The integration connects these two areas by automatically synchronizing phpIPAM inventory with the primary Hosts & Subnets Lookup in Sycope. This allows information already maintained in the IPAM system to be reused across Sycope without recreating the same host and subnet structure manually.
Once synchronized, phpIPAM data can be used in Hosts & Subnets dashboards, filters, rules, reporting and Asset Discovery. Running the synchronization continuously also helps keep the Sycope infrastructure configuration aligned with changes made in phpIPAM.
Table of Contents
From IPAM inventory to network context
The integration retrieves information about IP addresses and subnets from phpIPAM and maps it to the Hosts & Subnets Lookup in Sycope.
Individual IP address entries can be synchronized together with fields such as Hostname and Description. The Hostname from phpIPAM is stored as the Name of the corresponding entry in Sycope, while the Description field is retained as additional context.
The integration also supports master subnets, subnets and nested subnets, including their descriptive information. DHCP-managed addresses can be included as well, allowing Sycope to display inventory information for addresses that are assigned dynamically.
Once the information is available in Sycope, network traffic can be analyzed using the names and descriptions already maintained by the organization in phpIPAM. Instead of working only with raw IP addresses, teams can use familiar host and subnet information throughout the monitoring environment.
Complementary capabilities, clearly divided
phpIPAM and Sycope remain independent products. The integration does not replace the role of the IPAM system; it makes selected inventory information available as context inside Sycope.
phpIPAM provides:
- IP address and subnet management
- Host and network inventory
- Hierarchical subnet structure
- Hostnames and descriptions
- Static and DHCP address information
Sycope provides:
- Flow-based network analysis
- Host and subnet dashboards
- Network traffic filtering and search
- Network monitoring rules
- Reporting
- Asset Discovery
- Network performance and security analysis
phpIPAM remains the source of structured IPAM information, while Sycope uses that information to add identity and inventory context to the network activity it observes.
Why IPAM and network monitoring work better together
Network traffic is built around IP addresses, but an address alone does not always provide enough information about the system or part of the infrastructure it represents.
Synchronizing IPAM information with Sycope adds the organizational context already maintained in phpIPAM to traffic analysis.
Faster infrastructure configuration
Hosts & Subnets is one of the primary configuration elements used by Sycope.
Instead of manually recreating the organization’s host and subnet structure during deployment, the integration can populate this information directly from phpIPAM. This can reduce manual configuration during new deployments and PoCs and provides a consistent starting point based on the existing IPAM inventory.
More meaningful network analysis
Synchronized Hostname and Description fields make it easier to identify systems while analyzing traffic.
Rather than interpreting communication only as connections between IP addresses, analysts can use the names and descriptions already defined in phpIPAM to understand which hosts or network areas are involved.
The same information can be used in Hosts & Subnets dashboards and Asset Discovery views, where hostnames provide additional context for observed devices.
Filtering and rules based on infrastructure context
phpIPAM inventory data synchronized with Sycope can be used when filtering network information or configuring monitoring rules.
Traffic can be filtered using attributes such as hostname, subnet or description, allowing teams to work with infrastructure concepts that are already defined in their IPAM environment rather than relying only on individual addresses.
This can also support more targeted monitoring rules for specific hosts, subnet groups or parts of the infrastructure.
Inventory context in reporting and Asset Discovery
The synchronized information can also be included in Sycope reports and used within Asset Discovery.
This provides a connection between the assets and addresses maintained in phpIPAM and the systems actually visible in network traffic.
For DHCP-managed environments, the integration can also bring dynamically assigned addresses into Sycope, providing additional inventory context for systems whose IP assignments may change over time.
Keeping Sycope aligned with changes in phpIPAM
The integration can be run continuously as a service rather than only as a one-time import.
When the inventory changes in phpIPAM, the synchronization process can update the corresponding information in Sycope, helping keep the Hosts & Subnets Lookup aligned with the IPAM source.
The integration supports multiple phpIPAM instances. If duplicate addresses or subnets are present across them, the configuration determines priority based on the order of the defined instances.
Administrators can also control which information should be synchronized. Individual phpIPAM sections can be included or excluded, and entries can be filtered using description prefixes. The configuration additionally determines whether inactive, reserved and DHCP-managed addresses should be included.
The synchronization process does not overwrite Hosts & Subnets entries that are not managed by the phpIPAM integration, allowing manually maintained Sycope data to coexist with synchronized inventory.
A ready, documented integration
The phpIPAM integration is available through Sycope’s public GitHub repository.
The repository includes Python components for communicating with the phpIPAM API and synchronizing inventory data with Sycope, together with configuration examples and installation instructions.
The integration supports phpIPAM 1.5 or later with API access enabled and Sycope 3.1 or later with API access. Python 3.8 or later is required to run the synchronization scripts.
phpIPAM continues to be installed, configured and maintained independently. The integration uses read access to retrieve inventory information and the Sycope API to create or update the corresponding Hosts & Subnets Lookup entries.
How the integration works
The integration consists of three main elements.
phpIPAM inventory
phpIPAM remains the source of information about addresses and subnets.
API access is configured for each phpIPAM instance that should participate in the synchronization. The integration uses a temporary authentication token generated through the phpIPAM API and reads the inventory information defined in the configuration.
Inventory synchronization
The phpipam_sync.py script retrieves the selected phpIPAM data and processes it according to the configured synchronization options.
The integration can synchronize individual addresses as well as subnet structures and can include or exclude selected sections, address types and entries according to the needs of the environment.
Hosts & Subnets Lookup in Sycope
The synchronized information is written to the Hosts & Subnets Lookup through the Sycope API.
Once available there, the inventory data becomes part of the context used across Sycope dashboards, filters, rules, reports and Asset Discovery.
For environments using master or nested subnets, the repository recommends using the Overlapping mode for the Hosts & Subnets Lookup to prevent conflicts between related entries.
Network analysis with existing inventory context
Consider an organization that already maintains hostnames, subnet structures and address information in phpIPAM.
Without integration, the same information would need to be recreated or maintained separately in Sycope. As the infrastructure changes, the two configurations could also begin to diverge.
With continuous synchronization, phpIPAM remains the source of inventory information while Sycope receives updated host and subnet context through the API.
When traffic is analyzed in Sycope, the systems involved can be identified using the inventory information already maintained by the network team. The same context can then be used in dashboards, filtering, rules, reports and Asset Discovery.
The integration therefore connects existing IPAM documentation with the network activity visible in Sycope while avoiding the need to maintain the same infrastructure information independently in both systems.
See the integration in your environment
The Sycope–phpIPAM integration brings existing IP address and subnet inventory into the network monitoring workflow.
By synchronizing phpIPAM with the Hosts & Subnets Lookup, organizations can reuse their existing infrastructure information across Sycope and keep that context aligned as the IPAM inventory changes.
Want to use your phpIPAM inventory as network context in Sycope? Talk to our team.
