For network engineers and NOC operators

40+ diagnostic tools. One window.
An AI that reads the output.

Wireshark in one window. Termius in another. The browser tab pointed at the switch's web UI. PuTTY (still) for the firewall console. Notepad for the timeline of what you tried. Five tools open per incident is the diagnostic equivalent of typing with mittens on. Replace the tab graveyard with one workspace.

Download free for macOS, Windows, Linux

Free forever · No credit card · macOS · Windows · Linux

ShellYard · Incident #4419

MTR 8.8.8.8

hop  loss%  avg
1   0.0%   1.2
2   0.0%   8.4
3   2.1%  14.7
4   0.0%  15.0
5   0.0%  15.2

Packet Capture en0 · 412 pkts

time  src→dst       flag
.011  10.0.1.4→.22  SYN
.012  10.0.0.22→.4  S/A
.013  10.0.1.4→.22  ACK
.184  10.0.1.4→.22  RETX

DNS api.acme.io

type  ttl  value
A     60   203.0.113.42
A     60   203.0.113.43
AAAA  60   2606:4700::1
AAAA  60   2606:4700::2

SSH · core-sw-01 ●

core-sw-01# show int Gi1/0/24
Gi1/0/24 is up, line up
  duplex half, 100Mb/s
  input errors 0
  output errors 1,284

All four panels share one workspace. Ask Magellan to read all four

The tab graveyard

One ticket. Five apps. Zero shared context.

A user says "the API is slow." You start typing. By minute three you have:

Wireshark open on a 1.4 GB capture you took before the symptom started, scrolling for the retransmit you swear you saw.
Termius in another window with three SSH sessions — bastion, core switch, edge firewall — and you can't remember which is which.
A browser tab pointed at the access switch's HTTP UI, logged in via cached basic auth that will time out in 6 minutes.
PuTTY (still — it's 2026 and PuTTY is still here) for the firewall console because someone scripted it into the runbook in 2014.
Notepad (or Sublime, or a sticky note) holding the running timeline of what you tried, which you will lose the moment your laptop reboots for an update at 3pm.

When the answer turns out to be a duplex mismatch on Gi1/0/24, none of those five windows know about each other. The packet capture didn't see the switch's interface counters. The SSH session can't attach itself to the timeline. The fix disappears into terminal scrollback the next time you close the tab.

One workspace

The same incident, in one window.

1 Open the connection. The terminal pane is already a tab in the workspace — same identity, same credentials, same vault. show interfaces starts streaming.
2 Open MTR in another tab. Run it against the destination. Same window, same Space, no second app. Per-hop loss and latency stream live with ASN annotation.
3 Open a packet capture. The interface picker is one click — the libpcap capture is happening in the same window as the terminal that's printing the switch's view of the same traffic.
4 Attach any tool's output to Magellan. "What pattern is in this capture?" Magellan reads the frames, reads the MTR trace, reads the show int output you pasted, and tells you in plain English: "Gi1/0/24 is half-duplex but the upstream port negotiated full — that's the source of the retransmits."

The output becomes the runbook. On Team tier, the diagnostic, the explanation, and the fix save into the Space's documents with version history. Next engineer on the same symptom finds your work — not your shell scrollback.

What ships

The kit you keep alt-tabbing to — without the alt-tabbing.

40+ tools in tabs.

DNS, WHOIS / RDAP, NTP, ping sweep, port scanner, subnet calc, MTR, packet capture, TLS inspector, SNMP v1/v2c/v3, syslog viewer, bandwidth monitor, Nmap, DHCP browser, MAC tracker, PoE calc, AP scanner, config backup + diff, file transfer (TFTP / FTP / SFTP), Docker inspector, log viewer, network discovery. Every tool is a tab in the same window.

See the full list →

Magellan attaches the output.

Every diagnostic tool has an "Ask Magellan" button on its toolbar — the capture, the trace, the syslog stream, the config diff. BYO Anthropic / OpenAI / Gemini / Ollama key. Prompts go directly to your provider; nothing transits ShellYard. Run a local Ollama model and the AI loop never leaves your laptop.

Cross-platform — one tool per tech.

macOS notarized (Apple Developer ID, no Gatekeeper prompt). Windows Authenticode-signed via Azure Trusted Signing. Linux .deb / .rpm / AppImage. Your Mac-using SRE and your Windows-bound NOC tech open the same workspace — unlike SolarWinds Engineer's Toolset, which is Windows-only.

Bulk Command + Batch SSH.

Team tier. Select a folder of saved connections, run one command across all of them in parallel, see a structured pass/fail table per host. Batch SSH uses a real shell + PTY for devices that need a login shell. Same vault, same credentials, same workspace.

Side-by-side

The three shapes a NOC tech actually ships with.

	ShellYard	SolarWinds ETS	5 separate apps
Cross-platform	macOS · Windows · Linux	Windows only	Depends — Wireshark yes, PuTTY Windows-first, ETS Windows-only
Integrated AI on tool output	Yes — every tool has "Ask Magellan"	No	No (copy-paste into ChatGPT manually)
AI = BYO-key, direct to provider	Yes — Anthropic / OpenAI / Gemini / Ollama; nothing transits us	N/A	N/A
Number of bundled diagnostic tools	40+	~60 (older, Windows-only utilities)	Whatever you've manually installed
Tools live as tabs in one window	Yes — every tool is a tab in the workspace	Launcher fires each tool as a separate app	No — alt-tab city
Pricing	Free / $24 Pro / $49 Team / $99 Enterprise — per user, per month	$1,675+ perpetual, per technician (1st year), plus annual maintenance	Free to ~$200, fragmented across vendors

Full SolarWinds Engineer's Toolset comparison →

Before you install

The questions you'd ask first.

Does packet capture really work on Mac, Windows, and Linux?

Yes. ShellYard ships a libpcap-backed capture tool on every platform. macOS uses ChmodBPF (the same helper Wireshark installs), Linux uses Linux capabilities on the binary (no sudo at runtime), Windows uses npcap. You pick an interface, you get live frames. Save to .pcap when you need a second opinion.

Does ShellYard replace Wireshark for deep PCAP analysis?

No, and it doesn't try to. Wireshark's dissectors are decades deep — we're not rebuilding that. ShellYard covers the 80% case inline (capture, filter, spot the retransmit pattern, see TLS handshake failures, ask Magellan what it means) and exports a real .pcap when you need Wireshark's protocol depth. The point is you don't have to leave the workspace for the first pass.

Is there a bandwidth monitor?

Yes — per-interface, in/out Mbps, real-time graph. Counter source is OS-native (no agent install). Pair it with the syslog viewer in another tab when you want to correlate a traffic spike with a log event.

SNMP — v1, v2c, v3?

All three. v3 with auth + priv. GET and WALK. Standard MIBs bundled (IF-MIB, ENTITY-MIB, BRIDGE-MIB, POWER-ETHERNET-MIB for PoE, and the usual host-resources set). You can upload vendor MIBs per Space. Known OIDs render as structured tables instead of dotted strings.

I work on a Mac — will it actually run?

Yes. ShellYard is code-signed with our Apple Developer ID and notarized. No Gatekeeper warning, no right-click-open-anyway dance. Universal binary (arm64 + amd64). On Windows: Authenticode-signed via Azure Trusted Signing — SmartScreen may show a one-time warning while the reputation builds. Linux: .deb / .rpm / AppImage.

Can I run one command across a folder of switches?

Yes — that's Bulk Command (Team tier). Select a folder of saved connections, paste a command, get a structured pass/fail table per host. Batch SSH is the same shape but with a real shell + PTY for devices that need a login shell. Both ride your existing SSH credentials from the vault.

Does Magellan see our packet captures or traffic?

No. Magellan is BYO-key — you supply an Anthropic, OpenAI, Gemini, or Ollama key. Prompts and attached tool output go directly from your machine to the AI provider you chose. Nothing transits ShellYard's infrastructure. With Ollama or LM Studio you can keep the whole AI loop on your laptop.

Open the next ticket in one window.

Install. Open the SSH connection you already use. Open MTR in the next tab. Open a packet capture in the one after that. Hand the output to Magellan. If it doesn't beat your current five-window ritual, uninstall — no account required to try it.