.200.0.0/24, never the other customer GRE over IPsec UDP 500/4500 + ESP BGP TCP 179 inside GRE over IPsec UDP 500/4500 + ESP Why it works Each customer's traffic lives in its own VRF, so identical networks never meet. NAT makes you appear from an address each customer picked, so their firewall rules and logs stay simple, and nothing of one customer's is ever reachable from another's. KEY GRE over IPsec tunnel Checks, from the customer's external network To the server

Packet capture from a SPAN port

A collector records mirrored traffic on a second network port with no address, separate from its management port, and uploads the capture over HTTPS.

Packet capture from a SPAN port Short on-demand captures (Network Pro). The collector listens on a second port that only receives a copy of traffic; it has no IP address and never sends. YOUR NETWORK Switch Monitor session (SPAN): copies ports or VLANs to a destination port Gi1/0/1–12 → Gi1/0/48 Servers and firewalls The traffic being copied normal traffic Collector Capture port (eth1) No IP address, receive only Management port (eth0) Has an IP; talks to Uplivra Capture filter picks what to keep SPAN copy: one way management VLAN Uplivra server Stores the capture Display filter in the browser HTTPS 443 Engineer Starts a 30–60 s capture, reads it, or downloads pcap Rules Use a different port from the management port. Size the capture port for the copied traffic (1 G vs 10 G). Filters Capture: host 10.0.0.5 and port 443 (what is recorded) Display: tcp.port == 443 && ip.src == 10.0.0.5 (what is shown)

Health reporting: what Uplivra and MSPs see

Every customer's server reports its health to the Uplivra portal every 5 minutes, outbound on HTTPS. MSP customers home to the MSP's data center, and the MSP's server reports each customer. Staff see everyone; each MSP sees only its own customers. Actions still need the customer's approval.

Health reporting: what Uplivra and MSPs see Every server reports outbound on HTTPS 443 every 5 minutes. Nothing connects in to a customer, and the reply can't run commands. DIRECT CUSTOMER Uplivra server Settings › Uplivra support: summary (default), detail or off Collector Branch A Collector Branch B MSP DATA CENTER AND ITS CUSTOMERS Customer collectors Clinic, law firm, school… home to the MSP, not Uplivra MSP master collectors HTTPS or SSH relay, router mode MSP's Uplivra server Multi-tenant: one report per customer MSP staff Portal › Monitoring: only their customers UPLIVRA (LICENSING AND PORTAL) licensing.uplivra.com Receives health reports Reply: check the license in now, collectors suspended to free tier (no commands, ever) Portal › Monitoring Every customer: up or down, collectors, versions, sites, devices, license use; search and filters; revoke or suspend Support connection Diagnostics, connection logs, restart, upgrade, SSH terminal: each one approved by the customer first HTTPS 443, every 5 min per customer What's shared (the customer chooses) Summary: sites, collectors, versions, device up/down counts Detail: plus device names, addresses and status Off: version and license state only What staff and MSPs can do See: staff everyone; each MSP only its own customers Uplivra staff only: revoke a license or suspend a collector Anything on the customer's systems: only after approval

Packet capture collector: record all the time, pull any moment

A dedicated collector records one or more SPAN ports around the clock into encrypted storage. Your Uplivra server licenses it, and pulls the minutes you ask for, or the minutes before an alert.

Packet capture collector: record all the time, pull any moment A collector that only captures. Its SPAN ports listen; its management port is the only one with an address, and it only connects out. YOUR SITE Switch Monitor sessions (SPAN): uplink and server ports copied to 2 destination ports Gi1/0/1-24 → Gi1/0/47 Firewall, servers, phones The traffic being recorded normal traffic Packet capture collector SPAN port eno2: "internet edge" No IP address, listens only SPAN port eno3: "server VLANs" No IP address, listens only Rolling recording on its own disk AES-256-GCM, a key per segment Oldest removed first: disk % and hours Plan speed limit (1, 2 or 10 Gbps) Management port eno1 (has an IP) Management page, HTTPS 443 Connects out to the Uplivra server SPAN copy: one way MAIN SITE OR DATA CENTER Uplivra server Sends its license and settings (ports, labels, filters, disk %) Queues pulls for a time window Summarizes; download for Wireshark HTTPS 443 An alert opens Pull 3 minutes before to 30 seconds after, automatically Engineer Pick the collector, a time and a host or filter, then Pull Plans (per capture collector, per year) Free: 1 port, 100 Mbps, 24 hours (one per installation) Lite: 1 SPAN port, 1 Gbps, $499 Standard: 2 SPAN ports, 2 Gbps in total, $999 Pro: 4 SPAN ports, 10 Gbps, $2,499 (in development) Rules 2 or more network ports: 1 management, 1+ SPAN SPAN ports can never be the management port The license comes from your Uplivra server Headers only (128 bytes) or whole packets, per collector