Network Scanner

Authorized local OT/ICS network discovery

Network Scanner is aimed at authorized lab and owner-controlled IPv4 networks where a quick inventory is more useful than a broad internet scanner. It begins with ARP discovery to find live hosts, then probes TCP ports and adds MAC-vendor context. The result is available from a Rich CLI or a local FastAPI dashboard.

Port association is not protocol identification

Its OT/ICS focus is deliberately modest. Ports associated with Modbus, S7comm, DNP3, EtherNet/IP, BACnet, OPC-UA, and similar services are flagged so they stand out during review. Seeing TCP/502 open, for example, is a reason to investigate a possible Modbus service; it does not prove that Modbus is speaking, identify the device, show that it is industrial, or establish that it is vulnerable.

These are port associations for triage, not protocol identification or vulnerability proof.

Discover, probe, annotate

authorized IPv4 subnet → ARP discovery → TCP probes → vendor and OT/ICS port context

ARP provides a local host and MAC-address starting point. TCP scanning adds open-port observations, and the tool labels ports from its built-in OT/ICS list. Together, those pieces make a small lab scan easier to reason about: a host, a vendor hint, and an exposed service are more useful than a bare address list, while protocol confirmation remains a separate next step.

The web API validates the requested subnet before handing it to Scapy and limits targets to IPv4 /24 networks or smaller. Its normal Uvicorn example binds to 127.0.0.1, and the local API is rate-limited. The public Ahlyx Labs site does not offer arbitrary hosted scanning.

Local lab workflow

The scanner is a Python tool built around Scapy, FastAPI, Rich, and Uvicorn. It needs Linux raw-socket access, so ARP discovery normally requires sudo. The CLI prints the local results, while the dashboard can be started on loopback and asked to scan a scoped lab subnet such as 192.168.1.0/24.

sudo venv/bin/python3 cli.py
sudo venv/bin/python3 -m uvicorn api:app --host 127.0.0.1 --port 8000 --reload

Run it only where you own the network or have explicit permission. The small target cap is part of the tool's intended context, not an invitation to broaden a local discovery helper into an internet-facing scanner.

Clues are not conclusions

An open TCP port does not prove a service, device type, protocol implementation, or exploitable condition. ARP visibility depends on the local network, and MAC vendor information can be incomplete or misleading. OT/ICS port flags make likely industrial services easier to notice; they do not perform a protocol handshake or vulnerability assessment.

The local dashboard and API are designed to remain local. They are not an access-controlled multi-user scanning service, and the site's hosted backend does not expose arbitrary visitor-supplied scanning. Scope, permission, and cautious interpretation are part of using an authorized lab discovery tool correctly.

Sources and further reading

Network Scanner README (commit 5d73910) · Scanner implementation (commit 5d73910) · Local API (commit 5d73910)