v0.2.0 — Distributed Discovery · Topology · Change Detection · Fingerprint Library
This release turns MiBee Steward from a single-network discovery tool into a distributed, multi-LAN device portrait system. It ships two binaries: the center (mibee-steward, the SPA-embedded server you already know) and a new lightweight discovery agent (mibee-agent) that runs on remote networks and reports back.
| Binary | amd64 | arm64 |
|---|---|---|
mibee-steward (center + Web UI) |
24 MB | 23 MB |
mibee-agent (remote LAN discovery) |
17 MB | 17 MB |
Both are CGO-free (pure Go + modernc.org/sqlite) — no C toolchain needed on the target, runs as a regular user.
Distributed discovery (center + agent)
v0.1.0 could only discover the one LAN the center sat on. v0.2.0 adds a dedicated agent binary so one registry covers every network segment. The agent uses a push + pull model — it pushes alive-host reports and pulls ad-hoc scan commands on a 60s poll — so it works behind NAT with no inbound port needed.
How the two halves stay consistent:
- Anti-entropy fast path: when a network is stable, the center skips the per-host device bridge and only refreshes leases — near-zero cost.
- Lease model: lost detection for agent networks is TTL-based (default 5 minutes), tolerating ~10 missed reports.
- Disconnect backfill: if the center is down, batches are queued and redelivered in order once it recovers — never silently dropped.
Topology discovery
A new Bridge-MIB SNMP probe walks switch forwarding databases to learn L2 adjacency (which MAC lives behind which port), persisted to the device_neighbors table. This is the foundation of a topology graph.
Change-detection engine
v0.1.0 recorded device state but never told you what changed. v0.2.0 adds a change-detection engine that records device_added / device_changed / device_lost events (with structured before/after diffs). Query via GET /changes, or stream live via the SSE endpoint /changes/watch. The frontend Changes page renders diffs and updates in real time.
Passive discovery service
Spots newly-appeared hosts between scheduled scans (a device that boots at 2 AM still gets a device_added event without waiting for the next scan). Three zero-cost sources: router ARP (widest coverage), ARP cache (zero traffic), multicast (passive mDNS/SSDP). A MAC-primary precheck prevents identify-scan loops on DHCP-churned hosts.
Data-driven fingerprint rule library
Identification rules are now YAML data, not hand-written Go. Adding a device signature = one YAML entry. ~2554 rules ship out of the box (20 builtin + ~2534 from Rapid7 Recog, Apache-2.0). Logic that can't be expressed declaratively (SNMP bitmask heuristic, camera cross-evidence fusion) stays as Go code.
Probe enhancements
- SMB2 Negotiate: parses the SMB server dialect and OS string (v0.1.0 only had a version-less port-only fallback)
- TLS certificate brand override: recognizes OpenWrt / GL.iNet / iStoreOS
- 15 active probes in total (SMB2 + Bridge-MIB new this release)
Operational
Server bind-retry on systemd restart (prevents TIME_WAIT crash loops), agent HTTP keep-alive deadlock fix, golangci-lint v2 enforced in CI, retention config consolidated under retention.*.
See the CHANGELOG and the distributed deployment guide for full details and upgrade steps.
Full diff: v0.1.0...v0.2.0