Security
Security overview
A tool that maps your network should be the least risky thing on it. This page says what NS-Discovery does with your data, what it can and cannot do in your network, and what we have not done yet.
What leaves the segment
Inventory, not traffic
A Sensor sends its Manager only the inventory: MAC and IPv4 addresses, names, type and model, change events and findings. Packets, their contents and credentials never leave the Sensor.
No vendor cloud, no telemetry
Neither the Sensor nor the Manager contacts us. There is no license check over the network, no usage reporting and no update channel you did not set up.
What it can and cannot do in your network
| Question | Answer |
|---|---|
| Does it send traffic? | No. It only receives. The optional local ARP discovery is off by default and, when enabled, bounded by the operator. |
| Do we open inbound ports for it? | No. Sensors open an outbound TCP connection to the Manager. |
| Can the Manager run commands on a Sensor? | No. There is no command channel: the Manager receives inventory and nothing else. A compromised Manager cannot be used to execute code in the networks it monitors. |
| How do Sensor and Manager trust each other? | Mutual TLS 1.3. A Sensor enrolls with a one-time token and pins the fingerprint of the Manager's certificate authority, so DNS tricks or another server cannot impersonate the Manager. Sensors can be revoked. |
| What privileges does the Sensor need? | On Linux it runs as a dedicated user with only CAP_NET_RAW and CAP_NET_ADMIN, under systemd sandboxing. Its local web interface listens on the loopback address only and is read-only. |
| How is hostile traffic handled? | Every decoder treats packets as hostile and checks bounds before every read, with tests for malformed input. Queues, request sizes and result sets are bounded. |
Access to the Manager
Single sign-on
OpenID Connect with your identity provider, so multi-factor authentication and leavers are handled where you already manage them. Local accounts lock after failed attempts.
Roles and site limits
Administrator, operator, viewer and auditor roles. A user or API key can be limited to chosen Sensors; the limit applies on the server to every read.
Audit log
Sign-ins, configuration changes and administrative actions are recorded and can be reviewed by auditors.
Building the software
Few dependencies
Written in Go, mostly on the standard library, built without C code. Each dependency is reviewed for license, maintenance and security history.
Checked on every change
Automated tests including race detection, and govulncheck against the Go vulnerability database.
Reproducible packages
Builds are reproducible, and each Debian package ships a software bill of materials (CycloneDX).
Not done yet
We would rather say it than have you find out.
Independent assessment
No SOC 2 report and no external penetration test yet. Both are planned before any hosted offering.
Hosted service
We do not host customer data today. Every deployment runs on the customer's or the service provider's infrastructure.
Report a vulnerability
Write to [email protected] with the affected version and the steps to reproduce. We answer within three business days and credit reporters who wish to be named. Please do not test against networks you do not own.