Everything you need to get your NOTBOX up and running in minutes.
Your NOTBOX package includes everything you need to get started:
NOTBOX runs entirely through a web browser. There's nothing to install on your computer - just connect and open your browser.
Get familiar with your NOTBOX's ports, LEDs, and buttons.
192.168.100.1. Use when you don't know the MGMT IP or want isolated management.Devices connected to NOTBOX's built-in WiFi are treated exactly like devices plugged into the DOWNLINK port. Their traffic passes through NOTBOX the same way (captured, impaired, or monitored) and reaches the internet via UPLINK. Use WiFi or DOWNLINK interchangeably for your test devices.
There are two ways to access your NOTBOX's web interface. Choose the one that works best for your situation.
Connect NOTBOX to your existing network. It gets an IP address automatically via DHCP. The assigned IP is shown in the top bar of the interface.
Direct connection between your computer and NOTBOX. Always available at 192.168.100.1.
NOTBOX is designed to run on your local network. We don't recommend exposing it to the public internet (e.g. by port-forwarding from your router). Keep it behind your firewall where it belongs. For remote access, connect it to HENcloud instead of port-forwarding. The device makes an outbound connection, so there are no ports to open.
Follow these steps to get up and running quickly.
Plug the power adapter into NOTBOX and connect it to a power outlet. The green power LED will turn on.
Connect the MGMT port to your network with an ethernet cable. This gives NOTBOX internet access for its built-in tools and allows you to access the interface from your network.
Open your browser to the IP address shown in your router's DHCP client list. Don't know it? Connect to the LOCAL port and go to http://192.168.100.1. The MGMT IP is shown in the top bar.
Connect the UPLINK port to your router or network switch. This is a separate connection that provides passthrough internet access to your test devices.
Connect the devices you want to test to the DOWNLINK port or the optional WiFi access point, then configure and run your tests from the web interface.
On your test device, open any website. It should load normally. In the NOTBOX interface, go to the Impairment page and click ENABLE to arm it. Then click the Poor LTE preset to fill in the values and click Apply Settings to push it live. Now return to your test device and reload the website, and you'll feel the difference. Click DISABLE when you're done to restore the connection. From here, explore the Capture, Monitoring, and Tools pages for the rest of NOTBOX's toolkit.
Once you're up and running, head to Settings → Firmware Update and click Check for Updates. Keeping the firmware current ensures you have the latest features and fixes.
The local NOTBOX interface starts unlocked. To require a password, open Settings → Security, set a password, and select Lock UI. This is useful in a shared office or lab.
The front panel LEDs indicate the current state of your NOTBOX.
| LED | Colors | Meaning |
|---|---|---|
| MGMT | Green when connected, off when no link | |
| LOCAL | Green when connected, off when no link | |
| DOWNLINK | Green when connected, off when no link | |
| UPLINK | Green when connected, off when no link | |
| WIFI | Green when WiFi enabled, off when disabled | |
| STATUS | Off = booting, Green = normal, Yellow = MGMT connectivity issues, Blue = Port Mirror active | |
| POWER | Green when powered on, off when no power |
Yellow: The MGMT port can't reach the internet. Check that the MGMT cable is connected, then look upstream for a DHCP, gateway, DNS, or firewall issue.
Blue: Port Mirror mode is active. The LOCAL port is outputting mirrored network traffic for capture in Wireshark. Press the STOPCAP button at the top of the device to stop mirroring and restore normal LOCAL port access.
Make sure you're connected to the LOCAL port (not MGMT or DOWNLINK). Your computer should automatically get an IP address in the 192.168.100.x range. If it doesn't, try unplugging and reconnecting the cable, or manually set your computer's IP to 192.168.100.10 with subnet mask 255.255.255.0. Also check the STATUS LED: if it's blue, Port Mirror mode is active and the LOCAL port is in mirror-only mode.
Yes. The MGMT port uses DHCP by default, but you can give it a static IP (with netmask, gateway, and DNS) in the web interface's network settings. (The LOCAL port is also always reachable at a fixed 192.168.100.1, no configuration needed.)
Open the web interface and go to Settings → Firmware Update. The currently installed version is displayed at the top of the panel. From there you can also click Check for Updates to see if a newer version is available.
Check that the UPLINK port is connected to your router or a switch with internet access. NOTBOX bridges traffic transparently. Your DOWNLINK and WiFi test devices behave as if they were plugged straight into your upstream network, getting their IP address, DNS server, and gateway from it. NOTBOX doesn't hand out IP addresses or act as a gateway itself, so no-internet issues almost always trace back to the UPLINK connection or your upstream network.
You still need the UPLINK port connected to your router for internet access. But for test devices, yes, they can connect via NOTBOX's built-in WiFi instead of the DOWNLINK port. WiFi ships disabled by default; to enable it, click the WiFi indicator in the header bar of the web interface and configure the SSID, band, and password.
No. Impairments won't affect your access because they only apply to the UPLINK, DOWNLINK ports, and WiFi. The main exception is Port Mirror mode, which temporarily makes the LOCAL port mirror-only until you stop mirroring.
No. NOTBOX only impairs devices connected to its DOWNLINK port or WiFi, and only when impairment is enabled. With it off, traffic passes through untouched, and the rest of your network is never affected.
A bandwidth cap is a ceiling, not a guarantee, and once you add latency or packet loss, TCP throttles itself: it backs off on every lost packet and can only keep so much data in flight before waiting for acknowledgements, so higher round-trip time alone lowers throughput. The more delay and loss you apply, the further real TCP throughput sits below the cap - exactly what happens on a congested or long-distance link.
NOTBOX is a transparent inline bridge, so it sees the whole network segment it’s plugged into, not only your test device. Even with nothing on DOWNLINK or WiFi, the UPLINK side is always receiving background broadcast and multicast traffic (ARP, mDNS, SSDP, multicast, spanning-tree, etc.) that crosses the bridge. That ambient “chatter” is what shows up in the bandwidth monitor and captures. Completely normal.
Press and hold the Reset button (small recessed button near the power jack) for 10+ seconds. The device will restart and return to factory defaults. Note: This will clear saved settings, WiFi passwords, locally stored capture files, and, if the device was connected, its HENcloud link.
Upload impairments affect traffic going from your test device to the internet (like sending files, video calls from your side, form submissions). Download impairments affect traffic coming to your test device from the internet (like streaming video, downloading files, loading web pages).
Yes! You can connect a network switch to the DOWNLINK port to test multiple wired devices, and any number of devices can connect via WiFi. All devices connected through DOWNLINK or WiFi will experience the same impairments. The impairment settings apply to all traffic passing through.
NOTBOX is designed to be private. By default, it runs locally on your network and only reaches the outside world for two background tasks:
8.8.8.8 and resolves google.com every few seconds so the device knows whether the internet is reachable0.openwrt.pool.ntp.org through 3.openwrt.pool.ntp.org), with Cloudflare time servers (time.cloudflare.com: 162.159.200.123 / 162.159.200.1) as a fallback when DNS is not yet available at startupEverything else only happens when you ask for it, like checking for firmware (hellernetworks.com) or running one of the built-in tools:
speed.cloudflare.com). No account or signup needed.ipify.org, a free public IP lookup service.rdap.org, a registry data service for WHOIS-style info.standards-oui.ieee.org) once, then uses the local cached copy.Only when you connect the device to HENcloud. Every connection is outbound from the device, so there are no inbound ports to open or forward.
tn.hencloud.hellernetworks.com over TCP 443 (TLS). A persistent connection the device keeps open while it is linked, so the dashboard can reach it.turn.hencloud.hellernetworks.com over UDP 3478, falling back to TCP 443 when UDP is blocked. Used only while a capture streams to your browser or an on-device capture downloads through HENcloud.Your captures, impairment settings, and test traffic stay on the device unless you download or stream a capture. When connected, HENcloud receives the operational status and network metadata needed to manage the device.
The local NOTBOX interface uses HTTP so it works immediately without certificate setup. Access it from a trusted management network and do not expose it through internet port forwarding. For encrypted remote access, connect the device to HENcloud.
Local PCAP downloads use the same HTTP connection as the NOTBOX interface, so your browser may display a warning. Download captures only over a trusted management network. HENcloud uses encrypted WebRTC for remote capture transfers.
In the device's web interface under Settings, Regulatory & Licenses. That page carries the FCC notice and the open-source license list.
Can't find what you're looking for? We're here to help.
When you reach out, have your device's Serial handy. It's on the sticker on the bottom of the unit, and in the web interface under Settings → Firmware Update.
What HENcloud addsHENcloud is completely optional. If you don't connect your device to HENcloud, it continues to work as a local-only appliance. HENcloud lets you reach it from anywhere, manage more than one unit, and invite your team.
Factory resetting the device will require a new claim code.
The device shows as online in your dashboard. To stop cloud management at any time, use Disconnect under Settings → Cloud Management on the local page. The device goes offline in the dashboard right away and returns to local-only.
Invite people to your organization and give each one the right level of access.
| Can | Viewer | Admin | Owner |
|---|---|---|---|
| View devices and their health | ✓ | ✓ | ✓ |
| Run captures, impairment, Wi-Fi, monitors, tools, and downloads | ✓ | ✓ | ✓ |
| Change network, firmware, and device security | ✗ | ✓ | ✓ |
| Add or remove devices and claim codes | ✗ | ✓ | ✓ |
| Invite and manage team members | ✗ | ✓ | ✓ |
| Manage owners and delete the organization | ✗ | ✗ | ✓ |
No. HENcloud is completely optional. If you never connect the device, it keeps working as a local-only appliance with every feature intact.
A few things stay on the device itself: saving captures to a network share (SMB or NFS), API automation (scripts run against the device on your network, not through HENcloud), and Port Mirror mode (feeding the LOCAL port straight into Wireshark). Everything else the device does is available in HENcloud.
No. Capture data goes from the NOTBOX to your browser over encrypted WebRTC, directly when the network allows it. If a direct path is blocked, the Heller Networks TURN relay forwards the encrypted WebRTC traffic. HENcloud does not read or persist capture payloads.
Yes. Every device you claim shows up in one dashboard, so you can switch between units and see which are online at a glance.
Yes. Invite people to your organization as owner, admin, or viewer. Viewers can operate any device (captures, impairment, Wi-Fi, monitors, tools, and downloads) but can't manage the fleet or the team. Admins also manage devices and members, and owners also own the organization. See the Team roles table above for the full breakdown.
Open the NOTBOX local page, go to Settings → Cloud Management, and select Disconnect. The device goes offline in the dashboard right away and returns to local-only. Reconnect later with a fresh claim code.
No. Every connection is outbound from the device, so nothing needs to be opened or forwarded. If your network restricts outbound traffic, allow these two destinations:
tn.hencloud.hellernetworks.com, TCP 443turn.hencloud.hellernetworks.com, UDP 3478 (falls back to TCP 443)At idle, almost none. Linked to HENcloud, it keeps one outbound connection open and reports its status every 15 seconds: about 4 MB a day, around 120 MB a month. Tools you run and captures you download or stream add to this, depending on their size.
The device keeps doing everything on your own network. Cloud access simply resumes on its own once the connection is back.
Yes. You can enable authenticator-app two-factor authentication from your account's Security settings.
A factory reset clears the cloud link on purpose. Add the device again in HENcloud to get a new claim code, then enter it under Settings → Cloud Management.