Network scanning

Besides code, Vulnara scans networks. You register an IP address or range that you own, start a scan, and Vulnara reports every open port it finds with the service, product and version behind it. A private network, or one closed to the internet, can be scanned through a connector agent that you run inside it.

What it is for

An open port running an old service is one of the easiest ways into a network. A network scan shows you what the outside world can see on your hosts, so you can close what should not be open and update what is out of date.

How it works

• Vulnara scans the hosts in the range one at a time, so progress is reported host by host and one unreachable host does not stop the scan.
• On each host it checks the 100 most common TCP ports and identifies the service running on each open one.
• Every open port becomes a finding carrying the host, hostname, protocol, port, service name, state, product, version, extra information, the reason it was reported, a confidence value and the CPE identifier where one is known. Ports that give no response or no useful service information are not reported.
• A scan sees your hosts the way the internet does, unless the network has a connector agent (see below).
• The network's security score is worked out from its findings. Open ports weigh more than filtered ones, and closed ports add nothing. Services that are commonly attacked, such as HTTP, FTP, Telnet and SSH, add more risk, as does a service on its standard port and any disclosed product, version or CPE. Low-confidence findings count for less.

Which ranges you can add

A network is an IP address or range of at most 65,536 addresses (an IPv4 /16 or an IPv6 /112).

• Public ranges are scanned from the internet, the way anyone else would see them.
• Private ranges, such as 10.0.0.0/16 or 192.168.1.0/24, are accepted, but Vulnara can only reach them through a connector agent inside that network. When you add one, the app reminds you to provision the agent. See Reach a network through a connector agent.
• Loopback, link-local, multicast and unspecified addresses, such as 127.0.0.1 or 169.254.0.0/16, are refused.

What you can set

• Name: a label for the network.
• Network: an IPv4 or IPv6 address, or a CIDR range. A range can cover at most 65,536 addresses. See Which ranges you can add.
• Network Type: Public, Private, VPN, Internal, External, DMZ or Unknown. Vulnara suggests a type from the range; choose Unknown if you are not sure.
• Ownership confirmation: you must confirm that you own the network or have permission from its owner to scan it.

Do it

1. Add the network

   Open Networks in the web app and choose Add Network. Enter a name, the address or range, and the network type, tick the ownership confirmation and save.

2. Start the scan

   Select the network and choose Scan Network, then confirm. You can also choose New Scan in the sidebar and pick Network. The scan appears in the tasks bar with the hosts scanned out of the total.

3. Read the results

   Open Network Scans to see each scan and its findings. On a finding, choose Request Consultation to ask Vulnara's security experts to help you understand and resolve it.

The same operations exist in the API:

• GraphQL: createNetwork, startNetworkScan, networkScanResults, networkScanFindings, requestNSFConsultation and deleteNetwork. createNetwork requires ownershipConsent: true.
• CLI: start_network_scan, networks, network_scan_results and network_scan_findings.
• MCP: networks, network_scan_results and network_scan_findings, and start_network_scan for members whose AI access is Write. See MCP.

vulnara start_network_scan --networkId <network-id>

Reach a network through a connector agent

If your hosts are on a private range or closed to the internet, run a connector agent inside the network and Vulnara scans the network through it. An agent belongs to one network, and a scan through it can reach only that network.

1. Provision the agent

   Open the network and, on its Overview tab, find the Connector Agent card. Choose Provision Agent and confirm with Provision. You need the admin role.

2. Save what is shown

   Vulnara shows a Pre-auth Key, a Heartbeat Token and an Install Command. They are shown only once, so save them, tick I've saved the pre-auth key and the heartbeat token and choose Done.

3. Install the agent

   Run the install command, as shown, on a host inside the network that has Docker.

4. Check its status

   The Connector Agent card shows Last Seen, or Never checked in until the agent has connected, and the Route, which reads Pending approval at first and Approved once the agent is ready. Then scan the network as usual.

To remove the agent, choose Deprovision Agent on the card and confirm. Vulnara can then no longer reach the network through it. The network itself is kept.

A network on a private range can only be scanned while its agent is connected. If it has no agent, or the agent has not checked in for a couple of minutes, the scan is refused rather than run, so it never comes back looking clean when nothing was reached.

In GraphQL, use provisionNetworkAgent, deprovisionNetworkAgent and the network's agent field.

Scan on a schedule

Open the network, go to its Schedules tab and choose Add schedule. Pick daily or weekly and a time, and the network is scanned on that cadence. If a scheduled run cannot start, for example because the connector agent was offline, the schedule shows why under its row. See Schedule recurring scans.

Reports

Choose Download report on a network for a PDF with its latest scan, its open ports and services, and its recent scans. The workspace security summary PDF also has a Networks section. See PDF reports.

Good to know

• Your plan sets how many networks you can hold, your network scan minutes, and how many scans of any kind can run at once. At the network limit you cannot add another network, and the web app offers an upgrade. If a plan change leaves you holding more networks than the plan allows, scans are refused until you are back within it.
• You can cancel a running network scan from the tasks bar. It stops before the next host.
• Vulnara notifies you when a network scan finishes or fails. See Notifications.
• Deleting a network cancels any scan still pending for it. You can also transfer a network to another account.