Shapes

The palette

The palette is the left-hand panel. Drag its edge to make it wider and the tiles reflow into as many columns as fit — three at about 320px, five at the widest — so a wide dock shows more shapes, not more space between them. It lists the whole shape catalog, grouped into sections in this order:

Colour comes from the family, which is deliberately not the same list as the sections — garnet for security, cobalt for network, viridian for compute, violet for data, teal for cloud, olive for OT, bronze for people, slate for annotation. That is why Network, Optical transport and Places share one blue and the two OT sections share one olive: a section is only a heading, so splitting a long group needs no new colour. Only the icon is coloured; the tile itself stays neutral, which is what keeps a large diagram calm.

Making the panel wider

Drag the palette's right edge to make it wider or narrower — the cursor changes to a resize arrow as you cross it. The width is remembered on this device, and a double-click on the edge puts it back to the standard width. Nothing is stored until you change it.

Patch panels and PDUs

Three shapes exist for the things in a cabinet that are not devices in the usual sense.

A patch panel is drawn as a 1U panel with rack ears and a matrix of ports, and it carries no arrows at all — the arrows on a router, an L3 switch and a switch say how far the device forwards traffic, and a panel forwards none. Search for it by pp, odf or patch. A cable that stops at a panel buys no transceiver at the panel's end — the panel is glass, not a cage — so a switch-to-panel fibre counts one module, at the switch. A console server is the wide chassis with a >_ prompt on its face: the out-of-band way in when the network is down. It answers to terminal server, oob and serial console. A PDU is the tall zero-U strip with a lightning bolt over its outlets, and it sits with the UPS under OT — field & facility rather than under Network, because power is the same subject on both. Search for it by power strip or power distribution.

Two of those words used to find something else — pdu reached the UPS and console server the protocol gateway. They now reach the real shape. Drawings made before that are unaffected: the search words are only how you find a shape in the palette, and a device you already placed keeps whatever it was.

Optical transport

Three more shapes draw a WDM line, under their own Optical transport heading — type dwdm, wdm or mux to find them. They are read against each other: the prism, a wedge that is narrow where the line arrives and wide where the channels leave, is what says "wavelengths", and an outline around it is what says "a device with power in it".

A DWDM terminal is the prism inside a shelf: the whole box at one end of a line — a muxponder shelf, a CWDM chassis, an optical line terminal. It answers to dwdm, cwdm, wdm, olt and optical line terminal. A Mux/Demux is the prism on its own, with no box around it, because there is nothing powered in a filter: use it for a passive mux, an OADM or a ROADM, and find it by mux, demux, multiplexer, oadm, roadm or optical filter. A Transponder is the plain wide chassis with a client port, an arrow and two ripples on its face — grey client in, one coloured channel out. It answers to transponder, muxponder, txp and wavelength converter.

The Mux/Demux being the one without an outline is not only a drawing. A cable end on a Mux/Demux buys no transceiver, because the filter is glass: a transponder-to-mux channel is counted as one module and not two, in the optics block, the Optics report and the Optics CSV. The cable itself is a cable like any other — it is on the Cables tab, in the schedule and in the device's own list — and if you hold that channel's cable selected, the line under the cable type says which end the module is for: one at TXP-1’s end · MUX-A is passive.

A terminal drawn as one box can carry its own channel plan. Select a DWDM terminal or a transponder and there is a Port map under Network: one row per channel — the client port, the channel it rides, the line port it leaves by (C1 → C21 → LINE). The channel box offers the C-band grid and the CWDM wavelengths, and takes anything you type. This is the one place a device lists its ports, and it exists because a single box has no cables inside it for the plan to be read off: a shelf drawn as a group gets its plan from those cables instead (see Optical shelves in the Canvas chapter), and when a device is in such a group the group's cables win.

Everything else follows from the rows. The tile wears a small λ badge — click it and the panel comes back to the map. A cable plugged into a client port says what it carries at that end: C1 becomes C1 · C21, derived on every redraw, never stored, so changing a row changes the label. The box becomes a site in Tables → Channels, a fibre between it and another mapped box (or a shelf) is a span carrying the channels both ends state, and a channel stated twice on one span is the same Checks finding a shelf would get. The map round-trips through .drawio, .vsdx and DOT, reaches the people you are sharing with, and travels with a copy — so duplicating a terminal gives you the other end of the line with the plan already in it. The λ badge is the editor's: no export carries one.

Telling a router from a switch

The three devices you draw most often are deliberately drawn to one rule, so you can read a topology without reading the labels. The shape tells you what the device is and the number of arrows tells you how far it forwards:

Every arrow is drawn identically across the three, so what you are comparing is only the outline and the count. Zoom out on a core-and-access diagram and the tiers separate on sight.

Drawing who gets in

Three shapes cover privileged access, and they say different things:

• PAM (Security) is privileged access management — the thing that holds the credential, hands out a session and records it. It is drawn as a screen with a user on one side and a padlock on the other. Search pam, pim (Entra's name for the same job), credential vault, break glass or session recording.
• Jump host (Security) is the box the traffic passes through — a bastion in the DMZ, drawn straddling a dashed boundary with one arrow in and one out. Reach for it when the point of the picture is the path; reach for PAM when the point is who is allowed and what was recorded. Many drawings want both, side by side.
• User group (People) is a set of people rather than a person — a department, a role, a directory or LDAP group, the contractors. It is the User shape drawn three times over, so a page mixing individuals and groups reads at a glance. Search group, role, ad group or team.

PAM shares its screen-on-a-stand outline with the Engineering workstation and the Desktop on purpose — all three are a session at a screen, and only what is drawn on the screen differs — and they never share a colour, so they do not get confused.

Where the accounts live

Two shapes sit either side of a login, and they are easy to mix up.

A Directory (Data) is the store — the user objects themselves. It is the Database cylinder with a person inside it in place of the usual course of rows, because that is what it is: a database of people. Reach for it for Active Directory, an LDAP tree, OpenLDAP, FreeIPA or Entra ID, and find it by ldap, domain controller, user database or identity store.

An Auth server (Security) is the thing that answers — a server with a key badge: the RADIUS, TACACS+ or IdP box a switch, VPN or portal asks "is this person allowed in?". It usually reads its answer from a directory, so a drawing that shows 802.1X in full has both, with a line between them. User group (People) is neither of those: it is a set of people in the picture, not a system that holds them.

A Visio file whose shapes are called "Directory server", "Domain controller" or "Active Directory" now imports onto the Directory. Before it existed they arrived as a DNS server, which was the closest badge we had.

The machine at the other end

Five shapes in People are the thing a person is actually using, and they are deliberately different pictures rather than one box with a label.

• Laptop is the open laptop — a screen, a hinged deck and a base bar. Search notebook, macbook or portable.
• Desktop is the machine on a desk: a screen on a centre-post stand with nothing drawn on it. It is the same outline as the Engineering workstation and PAM, because all three are a session at a screen, and the blank screen is what says "just a computer" — those two have a ladder rung and a padlock on theirs. Search pc, workstation, computer, tower or thin client. A workstation and a desktop are the same thing here, so all three of those words lead to this shape; workstation also reaches the Engineering workstation, which is honest — it is named that — and the Engineering workstation is listed first because OT comes before People in the palette.
• Endpoint is a client of any kind: the Desktop's monitor with a phone standing in front of it. Reach for it when the point of the drawing is that something connects, not what it is — a NAC or 802.1X picture, a port count, a diagram where the clients are not the subject. Search client, end device, end host, client device or station.
• Managed endpoint is a laptop with a shield on its screen: a client under a management or EDR agent, so it says something the plain shapes do not. Search managed client, endpoint agent or edr.
• Mobile is the handset or tablet. Search phone, smartphone, tablet or byod.

desktop, pc and workstation used to find the Laptop — it was the only client in the catalog — so searching for a desk machine answered with a portable one. They now reach the Desktop. A drawing made before that is untouched: search words are only how you find a shape in the palette, and a device you already placed keeps whatever it was.

A Visio file whose shapes are called "PC", "Workstation", "Desktop PC", "Terminal" or "Thin client" imports onto the Desktop; one called just "Client" or "Endpoint" onto the Endpoint. A switch's LLDP table that advertises only the (S) Station capability also lands on the Endpoint, because "station" is all the switch said — it used to arrive as a laptop, which was a guess.

Drawing an attack

The Attack section holds the vocabulary for telling a security story, drawn to one rule:

• Attacker is the hostile actor — the User's own shoulders wearing a solid black hat, the black-hat hacker. It is always garnet, never the bronze of the users beside it, so the threat stands out on a busy page. Search hacker, threat actor, adversary or apt.
• Home (Places) is the remote worker's site — a house alongside Branch office and Campus. The person is a User and their machine is a Laptop; Home is the place they connect from. Search wfh, home office or teleworker.
• Clean / Malicious / Unknown file are a document sheet stamped with a verdict badge: a check, a radiation mark or a question mark. Use them for what moves through the picture — a download, an attachment, a payload.
• Clean / Malicious / Unknown website are a browser window carrying the same three badges. Use them for where the traffic goes — a phishing page, an unrated site, an allowed one.
• Infected laptop is the Laptop shape with the radiation mark ringed on its screen — the endpoint after the malicious file ran. Search compromised, pwned or patient zero.

The verdict shapes are the one place in the palette where colour means status: clean is green, unknown is grey, malicious is red — the same three verdicts whether stamped on a file or a website. The badge mark always says the same thing as the colour, so the verdict never depends on telling red from green. And the radiation mark is the one signal for "malicious" everywhere it appears: on the file, the website and the infected screen alike.

Finding a shape

• Search — the box at the top of the palette filters by name, catalog key and alias. Aliases are built in, so fw finds Firewall. Multiple words all have to match. Escape clears the box. Catalog keys work typed in full, hyphen included — l3- finds L3 switch — so an id you have read in a .dot file leads back to its picture. Press / anywhere on the canvas to jump straight into the box, and Enter there arms the first shape in the filtered list and gives the canvas back — so a shape is a slash, a word and a click away without ever reaching for the mouse. A few things with no shape of their own are found as the one that draws them: a direct-attached storage shelf is Storage — search das, jbod or disk shelf — because it is block storage cabled to one server, while NAS is storage on the network.
• Its DOT name — hover any shape and the tooltip gives you its kind= value, with a small copy button in the tile's corner that puts the bare id on your clipboard. That is the whole point of the palette for anyone writing diagrams as code: find the device by its picture, take the word, paste it after kind=. The Diagrams from code chapter lists every value.
• Collapse — click a family heading to fold that group away. The count next to the heading tells you how many shapes are inside. Collapse all / Expand all does every group at once. Your collapsed groups are remembered.
• If your text is bigger than ours — the palette is a fixed width, so a browser minimum font size or an unusual system font can make a category name longer than the room it has. When that happens the name is shortened with an ellipsis and the whole name is in its tooltip; the count stays beside it, and Collapse all and Connector stack onto two rows rather than one of them being cut off. Nothing ever ends up outside the panel.

Your own shortlist

Most drawings lean on a handful of shapes. Two places keep yours at hand, and you configure each on its own:

• ★ Favorites in the palette — hover any tile and a small star appears in its corner; star it and the shape joins a pinned ★ Favorites group above Security. Hovering a section heading reveals a star too, which pins the whole category. A favorite tile behaves exactly like its original — click to arm, drag to place, same search. Star it again anywhere to remove it.
• The ★ Quick menu in the toolbar — the star button opens a dropdown of shapes you chose for it; picking one arms click-then-place just like a palette tile, which is handy when the palette is buried under a long drawing. Press Customize… inside the menu to star shapes or whole categories for it; search works there like everywhere else.

The two lists are deliberately separate — starring a shape in the palette does not put it in the toolbar menu, and vice versa — so each place can hold what makes sense there. Both are remembered per browser, like your collapsed groups.

Placing a shape

Three ways, all fine:

• Press D with the pointer where the device should go, type a few letters of its name — fw, sw, plc, a model you imported — and press Enter. It lands under the pointer.
• Click the shape in the palette, then click the canvas. The palette button stays lit while it is armed; click it again, or press Escape, to disarm.
• Drag the shape from the palette straight onto the canvas.

The device picker

D opens the device picker beside the pointer. It holds a search field, the shapes that match it, and the same thirteen sections as the palette. The search finds what the palette's search finds — names, catalog keys like l3-switch, and the everyday abbreviations — and puts the best match first. A name that is exactly what you typed comes first, then names that start with it, then names with a word that starts with it, then shapes that only match through a keyword. Arrow keys move the lit row and Enter places it. Drag a row out onto the drawing to place it somewhere else, and Esc puts the picker away.

Open it and press Enter straight away to place the same device as last time: with nothing typed, the shapes you placed most recently come first. While you search, they wait as a Recent row under the results. Browse opens a section and lists what is in it. Imported device types are listed first, under My shapes, with their height and port count beside them.

With the pointer away from the drawing — on the bar, say — the picker places in the middle of what is on screen. In Studio the dock's Device opens it too. In Studio the palette itself is a drawer: switch on Shapes drawer in Edit layout and it floats along the drawing's left edge.

New nodes are placed centred on your click and snapped to the 8 px grid. Devices come in at 96 × 80; Internet and Cloud are wider (120 × 88) because they read as places rather than boxes; a Zone starts at 320 × 220 and a Rack at 240 × 316 (12U).

Unknown shape kinds — from a file authored elsewhere — always render, falling back to the Generic shape rather than disappearing.

Changing what a device is

Select a device and use Device in the inspector. It is a searchable list, grouped by the same families in the same order, alphabetical inside each. Matching works exactly as it does in the palette, so fw finds Firewall here too. With several devices of different kinds selected the control shows "Mixed"; picking a kind changes all of them.

Labels

• Double-click a device (or a zone, or a connector) to edit its label in place.
• Or select it and type in the inspector's Label field.
• Enter commits the edit. Shift+Enter (or Alt+Enter) inserts a line break instead — labels can be several lines. Escape cancels.

The edit box grows with what you type, in both places, so a long description stays readable while you write it.

Long labels

A label that does not fit wraps on its own; you only need Shift+Enter when you want the break somewhere particular.

How many rows you get depends on where the label sits. Outside the tile nothing is competing for the space, so it can run to six rows. Inside the tile it shares the tile with the icon, and each row takes height away from it — so it gets only what the tile can spare while the icon is still recognisable:

Past that limit the caption ends in an ellipsis (…) and hovering it shows the whole text — nothing you typed is lost, and the full label is always in the inspector's Label field. Making the shape taller raises the inside limit; making it wider fits more on each row.

So if a label is really a sentence rather than a name, put it Below, where it gets six rows and may overhang the tile a little — that reads better than a narrow stack. Container titles (zone, rack, Purdue band) and rack unit names stay on one row whatever you type: they sit in a fixed-height band, and a break you type there becomes a space.

Role and functions

Two devices of the same kind rarely do the same job, and until you say so a drawing cannot tell you which is which. Two inspector fields do that, and they are deliberately different from each other so you never have to work out which one you are reading.

Role — where it sits. One short tag, drawn on a tinted band across the top of the tile in the device's own accent colour: EDGE, ISFW, DCFW, CORE, ACCESS. A device sits in exactly one place, so this is one value.

Functions — what it runs. A comma-separated list, drawn as a quiet line under the device's name in ordinary sentence case: VPN, IPS, Web filter. One box usually runs several things at once, so this is a list. A list too long for the tile ends in "+2 more" rather than being cut off silently.

Both fields have a ▾ at their right-hand edge that opens the vocabulary for whatever you have selected — and the vocabulary follows the device, so a switch is offered core, distribution, access, top-of-rack, spine, leaf and management while a firewall is offered edge, internal segmentation, data center, DMZ, branch, cloud, OT, distributed and host-based. The role list shows each tag beside the name it stands for, so you do not have to remember that "internal segmentation" is written ISFW. The function list is grouped the way you would describe the box — inspection, access, network, platform — and you tick as many as you need: the list stays open, and ticking one that is already on takes it off again. There is a search box in both, matching the long name as well as the tag.

The list is an offer, never a rule. Both fields are ordinary text, so type TRANSIT or PCI in Role if that is what your site calls it, or add a function nobody else has — just separate functions with commas. A device kind that runs nothing worth naming gets no ▾ at all rather than a list it cannot fill; you can still type whatever you like.

The short way to remember it: the band on the tile is where the box is, the line under the name is what it does. They never share a style — the band is a code in mono capitals in the accent colour, the line is plain muted text.

Both travel everywhere the rest of the drawing does: they survive save and reload in .drawio and .vsdx, reach the people you are sharing a live session with, appear in the auto-legend (a kind used at two roles gets two rows, which is usually the point), get their own columns in the inventory CSV, are findable with Ctrl/⌘+F, and show up in the device panel of an exported interactive HTML file. Compare reports a changed role as re-roled rather than as a restyle, because it is a fact about the network and not a look.

One thing they deliberately do not do: the format painter leaves them behind. Copying the look of your edge firewall onto the data-center firewall should carry colour and type, not turn the second one into another edge firewall. Duplicate and paste do carry them, because a copy means "another device like this one".

Name position

The Name position buttons, on the inspector's Look tab, set where a device's caption sits relative to its tile — Inside, Below, Above, Left, Right:

Image nodes default to Below instead, because a caption drawn on top of a bitmap is unreadable.

A tile too small to hold its name defaults to Below as well — under 64px wide or 56px tall, which is where an inside caption is down to one short line and starts ending in an ellipsis. That is the size you end up at when you shrink sites to fit several onto a country map, and a marker whose name you cannot read is not a marker. It is only the default that moves: press Inside and the caption goes inside however small the tile is.

An inside caption shares the tile with the icon, so the icon takes the room the name leaves: a one-line name draws a bigger icon than a two-line one beside it. When a row of devices has to read as one system at one size, put their labels Below — an outside caption takes no room from the tile, so every icon in the row draws the same.

Rack units ignore label position: their name is always drawn inline in the unit strip.

Label align

Label align sets whether the caption sits left, centred or right over the tile's width. Centred is the default, and what every label was before.

It applies to the Inside, Below and Above positions — the ones that sit over the tile, where there is a width to align within. With the label Left or Right of the tile its anchor already is the tile edge, so there is nothing left to align it against and the buttons are greyed out.

Alignment works on a multi-row label as a block: every row shares the same edge, so a left-aligned two-row caption is flush left on both rows. It applies to Text and Callout blocks too — that is the same control those have always had, now in one place for every kind.

Colour and text

Color in the inspector is a row of swatches: a default swatch that removes any override and returns the item to its family colour (for nodes) or the theme line colour (for connectors), then the eight family accents read from the theme the app is running in, then — after a hairline — the six brand colours: red, green, teal, blue, purple and silver. The hairline marks a real difference in where those colours come from. The family accents are the current theme's own values, so the row offers the palette the rest of the drawing is already using; the brand colours are fixed and identical in light and dark, so a drawing that has to match a style guide keeps the right red wherever it is opened. Either way, the colour you click is stored on the object as a fixed value — only the default swatch keeps following its family, and so keeps changing with the theme.

Any colour at all

The last chip in the row is Custom…, and it opens the full brand sheet: each of the six hues in a column, five darker shades above the base and five lighter tints below it. Click a square and it applies. Underneath are two other ways in — a Hex field, where you can type or paste a value (#1a2b3c, and the # is optional) and press Enter, and Pick…, which opens your system's own colour picker, with its eyedropper, its sliders and whatever swatches you have saved there. On a Mac that is the macOS colour panel; the colour follows along on the canvas as you move around in it.

All three work on connectors exactly as they do on shapes, and on any number of selected items at once. The Custom… chip lights up when what you have selected is a colour the row itself cannot show — a brand tint, or something you pasted in — so the row never looks as though nothing has been set.

How big the writing is

Document text scale lives in Document info — the app menu, then Document info…, under the Text heading — rather than in the inspector, because it belongs to the drawing rather than to anything selected, and the inspector is hidden when nothing is. It sizes every label at once — device names, connector labels, port labels, zone and rack titles, text blocks — so a diagram that is going to be printed at A3, or read on a projector, becomes legible in one move instead of thirteen. It is one setting for one question, which is why there is no font size per kind of label.

The Font size field beside it is an override for whatever you have selected: a device, a zone, a text block, or a connector (which sizes its own label and both its port labels together — one connector, one size). Leave it empty and that object follows the document scale, and keeps following it when you change the scale later; the greyed number in the field is the size that currently produces. Type a size and that object stops following — deliberately, so a heading you made big stays big when you scale the rest of the drawing. Reset empties the field again.

Update all clears every override on the page in one step, so a document somebody has hand-tuned into a mess goes back to following its scale. It says how many objects it changed, and it is a single undo if you did not mean it.

A label positioned inside its tile wraps at the tile's width, so at the largest scales a long name stacks and the icon gives up some room. A single word that cannot fit never breaks in the middle: it stands a little proud of the tile instead, on the same allowance a Below label gets, with its halo keeping it readable over whatever it crosses — and only a name too long even for that is shortened with an ellipsis. If a large scale makes an inside caption feel cramped, the remedies are the same as ever: put the label Below, or make the shape bigger.

How heavy the lines are

Line weight sits directly under the text scale in Document info, under its own Lines heading, and it is the same kind of setting: one question about the whole drawing, three answers. Fine, Normal and Bold multiply every line on the page at once — every cable, and every outline: device tiles, zones, racks and their units, basic shapes, group frames, callout boxes, map and Purdue frames, title-block cells, lines and flow arrows. Normal is where a drawing starts and is what every file made before this existed opens at.

It multiplies rather than replaces, so the drawing keeps its own vocabulary: a trunk stays visibly heavier than an access link, a fieldbus run stays the thinnest thing on the page, and a WAN link's dashes grow with it so it still reads as dashed rather than turning solid. It multiplies rather than replaces because width is also how the drawing says what KIND of link something is — a trunk heavier than an access link — and a page-wide setting that flattened that would cost more than it gave. Document weight moves everything that has no width of its own; a single connector's Thickness sets that one connector's width in pixels and is then left alone by this control. See Thickness on the Connectors page.

Reach for Bold when a diagram is going onto a projector or a printed A3 sheet, where thin lines disappear; reach for Fine for a dense fabric on screen, where the default weight starts to crowd. The setting is part of the document, so it travels with the file, with everything you export — SVG, PNG, PDF, the HTML viewer, Visio — and with anyone you are sharing the drawing with.

What it deliberately does not touch: the pictogram inside a device tile (it is an icon, not a border), the halo behind a label, the ruling inside a rack or a Purdue backdrop, and the highlight the editor draws round whatever you have selected.

Everything else about a shape's look — tile fill, outline colour, shadow — comes from the design tokens and is not individually settable. That is deliberate: one good default beats a styling panel. (The label's weight, slant and typeface are the exception, and they have their own row — see Text style on the Canvas page.)

Alignment used to live beside the font size and now applies to any node's text — see Label align above.

To copy a look from one item to another — the format painter — use Copy look then Paint in the inspector's toolbar, or the same two from the keyboard: ⌥⌘C copies the look and ⌥⌘V paints it (Ctrl Alt C and Ctrl Alt V on Windows and Linux). It carries the whole look rather than a selection of it. For a shape that means the colour, where the caption sits and how it is aligned, its size, weight, slant, underline and typeface, the size of the shape itself, and — on a basic shape — whether it is dashed or filled and how faded it is. For a connector it means the colour, the connector type, the link type, the speed, the cable medium and wavelength, whether the cable runs through the icons instead of stopping at them, where every caption sits along the line, and the same typography again. The rule is that if it changes how something looks, the painter takes it — with one deliberate exception: a fact about your network is never a look, even when the drawing shows it. A device marked Planned is drawn dashed, a rack unit's Power feed draws a chip, and a cable's VLAN, addresses, circuit and provider all show on the page; none of them paint. "This box is in the building", or "this link carries VLAN 10", does not become true of the next object because it was true of this one, and painting it would put something false into your drawing. What the painter never takes either is what a thing IS or where it is — the words in a label, a cable's ends or its bends, which aggregate a cable belongs to, or a tick on the cable schedule. Anything else left behind is a bug worth reporting. A look only paints onto its own kind — if you copied a connector and then select a device, Paint tells you so rather than doing nothing, and if the thing you are painting onto already looks like that, it says that too rather than leaving you wondering. Size is stricter still: it only moves between like objects — a device's size onto a device, a zone's onto a zone — so painting a firewall's look across a zone recolours it without collapsing it to tile size. Rack-mounted units and racks keep their managed sizes either way, and so do lines and flow arrows: a line's size is just wherever its two ends are, so painting a device's size onto one would move its ends, and painting a flat line's onto a device would flatten the device. Everything else about a line's look — its colour, whether it is dashed, how faded it is — paints exactly as it does on any other shape.

Text and callouts

Two annotation shapes, both in the Annotation family:

• Text is a floating block of writing that belongs to no device — a heading, a note, a caveat. Press T to arm it without leaving the canvas; T again, or Escape, puts it away.
• Callout is the same block with a leader line pointing at something. Drag the leader's tip to aim it; it follows when you move the callout.

The writing follows the box's width, and the box follows the writing's height. A long sentence wraps at the block's width, and dragging the block narrower or wider re-flows it — press Shift+Enter while typing where you want a break of your own, and that break always stays. The height is the text's: the box grows as you type, when you narrow it, or when you raise the font size, and a box that was hugging its text shrinks again when you widen it or delete some. Nothing is ever cut off to fit, and the outline, its handles and its connection points always sit around all of it. You can still drag a box taller than its text, to line it up with something — that height is kept as its minimum — but dragging it shorter stops at the last line.

Double-click to edit in place. The editing field opens exactly over the block, at its width and in its type, and grows as you type, so you are never editing one copy of the text while looking at another. That holds the very first time too: the click that places a block opens the field as the box the block is about to be, so the writing does not move when you press Enter.

The box shrinks to one line of its own writing. How small it goes follows the Font size you set, so a small label can hug its line — at 8 px the box stops at about 32 × 19 — and a tiny caption no longer sits in a box three lines tall, covering the devices and cables it is labelling. The same rule going the other way means a large size keeps a large box: it can never be squeezed inside its own first line. A bubbled callout keeps a little more, so its outline stays clear of the text.

Bullet and numbered lists. With a text block or a callout selected, the inspector's List row turns the whole label into a list: Bullets puts a • in front of every line, Numbers numbers them from 1. Press a pressed button again and the markers come off, leaving the words exactly as they were. You can also just type a list — - , * or • at the start of a line, or 1. — and while you are typing, Shift+Enter carries the marker down to the next line for you, counting up if it is a numbered one. An empty item ends the list: press Shift+Enter on a line that is only a marker and the marker goes away, which is how you stop. A list is nothing but the characters in the label, so it travels everywhere the label does — into the .drawio file, every export, and a collaborator's screen — and nothing has to know it is a list.

Two things follow from that, both worth knowing. The numbers are text, so inserting an item in the middle does not renumber the ones below it; when that happens the Numbers button un-presses, and pressing it once puts the numbering right. And a list you indent with spaces becomes a sub-list — indented text keeps its indent, and an item too long for the block wraps underneath its own words rather than back under its bullet, so a four-line note still reads as two items. Indenting works in the text block and the callout, where the writing is set flush left; a device's name is centred under its icon, so the List row is not offered there.

For either one, the inspector offers a Font size, and the Label align buttons set left / centred / right. A callout also has Callout → Bubble: off by default, so a callout is plain text with a leader; on, it draws the note inside an outlined bubble. That is one toggle rather than a border sub-model — a note that needs per-side styling wants a shape, not a note.

Style → Label style sets a text block like a cable's or a port's own caption: the caption's smaller size, its muted colour, and the halo — the outline in the page's colour that keeps a caption legible where it crosses a line. Use it for an address or a VLAN that has to float on its own rather than sit on a port, so it reads like the ones that do. Its own Font size, colour and bold or italic still win over it, and pressing Label style again sets it back to plain text.

Neither is a routing obstacle: a cable passes straight through a text block, which is what you want from writing laid over a diagram.

Nor does a note hide a cable. A text block laid over a cable does not take the cable away from you: select the cable first — click it anywhere clear of the note — and its line and its endpoint handles are then yours even where they run inside the note's box, and the pointer shows the cable's pointing hand there rather than the note's move cross. With nothing selected, a click on the note picks the note, so a caption sitting on a cable is still easy to grab.

Flow arrows

A Flow arrow (Annotation family) is a bold red arrow for showing where traffic goes — packets into the DMZ, an attack path, a replication direction. It is an annotation about the drawing rather than a cable: it routes around nothing, it carries no speed or link type, and a connector cannot end on it. Its ends can be fastened to devices, exactly as a Line's can — see The Line is a connector under Basic shapes.

Pick it from the palette — or press F — and drag on the canvas: the arrow runs along the dominant axis first with one right-angle bend, or hold Shift for a straight diagonal. Start the drag on a device and let go on another and the arrow arrives fastened to both — the device under the tip lights up as a cable's target would — so it follows them when they move, exactly as an end you drag onto a device afterwards does. Where the two devices are nearly level, the bend would land under the second one, so the arrow is drawn straight from border to border instead. Move a device over an existing bend later and the same thing happens — the arrow draws straight into it rather than doubling back out of its far side — and the bend is only hidden, not lost: its round handle is still there to drag out, and moving the device away again draws the bend as you left it. A plain click places a default arrow to shape afterwards. While an arrow is selected, drag its round point handles to reshape it, click a diamond mid-segment to add a bend, and double-click a point to remove it — an end is a point like any other, and removing a fastened one lets go of its device at the same time. It never drops below two points. Moving the arrow moves the whole shape.

Everything a connector's caption can do, the arrow's label does too: double-click the arrow (or use the inspector's Label field) to write on it, then place the caption with the same Label placement controls — start/middle/end, above/on/below, follow the arrow — or just drag the caption where you want it. The inspector's Flow arrow row switches Solid/Dashed and One way/Both ends, and the colour swatches recolour it; the default red stays out of the family palette so your devices keep their meaning.

In isometric view the arrow lies flat in the floor plane, exactly like cables, so it keeps pointing at what it annotates from every camera corner. On save it becomes a native draw.io arrow, so the file opens correctly in vanilla draw.io.

Blocks → Flows puts every arrow on the page into one table — what each runs from, what it runs to, and its caption — and keeps it up to date as you move them. See The Blocks menu is five switches below.

Asset data

A device carries seven optional fields: Management IP, under Network on the inspector's Facts tab, and under Details Model, Serial, Chassis ID, Location, Notes and Link. On a device that has none of the six, Details is one Add model, serial, location… button rather than six empty boxes; press it and they appear, with the caret in Model, and a device that has any of them shows them all. Two more things sit under Network beside Management IP and are not fields: Status, below, and — on a rack unit only — the Power feed, described under Racks.

The device card

Select a device and the inspector's Facts tab reads top to bottom as what it is and where it sits. At the top, its name, set large, beside its kind's icon in the kind's colour, and under the name a chip for each thing it touches: the layer it is on (press it for Layers), the zone it stands in, and how many cables it has (press it for the Cables tab). Then Network — Kind, Role, Functions, Management IP, Status — then Details, then Placement: the layer, the zone it is in with Detach, its group, and Trace path when two devices are selected. At the foot is the card's toolbar: Bring to front, Bring forward, Send backward, Send to back, Copy look, Paint, and at the far end Delete, which does exactly what the Delete key does. How it looks — colour, icon, text, and where its name goes — is on the Look tab.

Chassis ID is the MAC address a device's LLDP neighbours identify it by. An import from switch output fills it in — written one way, 74:78:a6:c3:24:80, whichever notation the switch printed — and a later import that sees the same chassis matches this device rather than drawing another, however short the switch cut the name it printed. Only a MAC counts: a chassis id that is an address or a name says nothing stable about which box it is. You can type or correct it like any other field, and copying a device leaves it behind, like the serial and management IP.

Link is the URL of whatever documents this device — its NetBox page, its management UI, a runbook. An Open button sits beside the field and lights up for an http:// or https:// address (management UIs on a LAN are routinely plain http); press it and the page opens in a new tab, or in your normal browser from the desktop app. Only those two schemes ever become clickable — anywhere: here, and in the HTML viewer export — so a link someone else typed into a file you opened cannot run anything. Copying a device deliberately leaves the link behind, like the serial and management IP: it names one physical unit's page, not the kind of device.

A Link can also point at another page of this document — a site on a WAN overview that jumps to that site's own page. Pick it from Link to page… under the field; the picker lists every page except the one you are on, and a note under the field reads → page Site B so you can see where the link goes. Open then switches page instead of opening a window. The link follows the page, not its name: rename the page and the link still works; delete it and the note reads → page (missing) and Open goes quiet. A page link is stored the way draw.io stores its own, so the same tile jumps between pages there too — and in the HTML viewer export, where it switches tab.

The picker's first choice is New page "name", named after the device: it adds that page and points the Link at it in one step, and leaves you where you are — so linking every site on an overview is one pick per site rather than a trip to the + button and back each time. One ⌘Z / Ctrl Z takes the page and the link away together. It is not offered when a page of that name already exists; pick that page from the list instead.

A device whose Link goes somewhere carries a small round badge on its top edge, near the left corner: a page symbol for a page of this document, a box-and-arrow for a web address. Click the badge to follow the link — to the site's page, or out to the web page in a new tab. Clicking the device itself still just selects it, and double-clicking still renames it; only the badge navigates. A link to a deleted page, or to anything that is not a web address, gets no badge, because there would be nothing for it to do. The badge belongs to the editor, not the drawing: no export carries it. After following a page link, ← page at the front of the page tabs takes you back — see Pages.

Status answers one question three ways: is this device really there? Installed changes nothing on the canvas — an installed device looks like a device. Planned draws the tile with a dashed outline, the same dashed-versus-solid language the basic shapes use, so a floor plan of what is planned and what is in the building reads at a glance. Not tracked is what every device starts as. Status applies to everything you have selected, so you can mark a whole rack row installed in one press; when the selection disagrees no button is lit and the row says Mixed.

A device that is not tracked is neither installed nor planned, and it draws solid, so opening an older drawing never turns it into a wall of proposals — and Not tracked takes a device back there. The state travels everywhere the rest of the asset data does — the overview map, the object list's Status column, the CSV inventory, exports, and the file itself, where it is stored as draw.io shape data called installed — and Compare reports it in words, "marked installed" or "marked planned", rather than as a restyle. Copying a device does carry it, unlike the serial: a copy of a planned device is a second planned device.

It is a fixed set, not a property grid, and it is the same set an audit asks for. What it feeds:

• Export → CSV inventory writes every device on every page with these columns — including the devices that have none, because the point is to show what is undocumented — and then where it stands: Rack, U, Zone, Installed and Power. Export → PDF with schedules prints the same table after the drawing sheets.
• The HTML viewer export shows all six in its details panel when you click a device, and renders the link as a real, clickable link there (http/https only — anything else is shown as plain text), or as → page Site B, which switches to that page's tab.
• The object list (≡ menu → Objects) shows → page Site B beside a device that links to a page, and searching a page's name finds the tiles that jump to it.
• ⌘/Ctrl F searches all six, so a serial number or a management IP typed into find lands on the device that carries it, and the counter says which field answered.
• A zone's Subnet (CIDR) compares against Management IP for its gentle out-of-subnet hint. If a device has no management IP, the hint falls back to reading an address out of its label.

The fields round-trip as draw.io's own shape data, so what Drawbridge writes is exactly what draw.io's "Edit Data" dialog shows, and a file that gains data in one opens with it in the other. The Link field goes one better: it is stored as draw.io's own link attribute, so a file we write opens in draw.io with the shape clickable there too, and a draw.io file whose shapes carry links opens here with them in the Link field.

Copying a device carries the shared traits — model, location, notes — and deliberately not the management IP or serial: those identify one physical unit, and two devices with the same serial is worse than two with none, because it looks like real data and would flow straight into the inventory.

Racks

A rack is a container drawn as a 19-inch elevation: a title strip at the top, side rails, and a rule per U. R arms the rack tool from the keyboard. U numbers run up the left rail with 1 at the bottom, like a real rack. Racks paint behind devices and are never obstacles for cable routing.

• Resize — a rack snaps to whole Us in height, minimum 4U, and cannot get narrower than a device tile plus its rails. The Rack height (U) field in the inspector sets it numerically.
• Mount by marking — drag down the U rows inside a rack to mark a span; releasing creates a rack unit there, spanning those Us.
• Put a device in — drag a device into a rack, or place one there straight from the palette (click with a shape armed, or drag it off the palette), and it is mounted: it becomes a rack unit, a 1U strip the width of the bay on the U you aimed at, and the rack counts it. A device type you imported mounts at its own height and depth instead, as it does from the rack builder. If that U is taken it slides to the nearest free one, down first; a full rack leaves the device loose rather than stacking it on a unit. Drag a unit back out and it is an ordinary device again, at its usual size. Grab it anywhere, including the middle: dropping a shape into a container always places it, and never draws a cable to the container. (To cable something to a rack or a zone, hover the device and drag from one of its connect handles.)
• Move a mounted unit — drag it up or down the rails; it moves in whole U steps, keeps its height and depth, and stops at the last U that fits.
• Delete a rack — its units go with it, along with anything else standing in it, and one undo brings them all back. What dragging the rack would leave behind — something you Detached, or that sits on another or a locked layer — stays. A zone works the other way: delete it and the devices on it stay where they are.

How full it is

Select a rack and its card reads Rack — its Height, its Location, Show the rear and Open the rack builder — then Units: one row for each unit mounted in it, top of the rack first, with the U it sits at (U12, or U9–10 for a 2U unit), its name and "rear" for one in the back bay. Press a row and that unit is the selection. A rack has no Subnet: subnets are a zone's.

The rack card in the inspector, and the rack builder's header, both say how many Us are in use out of how many the rack has — 18 / 42 U. A rack showing both elevations names them separately (Front 18 / 42 U · Rear 6 / 42 U), because one number over two bays answers neither question. A full-depth unit occupies its Us on both faces, so it counts once on each; a unit that hangs off the bottom of a rack you have shortened only counts the rows that are still there.

Where the rack stands

A rack carries a Location — the one asset field a container is offered, because a rack is a place. Anything mounted in it inherits that Location in the inventory CSV, in the NetBox devices CSV and in describe.json, so documenting forty units is one field rather than forty. A unit's own Location always wins where it has one, and nothing is written onto the units: move the rack to another hall and everything in it follows; drag a unit out of the rack and it goes back to having no location rather than keeping a stale one.

Power

A rack unit can say which power feed it is on: A, B, or A·B for dual-fed. It is drawn as a small chip at the unit's right edge, in the unit's own colour, so a column of chips down an elevation answers "what goes dark if I drop feed A" at a glance.

Select a unit (or several) and press one of the three chips in Power, under Network. Pressing the chip that is already lit clears the field back to not recorded — which is what every unit starts as, and is not the same thing as "unpowered": nothing is drawn, and the inventory cell is empty. A mixed selection says Mixed, and pressing a chip puts them all on that feed.

The feed travels everywhere the rest of the unit does: the inventory CSV's Power column, .drawio and .vsdx files, describe.json, a collaborator's screen, and Copy/Duplicate. The format painter deliberately leaves it behind — "this switch is on feed B" is a fact about the room, not a look. There is no PDU or power topology to draw: this is a chip, not a cable.

Rear elevation

Elevations → Show rear draws a second elevation beside the front one, sharing a centre rail. Marking U rows on an elevation gives you a unit on that face, so U10 front and U10 rear can hold two different units.

Mounting depth

For units in a two-elevation rack, Depth decides whether the opposite face stays usable:

Full is the default. A front-only rack has no opposite face, so its units are always full depth.

The rack builder

Double-click a rack's title strip to open the rack builder — a full-screen view of one rack, with both elevations drawn large. It is a view over the same document, not a separate one: undo, collaboration and file round-tripping all work normally, and the canvas behind stays live.

In the builder you can:

• Search the device list on the left, click a device to arm it, then click a free U to mount it. Click the armed device again to disarm.
• Drag a mounted unit to another U, or to the other elevation.
• Select a unit to rename it, make it taller or shorter by whole Us (− / +), set Full / Half depth, or Remove it.
• Toggle Show rear without leaving the builder.

The builder refuses exactly the mounts the canvas would refuse: it will not overlap an occupied U or hang a unit off the bottom.

Mounting a device type

If you have imported a device type (see My shapes below), it sits at the top of the builder's device list under a My shapes heading, with the room it will take beside it — 2U, or 1U ½D for something half depth. Mounting one is a single click: it arrives at its real height, on the right depth, with its model already in Asset data → Model, and wearing its picture if you gave it one.

Heights are rounded up to whole Us, because the drawing works in whole Us and a rack row that is half taken is a row that is taken. A 0.5U device therefore takes one U, and the unit's Notes says so — 0.5U device, drawn in 1U. — so anyone counting space off the drawing can find out that two of them fit where the picture gives room to one.

Zones and virtual contexts

Zone is a dashed, tinted container with an uppercase title along its top or bottom edge — at the top left unless you choose another place; Z arms it from the keyboard. Virtual context (VDOM / VRF / VSYS as a container) behaves identically. Both paint under devices, never clip them, and are never obstacles — a connector may pass straight through.

A zone owns what stands on it: move the zone and its contents move with it, whichever way you move it. When one object should not travel — a label that belongs to the page rather than to the zone, a device you have placed exactly — Detach it, from the inspector or by Alt-dragging it. Select the zone and anything it will leave behind fades back — and the inspector counts what travels — so you can see the whole answer before you move it; an ordinary drop back into the zone re-attaches an object. Release all, under Contents on the zone's own card — beside the count of what it carries — detaches everything on it in one step. See Moving and resizing for the whole rule.

Where the name sits is the inspector's Name position: Left, Centre or Right on its Top row or its Bottom row, always inside the zone. Every zone in the selection moves at once, the format painter carries the choice from one zone to another, and a .drawio or .vsdx file keeps it. A zone's name can also run to more than one line — Shift+Enter breaks the line while you type it, on the canvas or in the inspector — so a site can read Stockholm DC over Site 4.

A zone that has not been given a Name position moves its own name out of the way: when a cable crosses the edge the name sits on, the name slides along that edge — left, then centre, then right — to the first clear spot, taking all of its lines and its subnet row with it. Pick a position yourself and it is left exactly where you put it, cable or no cable. If every spot along the edge is crossed the name stays where it is, which is easier to read than a title that has wandered to the other end of the box.

A zone can carry a Subnet (CIDR) annotation, e.g. 10.20.30.0/24. It is purely annotational: it appears quietly on a line of its own under the zone's name — Stockholm DC, then 10.20.0.0/16 — and drives a gentle hint when a device inside carries a management IP outside that subnet: the device is marked on the drawing, and the zone's card names it under the Subnet field — FW-01 is outside 10.20.0.0/16. A device standing in a smaller zone that has a subnet of its own answers to that zone instead. There is no address management or allocation.

The hint reads the device's Management IP first. Devices that have none are judged on an address found in their label instead, so a drawing labelled fw1 10.20.31.5 is still checked; fill in a management IP and that is the one that counts, whatever the label says.

The field takes a subnet and only a subnet. Type something that is not one and the box outlines itself in red and nothing is written — the zone's title never presents prose as though it were a network. An IPv6 subnet such as 2001:db8::/32 is accepted as a label; the out-of-subnet hint is IPv4 only, so an IPv6 zone simply gets no hint. Clearing the field removes the annotation.

Folding a zone

A zone can fold to one tile that says what it holds. Select it and press the small arrow at its top-right corner, or Fold zone in its card or its right-click menu. The zone becomes a tile at its top-left corner, in its own dashed look and colour, carrying its name, its subnet and a line per kind of device inside — Virtual machine ×17 · Storage. A site with VLANs inside it lists each VLAN on a line of its own instead. Everything the zone would carry when you drag it is hidden behind the tile; a device you have detached, or one on another layer, stays on the page.

The cables keep working. A cable from a device outside to anything inside ends on the tile, and all the cables from ONE device arrive as one line labelled with how many it stands for — seventeen VMs on a host are one ×17 line, not seventeen. A cable between two devices inside is not drawn while the zone is folded. The Cables tab, the cable schedule and every CSV still list every cable with its ports, because folding changes how the zone is drawn and nothing else.

Drag the tile and the zone moves with everything in it. A double-click on the tile, or Open zone, puts the zone back exactly as it was; folding and opening are each one undo step. A folded zone stays folded in every export — SVG, PNG, PDF and the HTML viewer, where a click on the tile opens it — and in .drawio, .vsdx and Graphviz DOT files.

The bus

The Bus (network family) is the classic shared-segment bar: a thin strip that devices tap into perpendicularly, each at its own position — for "these devices are on the same network" without a zone box or a mesh of cables, and for internal fabric links (NPU, backplane, ISL) where a bar reads better than a cable.

• Connect devices to it like to any node; each cable drops onto the bar next to its device. Crowded taps push apart to a minimum spacing, and beyond capacity they spread evenly — one device or a hundred, never a pile-up.
• The bar grows automatically as you connect more devices (in the same undo step as the connect). It never shrinks by itself — resize it like any node; make it taller than wide and it becomes a vertical bus.
• The label sits above the bar; the Color swatches recolour it.

Map underlays

There are two kinds, and they behave differently on purpose.

Both come from the same control: the Add place… picker in the palette, under the search box.

A backdrop. The picker's first group, Backdrop, holds the world and the five regions — Americas, EMEA, APAC, Europe, Nordics. Choosing one drops that map behind the current page, sized to cover what is already there and shaped to the region itself, so Europe arrives as Europe rather than as a world map with most of the world cropped off. It goes on its own layer, placed beneath every other layer, so it stays scenery in the saved file as well as on screen. A map is scenery in every sense: it paints under everything, is never a routing obstacle, and cannot take a connector endpoint. One backdrop per page — pick another and it selects the one you already have, so you can change its extent in the inspector, which reframes the map and carries the devices standing on it.

Country objects. The rest of the picker — every ISO country and territory, grouped by continent — drops one country as an ordinary object, sized to that country's own shape, drawn on its own with no neighbours — a clean silhouette, with no border or background card around it, and its name underneath. Add as many as you like — each new one lands beside the last, so a run of them reads as a row — and then arrange them however the picture needs. That is how you build a country visualization without an EMEA or world map underneath it. From Russia down to Singapore, Malta and Monaco, each group sorted alphabetically. Each map goes on its own layer, named after it ("Map: Sweden", "Map: Finland"), so with several on a page any one of them can be hidden or locked from the Layers menu without touching the others; adding the same country twice reuses its layer.

Select the map and use the inspector's Map extent picker to choose what slice of the globe it draws — World, the regions (Americas, EMEA, APAC, Europe, Nordics) or a single country. Changing the extent reframes the map: it is resized so roughly the same number of device tiles fit across it at every scale, and devices standing on the map are carried geographically — a device over Stockholm on a Europe map is still over Stockholm when the map becomes Sweden — provided every device lands inside the new frame.

A country map is deliberately not drawn at world scale — the whole page would only be legible at a fraction of a percent — but it is sized to hold a working number of sites: a United Kingdom comes out about ten default tiles across, and shrinking sites towards the minimum (where their names move below the tile and stay readable) fits comfortably more. If a particular map still wants more room, it resizes like any other shape.

The neighbours checkbox chooses between drawing the country with its surroundings (the default) or on its own.

Every place stands upright. A single country or state is drawn flat, re-projected on its own central meridian — the way it looks on its own local map, not leaning the way it does at the edge of a world wall map. The United States sits square, Japan and Australia stop tilting, and countries the world map's edge cuts in half draw whole: a solo map of Russia or the Aleutians is one contiguous place. The world and region extents keep the classic world-map projection, because there the curve of the meridians is the point; showing a country's neighbours draws them in the country's own upright frame, so ticking the box never moves the country. Nothing is squashed or stretched to do this — it is the same geometry, looked at from straight on.

US states are countries to the map. The picker has a United States group with all fifty states and DC, and a state behaves exactly like a country: pick Texas from Add place… and it lands as a silhouette on its own Map: Texas layer, or set a map's extent to a state to frame it. With neighbours shown, the surrounding states are drawn with their borders, so a state map has the same context a country map gets from national borders. The outlines come from US Census Bureau geometry and are drawn in the same projection as the rest of the map, so a device carried between a state and a country extent stays over the same place on the globe.

Show cities marks the map's ten biggest cities — dots with names, sized to the map. Where several of them sit on top of one another — Dallas, Ft. Worth and Arlington share one metroplex — the names are placed around the cluster, one to the left, one to the right, one underneath, so all ten stay readable rather than three of them running together. Every extent has its own list: the world's ten, a region's ten, a country's ten, a state's ten. It is off by default — a map you drew yesterday looks exactly the same today — and it is there for the same reason devices carry geographically: sites belong on real places, and "over Göteborg" is easier to hit when Göteborg is marked.

The Show border and Show background checkboxes control the map's frame: the rounded outline around it and the faint tinted card behind it. A backdrop shows both by default — the frame is the map's edge — while a country added from the picker shows neither. With both off, the map is just its land, and its label sits under it like any other shape's.

The map's label is what names it on the page, so an EMEA extent can be called "Nordics" if that is what it represents to you. The map's layer follows its name the same way: pick Sweden and the "World map" layer becomes "Map: Sweden" — in the same undo step — unless you have renamed the layer yourself, in which case your name stays.

A map's layer belongs to the map: it holds only maps, so nothing else can be moved onto it and new shapes never land there, and it lives and dies with them. If you have locked that layer, adding another copy of the same place is refused with the lock as the reason rather than dropped somewhere else — a map only ever lives on a map layer, so there is nowhere else for it to go. Delete the map and its layer disappears in the same undo step (a layer shared by two copies of the same country stays until the last one goes); delete the layer from the Layers menu and the map goes with it. Pasting a map brings its layer back — cut a map, paste it elsewhere, and it arrives on its own bottom layer again.

The icon library

≡ menu → Icon library puts the whole catalog on one page: every icon, grouped into the same sections as the palette, with its catalog key underneath. There is a search box, and picking an icon arms it and closes the dialog, so browsing ends in drawing rather than in hunting for the same shape again in the palette.

The catalog key under each icon (plc, data-diode, purdue) is the name the shape is saved under in a .drawio or .vsdx file, and the name a CSV import will match — useful if you are writing one by hand.

Your own icon on a device

Select a device and the inspector offers an Icon section: Replace… takes a PNG, JPEG or SVG of your choosing — a vendor logo, a product face — and puts it in the tile's icon slot. Everything else about the device stays the house style: the card, the label, the role band, the colour, the asset data. Reset returns the catalog icon.

A few deliberate rules:

• An SVG stays a drawing; anything else becomes a small picture. An SVG is kept as vector, so it stays sharp at any zoom and in a large PDF — but it is cleaned on the way in: scripts, embedded web content, event handlers and links to anything outside the file are removed, and what is left is drawn the way a browser draws a picture, which runs nothing, here or in anything you export. A PNG or JPEG is scaled to 128 pixels on its longest side. Either way the icon must fit in 64 KB, and one that does not is refused with a message.
• A copy keeps the icon — a copy should look like the original — but the format painter does not paint it: an icon is the device's identity, and painting it would put one appliance's face on another.
• It travels in the .drawio file (draw.io preserves it and shows the device as it always did) and reaches every picture export and the minimap. The one place it does not survive is a .vsdx — Visio interchange drops it, like other page furniture.

My shapes — importing a device type

The palette has a My shapes group above Security, with a + in its heading. That + imports a device type: one file describing one model of hardware — how many Us it takes, whether it is full depth, and what every one of its ports is called.

The files come from the community-maintained NetBox devicetype-library, which covers several thousand models and is public domain (CC0). Find your model there, save the .yaml, and open it here — or simply copy the file's text and paste it into the box. Nothing is downloaded by the app: there is no URL to type and no library to browse, because Drawbridge makes no network requests beyond its update check. The file comes from your disk or your clipboard, and that is the whole story.

The dialog shows you what it understood before anything is stored — Fortinet FortiGate 100F · 1U · half depth · 29 ports — and asks for the two things a device-type file cannot tell you:

• Draw it as — which shape represents it: firewall, switch, router, server, and so on. A suggestion is made from the interface list (mostly optical, or a lot of copper Ethernet, reads as a switch), and it is only a suggestion; whatever you pick is what is stored.
• Picture… — optional. The library keeps elevation photographs beside each .yaml, but they are not inside it, so this is a file you choose yourself. It goes through exactly the same pipeline as Your own icon on a device above. A photograph is scaled down to a small bitmap; an SVG keeps its vector shape, so it stays crisp however far you zoom in and on the biggest sheet the PDF export will print.

What an imported device type gives you

Once it is in My shapes, it has a tile in the palette that you click or drag like any other:

• Placing one draws an ordinary device of the shape you chose — same card, same label, same everything — that arrives with Model filled in (Fortinet FortiGate 100F) and wearing its picture. It is one undo step, and from that moment it is a normal device: nothing about it is special, and nothing else in Drawbridge has to know it came from a file.
• Mounting one in a rack takes its U height and its depth — see Mounting a device type under Racks.
• Naming its ports — on the Cables tab, the port field for that device grows a small ▾ offering that model's interface names, searchable, with its console ports at the end. It is an offer and not a rule: the field is still free text, so a breakout or a logical interface you type yourself is as valid as it ever was. A device that did not come from a device type has no ▾ at all.

Ports are matched by the Model field, so a device you typed the model into by hand gets the same suggestions, and changing that field is how you take them away.

A whole folder of icons at once

Vendors publish their icon sets as a folder of SVG files — often hundreds of them. Choose a folder… at the foot of the import dialog takes the lot in one gesture: every .svg in the folder becomes a shape you can place, named after its file. 3cx-Supply-Chain.svg becomes "3cx Supply Chain".

Two things happen on the way in that are worth knowing about:

• Light and dark versions are paired up. Most sets ship two files per icon, one of them named -white for use on dark backgrounds. They are recognised as the same icon and merged into one entry, so a folder of 1571 files becomes 796 shapes instead of two nearly identical rows for everything.
• Nothing is stored until you have looked at it. The dialog shows what it found — 796 icons · 775 light/dark pairs merged · 3 skipped — and names anything it could not read. Then it asks the one question a bare picture cannot answer: Draw them all as. That defaults to Generic, because an icon on its own says what a box looks like and not what it is; pick something else if the whole folder is switches.

You get a sample of the faces rather than all of them — a few hundred thumbnails is not something anyone reads — with a line saying how many more are coming. Every icon you reviewed is added, not just the ones drawn.

Imported icons are vector, so they stay sharp at any zoom and on an A1 sheet. They keep no rack height and no port names, because an icon set does not know them: if you want a device type's Us and interfaces, import the .yaml as above and give it a picture. Drawbridge ships no vendor icons of its own and never downloads any — these are files from your disk, kept in your browser.

Keeping and sharing them

My shapes live in this browser, like your favourites and your collapsed groups — with room for a couple of thousand of them, so a whole icon set fits. In the import dialog, Export… saves every device type you have as one .dbshapes.json file, and Import… takes one back — which is how a team ends up drawing with the same models, and how you move them to another machine. Importing replaces by model, so re-importing a corrected file updates the entry rather than growing a second one. Remove in that list deletes one; devices already on your drawings are untouched, since they are ordinary devices.

Purdue level backdrops

Purdue levels in the palette (Annotation family, or just search purdue) drops a backdrop that draws the seven bands of the Purdue / ISA-95 model — 5 enterprise, 4 site business, 3.5 industrial DMZ, 3 site operations, 2 area supervisory, 1 basic control, 0 process. Like a map it is scenery: it paints under everything, is never a routing obstacle, and cannot take a connector endpoint. A conduit crossing a level boundary is the subject of the drawing, not something to route around.

It is one node, not seven stacked zones. That is deliberate — the bands are derived from the node's box, so they cannot drift apart, and a device's level stays readable from its y position no matter how much the page is edited. Resize the backdrop and every band scales with it.

The bands are not equal height: levels 3, 2 and 1 get more room because that is where devices actually accumulate, while level 5 is usually one cloud and a user. The industrial DMZ is drawn as a seam rather than a band — heavier fill, dashed edges — because that boundary is the reason the diagram exists.

Devices snap into a level: drop or drag one onto the backdrop and it lands centred in the band its middle falls in, so getting a level lined up takes no alignment tools. Only the vertical position is snapped — where a device sits left-to-right in its level is yours to choose. Tiles of different heights are centred rather than top-aligned, so a wide Internet tile still reads as part of the same row as the devices beside it. A device inside a rack keeps the rack's U slot: the rack wins.

Level numbers and names live in the rail down the left, never as captions inside the bands, so a device standing in a band cannot cover them. The rail is not fenced off, though: the snap only moves a device up or down, so one dropped on the rail stays where you put it and hides the number beside it — drag it right, into the band, and the level reads again. Narrow the backdrop past a point and the rail keeps the numbers and drops the names.

The OT — Purdue Plant template starts you with a populated one, with the backdrop on its own "Purdue levels" layer so you can switch the whole thing off from the Layers menu and keep a plain plant topology.

Legends

Blocks → Legend in the toolbar is a switch: tick it and a legend is built from what the active page actually uses. There is nothing to configure. It contains:

• the device kinds present on the page (containers and pasted images are skipped — they explain themselves), each as a small tile with its name beside it — a Line gets a sample stroke between two squares instead, like a link row, because a line's name would otherwise be written along the sample itself,
• the semantic link types in use, drawn with the real rendering rather than an imitation,
• every provider named on a cable, in with the link types, drawn in the style that carrier's own cables use,
• the link speeds in use with their colours,
• an aggregate entry when the page has one.

The legend is made of ordinary nodes and edges, so it exports, prints and syncs like anything else. You can park the frame anywhere and edit its labels; a refresh rebuilds the content in place, keeping your position and your label edits.

Don't need a row? Delete it. Click the row you do not want and press Delete, and it stays gone — the legend remembers, so the next edit to the page does not put it back. A link, speed or Line row is the two small squares and the sample line between them; deleting any part of it takes the whole row. One undo brings a row back. To start over, clear Blocks → Legend and tick it again: that rebuilds every row, including the ones you deleted. Deleting the legend's backdrop still takes the whole block, as it always did.

The Blocks menu is five switches

Legend, Optics, Title, Revisions and Flows are switches, not buttons. A tick means that block is on this page: tick it to build it, clear it to take it away. Nothing has to be selected on the drawing, so a block parked behind a rack comes off as easily as one in plain sight.

The menu stays open while you work it, so putting a legend and a title block on a page is two clicks rather than four, and it closes when you leave it — click the canvas, press Escape, or open another menu.

They are all the same kind of thing: built from the page, the document or the file, kept up to date on their own, and made of ordinary shapes so they export, print and share like the rest of the drawing. What each one is built from:

• Legend — what this page uses: device kinds, link types, speeds.
• Optics — the transceivers this page's cables call for.
• Title — the drawing's own paperwork, from the document's details.
• Revisions — the revisions saved in this file: rev, date, who and what changed, oldest at the top.
• Flows — one row per flow arrow on this page, with what each end runs from and to.

Switching a block off is one undo step and takes nothing else with it: the other blocks stay where they are, and what you typed into a title block lives on the document, so switching it off and on again brings your content back with it. A page with nothing to say is the one case a switch declines — a legend on an empty page, or an optics block where no cable needs port hardware — and it says so and goes back off rather than leaving you a tick over nothing. Revisions and Flows never decline: switch either on before there is anything to list and you get the empty frame, which fills itself in as you go.

A block already on the page follows what the page holds, so deleting the last thing it describes leaves it empty rather than gone — the frame stays, with its title, and fills back in the moment there is something to say. Only the switch takes a block away, which is what makes undo work: delete a page's devices and one ⌘Z (Ctrl+Z) brings them and their legend back together.

In Studio: the page card

In Studio the five switches are not in a menu: click empty canvas so nothing is selected, and the Facts panel shows the page. At the top is the page's name — type in it to rename the page — with where it sits ("Page 1 of 3") and how many devices and cables it holds. Under that, four sections:

• Blocks on this page — the same five switches, as a checklist, each with a note saying what that block would hold right now: "refreshes itself", "sheet 1 of 3", "4 transceivers", "2 saved", "no flow arrows yet".
• Document — Title, Organization, Created by, and the Revision with its date and a New revision button, which steps the number and stamps today's date in one undoable step. All document fields… opens Document info for the rest: initials, dates, what changed, the title block's logo.
• Drawing — Text scale, Line weight (Fine, Normal, Bold), and how new cables are drawn (Auto, Direct, Arc), which is remembered on this device rather than in the file.
• Branding — the Watermark (type your own or pick DRAFT, CONFIDENTIAL…), the Classification strip above and below the drawing, and the logo stamped behind it with the corner it sits in.

It is the same document either way: a block ticked here is the block the Blocks menu builds, and a revision stepped here is the one Document info would have given you. If you float or hide the Facts panel in Studio, the card has nowhere to show, so Blocks comes back to the ☰ menu until the panel is docked again.

The revision table

Blocks → Revisions puts this file's saved revision history on the sheet, as the four-column table an engineering drawing carries beside its title block: REV, DATE, BY and DESCRIPTION, oldest first so the newest is the last line. It reads the revisions you saved with the toolbar's Revisions button — the same list that dialog shows — so saving another one adds a row to the table without your touching it, and deleting one takes its row away.

The REV column shows the revision the document called itself when the snapshot was taken, and falls back to the snapshot's own number — #4 — on a drawing that does not name its revisions. The date is the whole stamp, to the minute, so two saves on the same afternoon do not read as the same row.

It is off unless you ask for it, and a file with no saved revisions gets an empty frame that fills in from the first save onwards. Rename the frame if "Revisions" is not what your standard calls it; the rows themselves are rewritten on every refresh, so edit those and the next save puts them back.

The flow table

Blocks → Flows lists this page's flow arrows: what each one runs from, what it runs to, and the caption written on it. It is the answer to reading a busy page and asking which arrows are on it and where they go.

Each end is resolved the way you would read it. An end fastened to a device names that device, even where the device is standing inside a zone — you said which one it was. An end that floats names the zone or container it lands in, and the innermost one where they nest, so an arrow into a VRF inside a site says the VRF. An end over nothing says so with a dash rather than guessing. Move an arrow and the table follows it.

Rows run in the order the arrows appear down the page, not the order you drew them, so the table can be read against the drawing.

Title blocks

Blocks → Title in the toolbar switches on a title block: the bordered grid an engineering drawing carries in its corner, with your logo, the drawing's title, the date, the file name, who drew it and the current revision.

It is off unless you ask for it. No new document, template or opened file grows one on its own — a sketch you are thinking with should not have paperwork attached to it.

Double-click any cell to fill it in. What you type is stored on the document, not on the cell, which is why:

• a multi-page drawing shows the same author on every page, and correcting it once corrects all of them,
• the printed PDF and the cable schedule name the same person,
• refreshing the block never eats what you typed.

Document info… in the app menu fills in every field at once, and is where you choose the logo. Tick the box there to remember your name, organization and logo for the next drawing. Save, Return or a click outside the dialog keeps what you typed, as one step to undo; Cancel or Escape leaves the drawing as it was.

A title block says which revision the drawing is at; it does not say how it got there. Blocks → Revisions adds the table that does, built from the revisions saved in this file — see The Blocks menu is five switches above.

The revision is yours, always. Nothing in the app ever steps it for you — not saving, not editing, not rebuilding the block. Issuing a revision is a decision, so it takes one: New revision in Document info steps the number and stamps today's date into the fields, where you can still change both before saving. Type whatever scheme you use; R2, V10.20.30 and Issued for construction are all fine.

The revision date is only filled in once you have actually revised something — on a new drawing there is one date, not two.

On a multi-page drawing the block gains a SHEET cell — 2 of 3 — taken from the document's own page list, so it cannot disagree with reality.

Two cells look after themselves. FILENAME follows the file the document is saved as — including the moment you Save As, so what is written to disk already says the right thing. TITLE falls back to the page's name until you give the document one of its own.

It moves as one. Clicking any cell selects the whole block, so a drag takes all of it; deleting any cell removes all of it, rather than leaving a grid with a hole in it. To work on a single cell, double-click it — that drops you inside the block, exactly as it does for a group, and from there you can drag or resize that one cell.

Columns adjust. Select the block and drag any column divider — the vertical rule between two cells, the way a spreadsheet works. The neighbour in the same row gives up what you took, so the grid stays a grid. A cell has no position of its own — dragging one moves the whole block — because a cell pulled out of its row would only leave a hole. Widen the last cell in a row and the block itself grows. Cells resize widthwise only — heights belong to the row — and what you set is kept through every later refresh. If a block ever ends up out of shape, switch Blocks → Title off and on again: a grid that no longer adds up is laid out fresh, and nothing you typed is lost, because the content lives on the document.

It is furniture, not a device: no connectors attach to it, and a cable dragged across it goes to whatever is behind.

Selecting any generated block — a title block, a legend, an optics block, a revision table or a flow table — shows a small card naming it rather than the usual property rows. Those blocks are rebuilt from scratch whenever their source changes, so a colour or a label position set on one would be thrown away at the next refresh. Where a rename does stick, the Label field is still there: legend entries, and the title on the optics, revision and flow blocks, can be renamed and keep it.

The block is made of ordinary nodes, so it exports, prints and syncs like anything else, and you can park it wherever you like. When a page carries one, a PDF export drops its own small footer band — one title block to a sheet.

Branding a drawing

Document info… → Branding stamps the marks an organization puts on a drawing before it leaves the building:

• a watermark across the sheet — DRAFT, CONFIDENTIAL and three more are one click, and the field takes anything you type;
• a classification, printed as a strip above and below the drawing;
• your background logo, behind the diagram, in the middle or any corner;
• a strength slider for how strongly the watermark and logo paint.

Setting a classification fills the watermark too, so marking a sheet CONFIDENTIAL is one choice rather than two — type something different in Watermark and you get both, which is how you stamp DRAFT across a CONFIDENTIAL sheet.

It all sits behind the drawing, and the strength is capped: a watermark that hides a device name has made the drawing worse to protect it. The watermark is sized to the drawing it crosses — a longer phrase and a smaller drawing both make it smaller, so it always fits inside the sheet rather than running off the edges. A page with nothing on it has no drawing to mark, so on a new drawing the marks arrive with the first shape you place. It appears on every page, in everything you export and in what you print — a mark only on screen would be decoration rather than a control.

Branding is a property of the document, not shapes on the page: you cannot select it, drag it or delete it by accident, it never appears in the object list or the cable schedule, and turning it off leaves nothing behind. Tick the remember box and your logo, organization, name and classification carry to the next drawing.

Images

Paste an image from the clipboard, or drop an image file on the canvas, to create an image node. Images are embedded in the document.

• Inputs over 20 MB are rejected; anything that is not an image is ignored.
• Stored pixels are capped at 1024 px on the longest side. PNGs stay PNG, JPEGs re-encode, small files pass through untouched.
• A pasted image lands the size it looked on screen — a screenshot taken on a Retina display counts its pixels at half, as the screen did — up to about half of the canvas you can see, so it always arrives whole and in view. It is never enlarged, so a small picture stays sharp. It arrives selected, so it is one resize away from any other size. To make a vendor icon into a device, set it as that device's custom icon instead.

Groups

Select several nodes and press ⌘/Ctrl G (Group) to bind them by identity, not by position — members stay grouped however you move them. Selecting, moving, duplicating or deleting any member acts on the whole group. The group's frame is derived from the members' bounds; it is never a stored shape.

• Ungroup (⇧⌘/Ctrl G) dissolves it.
• Delete the group itself by clicking its frame — the dashed outline, or an MC-LAG pair's or a stack's outline — on its edge, or the group's name above it. That selects the group: the frame turns solid and the devices' rings go faint. Delete then dissolves the group and the devices stay where they are; one undo puts the group back. Click a device instead and Delete deletes the devices, as above.
• Collapse / expand folds the group down to one object that keeps its cables: every connector to a device outside the group re-attaches to it, and the ones between two members are hidden inside it. A group of one kind of device draws as that kind's tile with a ×N marker; a mixed group keeps the plain titled box. Double-click it to expand again — nothing was moved.
• Double-click a member to enter the group and select just that one; double-click again to edit its label.

Groups are different from zones: a zone contains by geometry, a group by membership.

Arrange and align

Several selected at once

Select several devices and the inspector's Facts tab is about all of them: its header says 3 devices selected (or objects, for a mix), with a chip for each kind and their names under it. Arrange comes first — the six Align buttons, Space evenly, Gap with − and +, and Group with its type, so Make a stack or an MC-LAG pair is one press — then Network, holding only the fields that make sense for all of them, saying Mixed where they differ: a value you type there is set on every selected device. Trace path is under Placement when exactly two are selected. The Align button stays in Classic's toolbar too.

Arrange moves items in the paint order: bring to front (⇧⌘F, Ctrl+Shift+F), forward one step, backward one step, send to back (⇧⌘B, Ctrl+Shift+B) — the two ends have keys, the single steps are buttons. It works on everything the same way — a pasted picture, a zone, a device tile — and it moves things past the connectors too, so an image sent to the back really does end up behind the cables that cross it. What Arrange will not do is take something out of its own layer: front means the front of the layer the object is on. To move a whole stack of things at once, drag the layer instead (see Layers). Align aligns edges or centres of a multi-node selection, and spaces three or more shapes evenly. Rack units are excluded from align and spacing — the rack grid owns their positions. Connectors are never moved by either: a cable has no box to line up, so it is not counted and not touched. Aligning shapes joined by a cable you shaped by hand carries that shape along when both of its ends move together, in the same undo step.

Gap, at the bottom of the Align menu — and on the card beside the Align buttons when several shapes are selected — is the other half of spacing: even spacing shares out the room the shapes already occupy, and the gap decides how much room that is. The number shown is the gap your selection is using — two numbers, 40 × 56 px, when it has rows and columns with different ones — and − / + step it by 8 pixels. Each row keeps its leftmost shape and grows to the right, each column keeps its topmost and grows down, so the shape you are measuring from stays put. Press it as many times as you like: a run of presses is one undo step, ending when you pause. It goes down to shapes that touch and no further.

Space evenly works a row at a time. ↔ finds the rows in your selection and evens out the gaps inside each one; ↕ does the same down each column. A row keeps its own end shapes exactly where they are, nothing changes row, and a run of fewer than three is left alone — so selecting two rows of switches and pressing ↔ tidies both rows rather than dealing them out into one long line. If there is no row (or column) to work with, if the shapes are packed too tightly to have gaps at all, or if they are already even, it says so and changes nothing. The gaps come out exactly equal, which can leave a shape a pixel or two off the drawing grid; the next time you drag it, it snaps back onto the grid as usual.

Basic shapes

The palette's last section holds eight plain shapes for annotating a drawing: Rectangle, Ellipse, Diamond, Triangle, Hexagon, Star, Note and Line.

Unlike a device, a basic shape has no icon — the shape itself is the drawing, so it fills whatever box you drag. A rectangle stretched wide is a wide rectangle, and an ellipse stretched wide is an oval. Two of them deliberately behave differently: a Star keeps its proportions whatever box you give it, because a stretched star reads as a mistake rather than a choice; and a Line is not a box at all — it is a connector, described below.

Select a shape and the inspector grows a Shape section with two switches: Solid or Dashed for the outline, and Outline or Filled for the body. They are independent, so the two of them give four looks, and the default — a solid outline over a faint tint — is one of the four. They take the colour you set like anything else on the page, and a mixed selection marks neither button until you pick one for all of them. A Line is offered the dash and not the fill: it has no body to fill.

Opacity fades a shape, and works on zones and the Purdue backdrop too — anything with a body you can see through. Use it to put a shape behind your devices without it competing with them. It scales the shape's own tint rather than replacing it, so a zone at 50% is half as strong as it was, not a half-solid block. The slider stops at 10% rather than 0: a shape at zero would be invisible and unclickable, which is a way to lose your own work rather than a useful setting. Devices do not offer it — an icon on a card looks broken when faded, not subtle.

Basic shapes are marks, not containers: they do not capture the devices you draw on top of them. Use a Zone when you want a boundary that owns what is inside it. You can attach a cable to any shape with a body — rectangle, ellipse, diamond, triangle, hexagon, star and note all take one, at either end. The Line and the Flow arrow are the two that take no connections: they are drawn like cables rather than boxed like shapes, so a cable cannot end on one — but either of their own ends can be fastened to a device, which is what the next section is about.

A basic shape is ordinarily something cables route around, like a device. Draw one round a group of devices, though — a solid rounded frame with its caption at the bottom, where a zone would look wrong — and the router treats it as a frame: the cables between the devices standing in it ignore it, and a cable attached to the frame itself runs straight, as a zone's does. It is a wall again the moment nothing stands in it, so a rectangle you use as a box routes exactly as it always has.

Type a name on one and it sits inside the shape you drew, not at the bottom of the box you dragged. For a rectangle, a note and a triangle those are the same place and the name sits along the bottom; an ellipse, a diamond, a hexagon and a star narrow to an arc or a point down there, so they name themselves across the middle, where the shape is at its widest. Put the name anywhere else with the inspector's Label position.

Saved to a .drawio file, each of these is written as draw.io's own shape — a diamond is a rhombus over there and a hexagon is a hexagon, not a box with a name on it — and the caption sits exactly where you see it here.

The Line is a connector

A Line is drawn, not dropped: press where it should start and drag to where it should end — sideways-then-down by default, or hold Shift for a straight diagonal. A plain click places a default-length line to shape afterwards.

It behaves like a cable rather than like a box. You can grab it anywhere along its stroke — there is a generous invisible corridor around it, the same width a connector has, so you never have to hit the hairline — and hovering lights it up so you can see what your click will land on. Selecting it gives you a handle at each end and a round handle at every bend, never a rectangle with corner handles: there are no corners to drag on a line.

Drag either end onto a device and it fastens there. The device rings as you pass over it, exactly as it does when you draw a cable, and the end settles on its border. A zone, context or rack takes an end too, like a cable, but only on its edge: let go on the frame and the zone rings and the end stays exactly where you dropped it. Inside a zone, away from the edge, nothing is fastened, so an arrow drawn inside a zone, or out across its edge, stays exactly as you drew it — and the flow table names the zone it lands in. From then on the line follows: move the device and the end travels with it, and it turns to face whichever way the line now runs. An end on a zone's edge keeps its place along that edge as the zone moves or is resized. While you drag an end, Drawbridge says what letting go would do: a label beside the pointer reads Fastens to and the name of the device or zone under it, and a dot marks exactly where the end will land. Inside a zone, where nothing fastens, the zone's frame turns into a dashed line in the selection colour and the label reads Free end · fastens on the zone's edge, so you know to move out to the frame. Over open canvas there is no label: the end simply stays where you drop it. To let go, drag the end off onto empty canvas — it stays exactly where you drop it. Either end can stay free, which is the point of a line, and deleting a device the line was fastened to simply releases it rather than taking the line with it. A plain click on an end handle only selects the line: letting go of a device is something you have to drag to do.

Shape it the way you shape an arrow — drag a round handle at any bend, click a diamond mid-segment to add one, and double-click a point to remove it. You can write on a line, too: double-click it to type a caption, then place the caption with the Label placement controls or simply drag it along the line. A double-click works in the middle of the line as well as anywhere else on it: the diamond sitting there takes a single click to add a bend, and leaves the double-click to the caption.

A line can carry a caption, and it is placed the way a cable's is rather than the way a device's name is: write it with the inspector's Label field, then use Label placement — Start · Middle · End along the run, Above · On · Below it, and Follow the connector. The device rows (Label position, Label align) are not offered for a line, because a line has no tile for a name to sit beside.

Everything here is true of the Flow arrow as well; a line is that arrow without the head. Both save as real draw.io connectors, fastenings included, so a line you attached to two devices arrives attached to the same two shapes in vanilla draw.io.