Network agent configuration

Two layers of configuration

The agent reads one local file at startup — C:\ProgramData\VerOps\Network Agent\config.toml on Windows, /etc/verops/network-agent.toml on Linux — and then takes per-agent settings from the platform on every heartbeat. Knowing which layer owns a setting saves a lot of confusion:

Layer	Owns	To change it
Local file	[platform] URL and key, [agent] identity and intervals, [passive], [netflow]	Edit the file and restart the service. It is read once at startup.
Platform (Network → Agents → the agent's Configure dialog)	[discovery], [mesh], [probes] defaults, [snmp] trap listener and poll targets	Save in the dialog; the agent applies it on its next heartbeat, no restart. Platform values override the file.

So the file is the bootstrap — enough to find the platform and identify itself — and day-to-day tuning happens centrally, which is what lets you change a fleet of agents without touching each host.

What is on and off by default

Several capabilities are deliberately off until you turn them on, because each is a deployment decision someone should make knowingly rather than something that appears on upgrade:

Capability	Default	Why it is a choice
Mesh (agent ↔ agent latency, loss, jitter)	On	Cheap and only ever between your own agents.
Mesh bandwidth test	Off	Floods the link between two agents for a few seconds each run.
LAN discovery (ARP scan, mDNS, port scan)	Off	Scans the local subnet. Unwelcome on corporate, cloud or shared networks unless agreed.
SNMP trap listener	Off	Binds a privileged UDP port (162) and accepts traffic from devices.
SNMP polling	Off until the platform pushes targets	Adding a device under Network → SNMP → Poll targets turns it on for the chosen agent.
Passive observation (host connections)	Off	Reports which processes talk to which endpoints — more sensitive than active probes.
NetFlow / IPFIX collector	Off	Binds a UDP port; an exporter pointed at an agent that is not expecting it should fail at the router, not silently here.

The file, section by section

[platform] — required

[platform]
url = "https://app.verops.io"
connection_key = "na_xxxxxxxxxxxxxxxx"     # from Network → Agents → Deploy New Agent

The only two values the agent cannot run without. A missing key is a startup error, logged and exited — the service manager then restarts it every 10 seconds until the file is fixed.

[agent] — identity and cadence

[agent]
name = "lon-branch-1"          # shown in every result and alert
region = "eu"                  # free-text labels used to group agents
environment = "production"
heartbeat_interval_secs = 30   # also how quickly platform config changes arrive
max_concurrent_probes = 50
health_port = 9877             # 127.0.0.1 only
# advertise_ip = "10.99.0.1"   # the address peers use to reach this agent's mesh port

Set advertise_ip when the host has several addresses and the auto-detected default-route one is not the one other agents can reach — a WireGuard or private VPC address, typically. Test assignments are polled separately from heartbeats, so a new or edited test reaches its agents within a minute.

[mesh] — agent-to-agent measurements

[mesh]
enabled = true
listen_port = 9876
bind_address = "0.0.0.0"              # bind to the private address on dual-homed hosts
bandwidth_test_interval_secs = 0      # 0 = off; e.g. 600 samples every 10 minutes

Peers arrive from the platform: every registered agent learns about the others, so there is nothing to list by hand. Latency, loss and jitter are measured every health cycle and are cheap; the bandwidth test is not, which is why it is off.

[discovery] — finding what is on the LAN

[discovery]
enabled = false
arp_scan = false
mdns = false
port_scan = false
scan_interval_secs = 300
# subnets = ["10.20.0.0/24"]         # limit scanning to these; empty = the agent's own

What discovery finds appears under Network → Discovery and feeds the topology. Turn it on per agent from the platform for the networks where scanning is acceptable, and leave it off everywhere else.

[probes] — defaults for tests that do not specify

[probes]
default_timeout_ms = 5000
default_count = 10

[snmp] — traps and polling

[snmp]
enabled = false            # the trap listener
bind_address = "0.0.0.0"
port = 162
# community = "public"     # v1/v2c allow-list; unset accepts any community
batch_max = 100
flush_interval_secs = 10

# Optional: SNMPv3 users so the listener can authenticate and decrypt v3 traps
# [[snmp.v3_users]]
# user = "monitor"
# auth_protocol = "SHA"      # or MD5; absent = noAuth
# auth_key = "..."
# priv_protocol = "AES"      # or DES; absent = noPriv
# priv_key = "..."

Polling targets are managed in the platform (Network → SNMP → Poll targets) and pushed to the agent; a local [snmp.poll] section exists only as a fallback for standalone testing. The full walkthroughs are SNMP traps and SNMP polling.

[passive] — what this host is talking to

[passive]
enabled = false
sample_interval_secs = 15      # how often the socket table is read (procfs / Windows)
report_interval_secs = 60      # how often folded flows are shipped
max_flows = 5000               # per window; overflow is counted, never silently dropped

When enabled, the agent picks the best collector the host allows and reports which one it used: on Linux, eBPF where the kernel, BTF and privileges permit — exact, sees every connection — otherwise /proc sampling; on Windows the TCP table. Sampled collectors miss connections shorter than the sample interval, and the Dependencies view labels their counts as lower bounds rather than presenting them as exact. Payloads are never captured — only connection facts: who, whom, protocol, port, duration, outcome. This section is local-only; the platform does not switch it on for you.

[netflow] — flows exported by routers

[netflow]
enabled = false
bind_address = "0.0.0.0"
port = 2055
report_interval_secs = 60

Accepts NetFlow v5 and v9 from devices you point at this agent. Use it where you want the traffic matrix of a network segment rather than of the agent's own host.

Environment variable overrides

For image-based or scripted deployments, the bootstrap values can come from the environment instead of the file. These override the corresponding file keys:

Variable	Overrides
AGENT_PLATFORM_URL	[platform] url
AGENT_CONNECTION_KEY	[platform] connection_key
AGENT_NAME, AGENT_REGION, AGENT_ENVIRONMENT	the [agent] labels
AGENT_ADVERTISE_IP	[agent] advertise_ip
AGENT_MESH_PORT	[mesh] listen_port
AGENT_SNMP_ENABLED, AGENT_SNMP_PORT	[snmp] enabled / port

Where things are

	Windows	Linux
Binary	C:\Program Files\VerOps\Network Agent\network-agent.exe	/usr/local/bin/verops-network-agent
Configuration	C:\ProgramData\VerOps\Network Agent\config.toml	/etc/verops/network-agent.toml
Log	C:\ProgramData\VerOps\Network Agent\logs\network-agent.log	journalctl -u verops-network-agent (JSON lines)
Service	VerOpsNetworkAgent — Start Menu shortcuts for start, stop, status and the log	verops-network-agent — systemctl
Health	http://127.0.0.1:9877/health and /ready

Configuration and logs live outside the program directory on purpose: they survive upgrades and are left in place by an uninstall unless you ask for a purge.