Compatibility
Will it work on my network?
This is the first question a network engineer asks, and the usual answer is a logo wall. This one is a table: every vendor, every protocol, every port, and what runs where. The last section lists what these products cannot do.
Host and install
Four run on your laptop. Two run on a machine that stays.
That split is deliberate. A tool you carry into a building has to open like an app. The two that hold something over time, an estate and a building, have to live where that thing lives.
| Product | Runs on | How it installs | What it needs |
|---|---|---|---|
| CrossScan | Windows, macOS | A double-click installer. | Nothing. It binds to 127.0.0.1, reachable only from the machine you run it on, and stays off the network it is scanning. |
| CrossCheck | Windows, macOS | A double-click launcher. | Nothing. It binds to 127.0.0.1. Docker is optional, only for the formal proof and the digital twin; without it, both say so and the verdict is capped. |
| CrossRoom | Windows, macOS | A double-click launcher. | Nothing. It binds to 127.0.0.1, reachable only from the machine you run it on. |
| CrossTrust | Windows, macOS | A double-click launcher, or a .dmg on macOS. | Nothing. It binds to 127.0.0.1 on the first free port in 8400–8430. It reads a folder you point it at and needs no credentials, because it never contacts a device. |
| CrossConnect | Linux | One command, inside your walls. | Docker with Compose v2, and PostgreSQL 16, which the install brings with it. About 4 GB of RAM, or more if you keep the configuration-analysis engine on. Java ships inside the image, so there is nothing to install on the host. |
| CrossVenue | Windows, macOS, Linux | A script on the operations machine, and it starts on boot. | Node 22.13 or later, and nothing else: no database to stand up, because it brings its own. It binds to 127.0.0.1:3000. It stays running because the record is written on a timer, and a building that is only recorded when somebody opens a browser has gaps on the nights that matter. |
CrossConnect is a server product and Windows is not a supported host for it. Everything it needs comes in the install, so "one command" means one command. CrossVenue is the other way round: it is usually installed on a Windows machine in the plant room, because that is the machine that already exists there.
SNMP
v2c and v3. Never v1. Never a write.
Four of the six speak SNMP, all four read with it, and none of them can write with it. No product imports an SNMP set primitive. In CrossScan, a test walks every source file and fails if anyone adds one. Two do not speak it. CrossTrust never contacts a device at all, because it reads files you already have. CrossVenue talks to a building rather than a network, so its protocol is BACnet/IP, and the read half of it.
| Versions | v3 authentication | v3 privacy | Writes | |
|---|---|---|---|---|
| CrossScan | v2c, v3 | MD5, SHA-1, SHA-224, SHA-256, SHA-384, SHA-512 | DES, 3DES, AES-128, AES-192, AES-256 | None |
| CrossConnect | v2c, v3 | MD5, SHA-1, SHA-224, SHA-256, SHA-384, SHA-512 | DES, 3DES, AES-128, AES-192, AES-256 | None |
| CrossCheck | v2c, v3 | MD5, SHA-1, SHA-256 | DES, AES-128, AES-256 | None |
| CrossRoom | v2c, v3 | MD5, SHA-1, SHA-224, SHA-256, SHA-384, SHA-512 | DES, AES-128, AES-192, AES-256 | None |
| CrossTrust | None | Not applicable | Not applicable | None |
| CrossVenue | None | Not applicable | Not applicable | None |
Security levels are noAuthNoPriv, authNoPriv and authPriv, derived from the credentials you supply. You never pick a mode. An illegal combination, privacy without authentication, cannot be constructed. SNMPv1 is deliberately excluded from polling: it is deprecated and it sends your community string in the clear. Give us v3 and we will use v3.
The MIBs are the standard ones, and there is no secret sauce in the list: system, IF-MIB and ifXTable, LLDP and LLDP-MED, BRIDGE and Q-BRIDGE forwarding tables, IP-MIB and ARP, POWER-ETHERNET for PoE, ENTITY and ENTITY-SENSOR, HOST-RESOURCES, IGMP, PIM, PTP, plus routing (BGP4, OSPF, IP-FORWARD, MPLS-L3VPN) and per-vendor extensions for Cisco, Juniper, Fortinet, Netgear and Ubiquiti where the standard tables come up short.
How each one collects
Nothing is installed on your gear. Ever.
No agents on switches, no software on a codec, no SPAN port, no packet capture. Four of these ask the network what it already knows about itself. One asks a building. One asks nothing at all and reads a folder.
Neither of the two that read a network finds your devices by shouting. The inventory is read out of the switch: SNMP tables, LLDP and CDP neighbours, the bridge forwarding table, ARP. CrossScan sends no broadcast and no multicast at all. Its one optional probe is unicast, addressed to a single device it has already found on a port, and it is off until you turn it on.
CrossConnect is the same shape with one exception worth naming, because a vendor who tells you there are none is a vendor who has not looked. Its own discovery probes are multicast, which is a different thing from a broadcast: WS-Discovery and SSDP to 239.255.255.250, mDNS to 224.0.0.251. Those go to a group, and a switch doing IGMP snooping keeps them off ports that did not ask. The one genuine broadcast in the product is BACnet Who-Is, to 255.255.255.255 on UDP 47808, which is how BACnet discovery works and the only way to find a controller that has never spoken. All of it, multicast and that one broadcast, runs from the active-discovery path, which is off until an operator turns it on and scopes it.
| Product | What it talks to |
|---|---|
| CrossScan | SNMP to the switches. LLDP, LLDP-MED and CDP neighbour tables to walk from your seed switch to the switches behind it, three hops deep by default. Reverse DNS to your own resolver. Optionally, and only if you switch it on, a read-only HTTP or SSDP probe of an endpoint, with no credentials, ever. |
| CrossConnect | SNMP and LLDP. SSH command-line reads, with confirmed profiles for eight vendors. NETCONF, read-only, fetching the running configuration. gNMI, subscribe only. NetFlow v5 and v9, IPFIX, and sFlow v5. Syslog and RADIUS accounting. ICMP, ARP, TLS certificate reads, HTTP banners, mDNS, SSDP, WS-Discovery and DHCP fingerprints. Read-only cloud APIs for Meraki, UniFi and Infoblox. ONVIF and per-vendor camera and AV probes, including Axis, Hanwha, Vivotek, Hikvision, Bosch, Panasonic, Sony, Huddly, Cisco, Poly, Q-SYS, PJLink and VISCA. |
| CrossCheck | SNMP to the switches. Q-SYS QRC, Dante Domain Manager, Dante and NDI discovery, AES67 and ST 2110 session announcements (listen only, it never transmits), ONVIF, Poly REST, Cisco and Webex xAPI, Biamp Tesira, AMX SVSI, AVDECC and Milan, and the Cisco lifecycle API when you give it credentials. SSH port 22 is used only to see whether a device answers. CrossCheck never logs in over SSH. |
| CrossRoom | Cisco RoomOS and Poly VideoOS media statistics from the codec itself. Microsoft Teams and Zoom quality data from the platform. IF-MIB counters from the switch over SNMP. Wireless controller client history. Room device, DSP and peripheral status from the vendor's own cloud or controller. |
| CrossTrust | Nothing. It talks to no device on your network and holds no credentials for one. It reads files in a folder you name: Visio .vsdx drawings, switch configurations, Excel workbooks in both formats, CSV exports and PDFs with a text layer. It can also read a documentation website over HTTP, and only the one you point it at. |
| CrossVenue | BACnet/IP on UDP 47808: a Who-Is to find the controllers, then property reads and trend-log retrieval. The National Weather Service gridpoint and observation APIs over HTTPS, which are public and need no account. Everything else is an import rather than a protocol: the interval meter export from the retail provider, the event calendar, the water and sewer statement, and the work history. It writes no property and holds no account that could. |
CrossConnect's active discovery is off by default. You choose the scope, the exclusions and the cadence before it sends a single packet.
CrossConnect network vendors
Three tiers, and we tell you which one you are in.
This table is CrossConnect only. The other three read any device that answers SNMP and treat every switch alike. CrossConnect goes further, reading each vendor's running configuration, so it owes you a straight answer about how far it can go on yours. Every vendor list has a dishonest middle where "supported" quietly means "we can log in and read some text." Here is ours, split by what it can do with your configuration, generated from the same source of truth the product uses at runtime.
| Vendor | Tier | How it reads | Formal analysis | Hardening checks |
|---|---|---|---|---|
| Cisco IOS, IOS-XE, NX-OS | Formal | SSH | Yes | Yes |
| Arista EOS | Formal | SSH | Yes | Yes |
| Juniper Junos | Formal | SSH | Yes | Yes |
| Fortinet FortiOS | Formal | SSH | Yes | Yes |
| Palo Alto PAN-OS | Formal | SSH | Yes | Yes |
| F5 BIG-IP | Formal | SSH | Yes | Yes |
| Check Point Gaia | Config | SSH | No | Yes |
| Netgear FASTPATH, M4250, M4300 | Config | SSH | No | Yes |
| Ubiquiti EdgeSwitch, EdgeRouter, UniFi | Config | SSH, and the UniFi controller API | No | No |
| Cisco Meraki | Cloud | Dashboard API, read-only | No | No |
| Extreme EXOS | Capture | SSH | No | No |
| Anything else | Capture | SSH, best effort | No | No |
Formal means the configuration is parsed into a model and reasoned over: reachability, blast radius, and whether a change does what you think it does. Config means we parse it and check it, but we do not prove things about it. Capture means we can read it, store it and show you what changed between two points in time, and we will not pretend to understand it. Extreme is capture only today, and we would rather say that than let you find out during an audit.
AV and UC vendors
The gear in the room.
CrossCheck reads AV devices directly, over each vendor's own protocol. CrossRoom reads the codec and the meeting platform. CrossScan identifies what is on the port without talking to it at all.
| Vendor or platform | Read over | Which product |
|---|---|---|
| QSC Q-SYS | QRC, the Q-SYS control protocol | CrossCheck |
| Audinate Dante | Dante Domain Manager, and Dante discovery | CrossCheck |
| Biamp Tesira | Tesira text protocol | CrossCheck |
| AMX SVSI and N-series | Direct control API | CrossCheck |
| Cisco and Webex RoomOS | xAPI status, the read half only | CrossCheck, CrossRoom |
| Poly and HP | VideoOS REST | CrossCheck, CrossRoom |
| Axis and other ONVIF cameras | ONVIF device information | CrossCheck, CrossConnect |
| AVB and Milan devices | AVDECC entity enumeration | CrossCheck |
| AES67 and ST 2110 senders | Session announcements, listen only | CrossCheck |
| Microsoft Teams | Call records and call quality | CrossRoom |
| Zoom | Quality of service subscription | CrossRoom |
| Crestron, Logitech, Neat, Yealink, Sennheiser, Extron, and the major display makers | Each vendor's own cloud or controller | CrossRoom |
CrossCheck's remediation is vendor-specific, and where it is not, it says so. It carries 16 confirmed, copy-paste fixes covering 5 settings across 4 switch vendors: Cisco, Arista and Juniper as command line, and Netgear as steps in the Engage AV UI, because that is where the setting lives on an M4250. For a switch vendor it has not confirmed, it gives you the principle, the verification and the rollback, and refuses to invent syntax. It will not print one vendor's CLI on another vendor's switch.
CrossCheck's catalog is 192 rules across 26 vendors: 116 hazard rules and 76 published end-of-support dates. It is curated by hand, and every rule cites the vendor advisory behind it.
CrossScan identifies 250 device types across 155 vendors, of which 48 are verified against real hardware and 202 are placeholder signatures that score at half weight and say so in the evidence. It never lets a placeholder pass as a fact.
CrossTrust recognizes AV gear by name, not over a protocol. It reads no AV device and speaks none of the protocols above. What it does is match 52 equipment names and markers in the port descriptions your engineers already typed, sort them into 6 equipment families, and check which of four network controls that family actually needs: IGMP snooping, an IGMP querier, QoS trust and PoE. A Dante device needs three of them. A control processor needs one. It checks what is owed, not a fixed list. That is how it can tell you a Q-SYS core is on a switch with no multicast querier without ever touching the Q-SYS core.
File formats
What CrossTrust reads, and what it tells you it cannot.
Four of these products take a network as their input. CrossTrust takes a folder, so this is its compatibility list. The second table matters more than the first: those files are named on screen with the reason, so you always know what was left out of the answer.
| Format | Extension | What it pulls out |
|---|---|---|
| Visio drawing | .vsdx | Shapes, connectors and Shape Data, cited to the page and the shape. |
| Switch configuration | .txt .cfg .conf .ios | Hostnames, interfaces, VLANs, addresses and settings, cited to the line. The vendor is detected from the contents, not the extension, across 11 configuration languages. |
| Spreadsheet export | .csv | Records, cited to the row and the named column. |
| Excel workbook | .xlsx .xlsm | The same, per sheet. |
| Excel, pre-2007 | .xls | The same. Still common in this industry, so it is read rather than declined. |
| PDF with a text layer | Structured statements only, cited to the page and the character range. | |
| A documentation website | HTTP, HTTPS | Tables and definition lists from the site you name. Prose is left alone. |
| Pasted configuration text | No file needed | Written to a temporary file so it takes the identical path as a file on disk. |
| Recognized and declined | Extension | What it says on screen |
|---|---|---|
| Legacy binary Visio | .vsd | Legacy binary Visio, which needs a different parser. |
| Word document | .docx | Word, planned but not in this build. |
| Images | .png .jpg .jpeg | An image, which this build does not read. |
| Visio stencil | .vssx | A Visio stencil rather than a drawing. |
Those sentences are the product's, not ours. They are the strings the screen prints, and a customer with four hundred .vsd files sees all four hundred named rather than a silently shorter answer. There is no OCR: a scanned PDF has no text layer, so it is reported as needing one rather than guessed at.
A single file is capped at 200 MB. Files that are byte-for-byte identical are read once, so two copies of one spreadsheet cannot confirm each other. A file that cannot be read safely is held back and named individually, because that is a security event rather than a skipped row.
Ports
What we open, and what we reach out to.
Your security team will ask. Here it is before they have to.
| Product | Listens on | Reaches out to |
|---|---|---|
| CrossScan | Nothing. The interface is on loopback only. | 161/udp to the switches, 53/udp to your resolver. If you turn on active probing: 80, 443 and 1900/udp to endpoints. |
| CrossCheck | Nothing. The interface is on loopback only. | 161/udp, and each AV vendor's own port: 1710 Q-SYS, 8443 Dante, 23 Biamp, 50002 AMX, 443 and 80 for the rest. |
| CrossRoom | Nothing. The console is on loopback only. | 161/udp to the switches, 443 to codecs, controllers and meeting platforms. |
| CrossTrust | Nothing. The interface is on loopback only, on the first free port in 8400–8430. | Nothing, by default. One button checks whether the published requirements it checks against have been revised, over 443, and only when you press it. If you point it at a documentation website, 443 to that site and nowhere else. |
| CrossConnect | 8080/tcp for the interface and the API. Everything else, including SNMP traps, flow collection and mDNS, is off until you turn it on. | 161/udp, 22, 830, 57400, 443, 80, ICMP and DNS. |
| CrossVenue | 127.0.0.1:3000. Loopback only, so reaching it from another machine is a decision somebody has to make deliberately. | 47808/udp to the building controllers, and 443 to the National Weather Service. Nothing else. A screen never makes the outbound call itself, because a page that waits on a network with no route out is a page that hangs, and on a plant-room network that is the normal case rather than the exception. |
The database and the configuration-analysis engine talk to CrossConnect over the container network and are not exposed outside it.
The limits
What we do not support.
Every other section on this page tells you what works. Print this one and hold us to it.
- No writes to a device. No SNMP set, no configuration push, no firmware flash, no reboot, no camera move. This is a property of the code, not a policy we are choosing to keep.
- No SNMPv1 polling. It is deprecated and it sends your credentials in the clear. If v1 is all a device speaks, we will report it as unread and leave your security where it is.
- No SPAN, no port mirroring, no packet capture. Your traffic stays yours. These products read what the network already knows about itself.
- No broadcast discovery in CrossScan. It emits no multicast and no broadcast. Every device it names came out of a switch table, and the active probe you can turn on sends to one address at a time, which is the device it already found.
- CrossConnect broadcasts in exactly one place. BACnet Who-Is, to 255.255.255.255 on UDP 47808, because a BACnet controller that has never spoken cannot be found any other way. Everything else it sends to find things is multicast or unicast. Active discovery is off until you turn it on, and you choose the scope and the exclusions before it sends a packet.
- No agents on your gear. Nothing is installed on a switch, a codec, a DSP or a display.
- CrossConnect's neighbour discovery is LLDP only. CrossScan reads both LLDP and CDP.
- CrossCheck stops at an encrypted firmware image. Some vendors seal theirs. It reports the image as sealed, asks you for the vendor's release notes, and declines to speculate about what is inside.
- CrossRoom scores audio only, and records nothing. The score is the audio experience, rebuilt from measured quality. There is no audio or video capture anywhere in it.
- CrossTrust reads documents, never devices. When it says a switch is set a certain way, it means a file you gave it says so. It cannot read Word documents, scanned images or the old .vsd Visio format, and it names those files on screen rather than pretending the folder held nothing else.
- CrossVenue never writes a setpoint. No schedule change, no roof command, no chiller start. It works out what to do and hands it to a person, and the account it asks for on the controls network is a read-only one. It also runs one site at a time and does not roll a portfolio up.
- There is no model in any of this. No product here uses an LLM to decide what is true. CrossTrust in particular parses structured formats only, which is why two runs over the same folder produce the same answer.
- These are diagnostic tools. A red light is where the work starts, and a tool that hands you an alarm and stops has left you where it found you.
- Where the evidence runs out, the answer is capped. The gap is named, and so is the thing that would close it.
Your gear is not on this page?
Tell us what you have. We will tell you whether it reads, whether it half-reads, or whether it does not, before you spend a day finding out.