+ {children} +
+ ); +} + +function UL({ children }: { children: ReactNode }) { + return ( +
+ {children}
+
+ );
+}
+
+function CodeBlock({ children }: { children: ReactNode }) {
+ return (
+
+ {children}
+
+ );
+}
+
+function SeverityBadge({
+ level,
+ description,
+}: {
+ level: string;
+ description: string;
+}) {
+ const colours: Record{name}
+ {default_})
+
+ )}
+ + NetworkCrawler is a passive home-lab security scanner. It + discovers every device on your local network, identifies open + services and their versions, infers the operating system, and + evaluates the result against a set of security checks — + producing a prioritised list of risks and hardening + recommendations. +
++ All scanning is passive from an exploitation perspective: no + credentials are tested, no vulnerabilities are probed. The goal + is visibility and awareness, not penetration testing. +
+network_mode: host to reach all devices.
+
+ A broadcast ARP request is sent across the configured subnet
+ (e.g. 192.168.1.0/24). Every active device
+ responds with its MAC address, giving a definitive list of
+ hosts that are online at that moment. ARP operates at layer 2
+ and cannot be filtered by a host firewall.
+
+ Each discovered IP is scanned with nmap against the top 1 000 + most common TCP ports. Service banners and version strings are + captured where available. This step is the most time-consuming + part of the scan. +
+
+ A reverse DNS PTR lookup is attempted for each IP. If that
+ fails, a direct mDNS query is sent to the multicast address{" "}
+ 224.0.0.251:5353 — the same mechanism your
+ browser uses to resolve .local names. This works
+ for most modern devices including Apple, Linux, and Windows
+ machines.
+
+ The MAC vendor (derived from the OUI prefix), open ports, and + service banners are combined to produce a best-guess operating + system label. This is heuristic, not authoritative. +
++ Each device is evaluated against all active security checks. + Checks look for things like unencrypted remote-access + protocols, default management ports exposed, outdated software + indicators, and unnecessary services. Each failing check + produces a Risk record with a severity level, and a linked + Recommendation with concrete steps to remediate. +
+
+ All configuration is done via environment variables in your{" "}
+ docker-compose.yml. No file editing inside the
+ container is required.
+
+ By default many devices advertise generic names like{" "}
+ android-a3f2 or show no hostname at all. Setting a
+ descriptive hostname makes your device list immediately
+ understandable and survives across re-scans.
+
+ Linux (systemd) +
++ macOS +
++ Go to System Settings → General → Sharing{" "} + and edit the Local Hostname field. The change takes + effect immediately and is broadcast via Bonjour (mDNS). +
++ Windows 10 / 11 +
++ Go to Settings → System → About and click{" "} + Rename this PC. A reboot is required. Windows + advertises the new name via NetBIOS and mDNS (WSD). +
++ Raspberry Pi / Debian +
++ Router / DHCP static mapping +
++ If you cannot change the hostname on a device (e.g. an IoT + appliance), most routers allow you to assign a static IP and + hostname to a MAC address via the DHCP reservation table. + Check your router admin panel under{" "} + DHCP → Static Leases or similar. NetworkCrawler + will pick up the PTR record if your router populates its + local DNS accordingly. +
++ Once you have identified all expected devices on your network, + mark them as Trusted using the toggle on the device + detail page. Trusted devices are visually distinguished in the + device list. Any new device that appears after that point and is + not trusted stands out immediately as something to investigate. +
+network_mode: host in your compose file.
+ Bridge networking prevents ARP discovery and mDNS from working
+ correctly.
+