Overlay networks are the modern answer to remote access: instead of publishing services, you join machines to a private mesh and let the mesh handle addressing and policy. NetBird is an open-source option in that category, combining WireGuard tunnels with an identity-aware control plane. Measuring it online produces three numbers that disagree with each other, and the disagreement describes the architecture.

The counts

ZoomEye queries on 23 October 2026, sub_type=all, page size one:

  • title="NetBird": 12,226

  • app="NetBird": 3

  • title="NetBird" && port="443": 3,292

  • title="NetBird" && ssl="netbird": 1,234
    Twelve thousand title matches against three application fingerprint matches is a large ratio. It is also a predictable one for a product whose self-hosted deployment is a web dashboard in front of an API, where the distinctive evidence lives in the certificate and the page rather than in a protocol banner.

Three interfaces, three exposure profiles

A self-hosted NetBird deployment has distinguishable parts, and the counts map onto them unevenly.
The management dashboard is the part humans log into. It is a web application, it presents a title and a TLS certificate, and it is the component most likely to be published through a reverse proxy on 443. That accounts for the 3,292 figure.
The management API is what agents and clients talk to. It is often exposed on the same hostname, sometimes on a separate port or path. It authenticates peers and distributes configuration, which makes it a control plane with credentials.
The signal and relay components carry peer traffic. They are infrastructure, they do not normally need a browser-facing title, and they are the part an organisation is most likely to leave in a cloud network without a public listener.

What a certificate count tells you

The ssl="netbird" figure of 1,234 is not a subset relationship with the title count; the two measure different artefacts. A certificate in the TLS handshake is text the organisation chose, and choosing a certificate that names the product is a small disclosure with an outsized effect on reconnaissance.
That disclosure is not a vulnerability. It is a naming decision that lets anyone confirm what runs at an address, and it survives the login page that otherwise hides the product.

Why the control plane is the asset

The interesting component in any overlay network is the one that decides who joins and what they may reach. For NetBird, that is the management service: it holds peer registrations, access policies and the keys that authenticate members of the mesh.
An unauthorised party who can reach that service has a target that a public dashboard does not offer. They see the enrolment endpoint and can attempt to obtain membership, and from inside the mesh the network looks flat in a way that its topology is designed to provide.
This is the point where an overlay network differs from a VPN concentrator. The concentrator's public surface is a single gateway with a login. The overlay's public surface includes the enrolment path that every endpoint uses, and that path has to be reachable by endpoints wherever they are.

The practical reading

A title population of this size suggests the deployment patterns are worth standardising. The fingerprint count is not a contradiction; it is a reminder that fingerprints are one instrument among several.
For an operator, the useful questions sit inside the estate.

  • Which of the three components are reachable from outside the private network, and does the dashboard require identity provider authentication rather than a local account.

  • Is the enrolment endpoint restricted to expected sources, and is there a record of every peer that joined.

  • Are certificates issued with names that describe the organisation rather than the software. A generic certificate reduces the reconnaissance value of the exposure at no functional cost.

  • Does the mesh policy separate administrators from regular peers. An overlay that gives every member reach to every other member is a flat network with extra steps.

Detection notes

Peer enrolment is the signal to watch. A new peer joined from an unexpected address, or with a name that does not follow the naming convention, is a discrete event with a timestamp, and it is the moment to decide whether it belongs.
Authentication events on the dashboard form the second record. Because the dashboard is the human interface, its logon history is short and unusually readable compared with the traffic logs of the overlay itself.

Measurement note

The counts here describe different things: a page title, a protocol fingerprint, and a certificate string. Presenting them as a single "number of NetBird instances" would be wrong in a way that matters, because the first includes documentation mirrors and demos, and the second is limited by what the index recognises. Each answers its own question, and the questions were the point.

References

  • NetBird documentation: https://docs.netbird.io/

  • NetBird source repository: https://github.com/netbirdio/netbird

  • ZoomEye queries executed 23 October 2026 with sub_type=all: title="NetBird" 12,226; app="NetBird" 3; title="NetBird" && port="443" 3,292; title="NetBird" && ssl="netbird" 1,234