User guide

AssetLoom Local Scanner User Guide

This guide explains how to install, configure, run, and troubleshoot the AssetLoom Phase 2 local network scanner.

The scanner runs from the command line, scans authorized IPv4 network targets, and writes device records to a local CSV or JSON file. Phase 2 adds independent hostname and service collectors, SNMP inventory, and Windows inventory through WinRM with an optional WMI fallback. This local build does not connect to AssetLoom Cloud.

Contents

• What the Scanner Does
• What It Does Not Do Yet
• Before You Begin
• Install or Build
• Create and Validate Configuration
• Choose Scan Targets
• Configure Protocols
• Configure Credentials
• Configure WinRM Trust
• Tune Timeouts and Concurrency
• Run a Scan
• Understand the Output
• Interpret Protocol Results
• Platform Notes
• Troubleshooting
• Security and Privacy
• Release Verification
• FAQ

What the Scanner Does

AssetLoom Local Scanner is an agentless network discovery and inventory tool. It first discovers live devices, then runs the enabled enrichment collectors against those devices.

Discovery methods:

• ICMP ping sweep.
• ARP discovery on directly attached Layer 2 networks.
• TCP connect probing against configured ports.

Enrichment methods:

• Reverse DNS (dns_ptr).
• Multicast DNS reverse lookup (mdns).
• DNS Service Discovery (mdns_sd).
• NetBIOS node status (netbios).
• SNMP v1/v2c inventory (snmp).
• WinRM inventory over verified HTTPS (winrm).
• WMI inventory fallback from a Windows scanner (wmi).

The scanner merges the evidence into one record per discovered IP address. It can add hostnames, observed MAC addresses, OUI vendors, open ports, operating system details, hardware details, network interfaces, service signals, and a rule-based device classification.

Supported output formats:

• CSV for a compact, spreadsheet-friendly summary.
• JSON for complete structured results and evidence.

The scanner does not install software on target devices.

Before You Begin

Only scan networks that you own or are explicitly authorized to assess.

Recommended scanner host:

• Linux, macOS, or Windows connected to the target network.
• Administrator or root access for the best ICMP and ARP coverage.
• A Windows scanner host when WMI fallback is required.
• Reliable DNS access if dns_ptr is enabled.

Network requirements:

• IPv4 only.
• ARP, mDNS, and DNS-SD are useful only on directly attached local links.
• Routed targets require an approved range or allow_routed.
• Public targets require an approved range or allow_public.
• Special-purpose ranges remain blocked.

Recommended target preparation:

Collector	Target requirement	Network requirement
SNMP	Read-only SNMP v1/v2c community	UDP 161 from scanner to target
WinRM	WinRM HTTPS listener with a valid or explicitly trusted certificate	TCP 5986; the scanner may also probe 5985 as a readiness signal
WMI	WMI/DCOM enabled and an authorized Windows account	TCP 135 and the required DCOM dynamic ports; scanner host must be Windows
mDNS/mDNS-SD	Device advertises mDNS or DNS-SD	UDP 5353 multicast on the local link
NetBIOS	NetBIOS node status enabled	UDP 137

Use dedicated read-only accounts and communities. Do not reuse personal or administrator credentials unless target policy genuinely requires them.

Install or Build

Use a release archive

Choose the release archive for the scanner host:

Platform	Archive
Linux amd64	assetloom-scanner-linux-amd64.tar.gz
Linux arm64	assetloom-scanner-linux-arm64.tar.gz
macOS Intel	assetloom-scanner-darwin-amd64.tar.gz
macOS Apple silicon	assetloom-scanner-darwin-arm64.tar.gz
Windows amd64	assetloom-scanner-windows-amd64.zip

On Linux or macOS, extract the archive for the host architecture:

tar -xzf ./assetloom-scanner-linux-amd64.tar.gz
./assetloom-scanner --version

The archive records the executable permission. If a transfer tool removes it, restore it with chmod +x ./assetloom-scanner.

On Windows PowerShell:

Expand-Archive .\assetloom-scanner-windows-amd64.zip -DestinationPath .\assetloom-scanner
.\assetloom-scanner\assetloom-scanner.exe --version

Build from source

With Go 1.22 or newer:

make build

The local binary is written to bin/assetloom-scanner. To build all release archives:

make build-all

Create and Validate Configuration

The scanner never creates configuration silently while starting a scan. Create it explicitly, review it, then validate the intended scan.

For a project-local configuration:

./bin/assetloom-scanner --init-config --config ./config.json

For the default production path on Linux or macOS:

sudo ./bin/assetloom-scanner --init-config

Default paths:

Platform	Default config path
Linux/macOS	/etc/assetloom-scanner/config.json
Windows	%ProgramData%\assetloom-scanner\config.json

ASSETLOOM_CONFIG can override the platform default when --config is not specified. Initialization refuses to overwrite an existing file.

The generated configuration enables Phase 1 discovery plus reverse DNS:

{
  "approved_ranges": null,
  "allow_routed": false,
  "allow_public": false,
  "max_aggregate_hosts": 0,
  "scan": {
    "protocols": ["icmp", "arp", "tcp", "dns_ptr"],
    "tcp_ports": [22, 23, 53, 80, 135, 443, 445, 554, 631, 902,
                  1883, 3389, 5000, 5060, 5900, 8006, 8080, 8443,
                  9100, 48899],
    "ping_retries": 2,
    "ping_rate_limit_pps": 1000,
    "tcp_rate_limit_cps": 1000,
    "timeouts": {
      "icmp_ms": 300,
      "tcp_ms": 200,
      "arp_request_ms": 500
    },
    "concurrency": {
      "ping_workers": 256,
      "arp_workers": 20,
      "tcp_hosts": 50,
      "tcp_ports_per_host": 20
    }
  }
}

Run a dry run before the first real scan:

./bin/assetloom-scanner --config ./config.json --dry-run 192.168.1.0/24

A dry run sends no discovery packets. It reports accepted and rejected ranges, candidate counts, local/routed/public classification, effective TCP probes, enabled collectors, credential coverage, trust readiness, timeout settings, and an estimated scan cost.

For a broader local readiness report:

./bin/assetloom-scanner --config ./config.json --diagnose

--diagnose validates the local runtime, credential store, credential coverage, and trust configuration without sending packets. --diagnose-hosts N limits the candidate addresses listed for credential readiness checks, up to the hard limit of five. It does not authenticate to those hosts in this release. --diagnose exits with status 0 after producing its report even when the report contains warnings, so automation must inspect the reported statuses.

Choose Scan Targets

Targets may be supplied in these forms:

Target form	Example
Single IPv4 address	192.168.1.50
CIDR range	192.168.1.0/24
Same-/24 shorthand range	192.168.1.1-254
Same-/24 full range	192.168.1.1-192.168.1.254

Combine targets with spaces or commas. Overlapping addresses are scanned once. For example:

sudo ./bin/assetloom-scanner --config ./config.json 192.168.1.20
sudo ./bin/assetloom-scanner --config ./config.json 192.168.1.0/24
sudo ./bin/assetloom-scanner --config ./config.json \
  192.168.1.0/24 192.168.20.0/24

When no target is supplied, the scanner auto-detects eligible private networks attached to the scanner host.

Approved ranges

For managed or repeatable scans, set explicit assignments:

{
  "approved_ranges": ["192.168.1.0/24", "192.168.20.0/24"],
  "allow_routed": false,
  "allow_public": false
}

Every requested address must be inside an approved range. When approved_ranges is non-empty, it is the authority and the routed/public flags are ignored.

When approved ranges are empty:

• Directly attached private targets are allowed by default.
• Routed targets require "allow_routed": true.
• Public targets require "allow_public": true.

The built-in aggregate limit is 65,536 candidate hosts. Set max_aggregate_hosts to a smaller operational limit or a larger authorized limit. The scanner always enforces its absolute ceiling of 1,048,576 hosts.

Link-wide mDNS permission

mDNS multicast is heard by every device on the local segment. If the requested targets do not cover the complete attached link, the safe default prevents a link-wide query:

"scan": {
  "allow_link_wide_mdns_browse": false
}

With the default, mdns_sd uses its safer per-host path and mdns reports mdns_link_not_permitted for the affected hosts. Set this option to true only when you are authorized to send multicast queries across the full local link.

Configure Protocols

The default protocol list is:

"protocols": ["icmp", "arp", "tcp", "dns_ptr"]

Phase 2 collectors are opt-in. Add only the collectors needed for the scan.

Protocol	Credential	Scope	Main contribution
icmp	None	All targets	Liveness, RTT, TTL
arp	None	Local Layer 2	Liveness and directly observed MAC
tcp	None	All targets	Liveness and open ports
dns_ptr	None	All live hosts	Reverse-DNS hostname
mdns	None	Local link	mDNS hostname
mdns_sd	None	Local link	DNS-SD services, instances, and hostname evidence
netbios	None	All live hosts	NetBIOS hostname, workgroup, and self-reported MAC signal
snmp	SNMP community	Hosts covered by credential scope	System, hardware, interfaces, hostname, and classification evidence
winrm	Windows account	Hosts with an applicable credential and WinRM gate port	Windows OS, hardware, network, hostname, and hypervisor evidence
wmi	Same Windows account	Windows scanner; WMI gate port; WinRM produced no inventory	Windows inventory fallback

Example profiles

Credential-free enhanced discovery:

"protocols": [
  "icmp", "arp", "tcp", "dns_ptr", "mdns", "mdns_sd", "netbios"
]

Network infrastructure inventory:

"protocols": ["icmp", "arp", "tcp", "dns_ptr", "snmp"]

Full Phase 2 inventory on a Windows scanner:

"protocols": [
  "icmp", "arp", "tcp", "dns_ptr", "mdns", "mdns_sd", "netbios",
  "snmp", "winrm", "wmi"
]

Enabling WinRM causes the scanner to probe its prerequisite ports 5985 and 5986. Enabling WMI on Windows causes it to probe port 135. These gate probes are performed even if the ports are absent from tcp_ports; they do not turn into a full TCP classification sweep when tcp is disabled.

SNMP version selection

When omitted, snmp_versions defaults to v2c followed by v1:

"scan": {
  "protocols": ["icmp", "arp", "tcp", "snmp"],
  "snmp_versions": ["v2c", "v1"]
}

Use ["v2c"] if the managed estate is known not to contain v1-only devices. SNMPv3 is not implemented. A list containing only v3 results in snmp_no_supported_version; it never silently falls back to v1/v2c.

Migrate older DNS configuration

The old combined dns protocol is rejected. Replace it with the independent collectors needed by your environment:

Old setting	Phase 2 setting
scan.protocols: ["dns"]	One or more of dns_ptr, mdns, mdns_sd, netbios
timeouts.dns_method_ms	dns_ptr_ms, mdns_reverse_ms, and/or netbios_ms
timeouts.dns_overall_ms	Removed
concurrency.dns_hosts	dns_ptr_hosts, mdns_reverse_hosts, and/or netbios_hosts

Configure Credentials

SNMP, WinRM, and WMI need credentials. The scanner stores secrets in an encrypted local credential file; credentials do not belong directly in config.json.

An optional credential configuration block is:

{
  "credentials": {
    "source": "local",
    "file": "/var/lib/assetloom-scanner/credentials.enc",
    "salt_file": "/etc/assetloom-scanner/salt",
    "kek_provider": "machine-id",
    "passphrase_file": "",
    "audit_log": "/var/lib/assetloom-scanner/credential-audit.jsonl",
    "audit_max_size_mb": 5,
    "max_auth_failures": 2,
    "max_host_attempts": 12
  }
}

All fields are optional; platform defaults are used when omitted.

Add an SNMP community

Pass the secret through standard input:

printf '%s' 'public' | sudo ./bin/assetloom-scanner credential add \
  --config ./config.json \
  --name noc-readonly \
  --type snmp_community \
  --scope 192.168.1.0/24

Add a Windows account

Create a secret file readable only by its owner:

chmod 600 ./winrm-password.txt
sudo ./bin/assetloom-scanner credential add \
  --config ./config.json \
  --name windows-inventory \
  --type winrm \
  --username 'DOMAIN\svc_assetloom' \
  --scope 192.168.20.0/24 \
  --secret-file ./winrm-password.txt

The winrm credential type is used by both WinRM and WMI. Every credential must have a CIDR scope. A credential with no matching scope is not offered to a host.

Do not put a password or community directly on the command line. Process arguments can be visible to other users and system tools.

Manage and test credentials

./bin/assetloom-scanner credential list --config ./config.json
./bin/assetloom-scanner credential test \
  --config ./config.json --name noc-readonly --host 192.168.1.10
./bin/assetloom-scanner credential update \
  --config ./config.json --name noc-readonly --scope 192.168.1.0/25
./bin/assetloom-scanner credential rm \
  --config ./config.json --name noc-readonly

Use credential rekey to change the credential-store key provider. The default machine-id provider binds the store to the local machine. A passphrase-backed store is portable but requires secure passphrase handling.

credential test currently verifies that the named credential can be opened, is supported by the configured collector, and is in scope for the host. It does not send a protocol request or verify the secret against the target. Run a narrow scan to confirm live authentication.

Authentication safeguards

• max_auth_failures limits actual authentication rejections per credential.
• max_host_attempts limits attempts across credentialed protocols for one host.
• Timeouts, unreachable hosts, unsupported authentication schemes, and certificate failures are reported separately from wrong credentials.
• Credential use is written to a rotating audit log without storing secrets.

SNMP v1/v2c community strings are not encrypted on the network. Restrict SNMP to trusted management networks, use read-only communities, and scope each credential narrowly.

Configure WinRM Trust

WinRM sends credentials only over HTTPS and never provides an insecure skip-verification option. By default, certificates are validated against the operating system trust store.

Use an internal CA

For certificates issued by an internal CA:

{
  "trust": {
    "ca_bundle": "/etc/assetloom-scanner/corp-ca.pem"
  }
}

The CA bundle must contain the certificates needed to validate the server chain.

Map an IP range to a certificate name

When the scanner connects by IP but the certificate contains a DNS name:

{
  "trust": {
    "ca_bundle": "/etc/assetloom-scanner/corp-ca.pem",
    "server_names": {
      "192.168.20.0/24": "windows.corp.example.com",
      "192.168.20.50": "db-node-02.corp.example.com"
    }
  }
}

The most specific matching entry wins.

Use scoped trust on first use

For authorized devices whose self-signed certificates cannot be issued by a managed CA:

{
  "trust": {
    "learn_ranges": ["192.168.20.0/24"]
  }
}

The first certificate is pinned for the host and purpose. A later certificate change is rejected as winrm_cert_changed; the scanner does not silently learn the replacement.

Review and remove pins with:

./bin/assetloom-scanner trust list --config ./config.json
./bin/assetloom-scanner trust list --config ./config.json --json
./bin/assetloom-scanner trust rm \
  --config ./config.json --host 192.168.20.50 --purpose winrm --port 5986

Remove a changed pin only after independently confirming that the target was legitimately rebuilt or its certificate was intentionally replaced.

Tune Timeouts and Concurrency

Start with defaults and tune only after reviewing logs and protocol statuses. Timeouts are whole-host budgets for the named collector, not a timeout applied independently to every internal request.

Common Phase 2 timeout defaults:

Setting	Default	Purpose
snmp_ms	30000	Complete SNMP system and interface collection
winrm_ms	30000	WinRM authentication and inventory
wmi_ms	30000	WMI connection and inventory
mdns_ms	4000	DNS-SD per-host work
mdns_browse_ms	2000	Scan-wide DNS-SD browse
netbios_ms	2000	NetBIOS node status
mdns_reverse_ms	2000	mDNS reverse lookup
dns_ptr_ms	500	Reverse-DNS lookup

WinRM or WMI budgets at or below 6000 ms cannot attempt a credential and are reported as winrm_budget_too_small or wmi_budget_too_small.

Common Phase 2 concurrency defaults:

Setting	Default	Purpose
snmp_hosts	32	Concurrent SNMP hosts
winrm_hosts	8	Concurrent WinRM hosts and authentications
wmi_hosts	8	Concurrent WMI hosts
mdns_hosts	64	Concurrent DNS-SD hosts
netbios_hosts	64	Concurrent NetBIOS hosts
mdns_reverse_hosts	64	Concurrent mDNS reverse lookups
dns_ptr_hosts	64	Concurrent OS resolver lookups

The scanner caps and proportionally scales wire-protocol concurrency to avoid unbounded fan-out. Increasing workers can raise load on the scanner, targets, authentication services, switches, and firewalls. Change one setting at a time and validate with a representative subnet.

Run a Scan

Run against an explicit range and write CSV:

sudo ./bin/assetloom-scanner \
  --config ./config.json \
  --output ./devices.csv \
  192.168.1.0/24

Write full JSON:

sudo ./bin/assetloom-scanner \
  --config ./config.json \
  --format json \
  --output ./devices.json \
  192.168.1.0/24

Auto-detect eligible local private ranges:

sudo ./bin/assetloom-scanner --config ./config.json --output ./devices.csv

Output files are not overwritten by default. Use --force-output only when replacement is intentional:

sudo ./bin/assetloom-scanner \
  --config ./config.json \
  --output ./devices.csv \
  --force-output \
  192.168.1.0/24

The scanner prints structured progress for discovery, enrichment, and output. Cancellation writes any available partial result and returns a non-success exit status so automation does not mistake an interrupted scan for completion.

When --output is omitted, the default is devices.csv, or devices.json when --format json is selected.

Capture console logs

The scanner writes operational logs to standard error and command output to standard output. The device result is written separately to --output.

On Linux or macOS:

sudo ./bin/assetloom-scanner \
  --config ./config.json \
  --output ./devices.csv \
  192.168.1.0/24 \
  >scanner.stdout.log 2>scanner.stderr.log

To stop a scan, press Ctrl+C. Treat any output from an interrupted scan as partial and check the command exit status before processing it.

Capture diagnostic fixtures

For a controlled support or regression run:

sudo ./bin/assetloom-scanner \
  --config ./config.json \
  --capture-fixtures ./fixtures \
  --output ./devices.json \
  --format json \
  192.168.1.10

Fixture files contain raw device responses. Credential values are redacted, but hostnames, inventory, interfaces, service advertisements, and other sensitive network information can remain. Store them securely and review them before sharing. Existing fixture files are never overwritten.

Understand the Output

CSV

CSV contains a stable summary with these columns:

Column	Meaning
IP	Device IPv4 address
MAC	MAC observed directly through ARP; a NetBIOS or Windows-reported MAC does not replace it
Hostname	Selected hostname after source precedence is applied
HostnameSource	Collector that supplied the selected hostname
Vendor	OUI vendor for the ARP-observed MAC
DeviceType, DeviceSubType, Confidence	Rule-based classification result
OpenPorts	Open ports found by the configured TCP sweep or prerequisite gate probes
TTL, RTT_ms	ICMP response evidence when available
DiscoveredBy	Liveness methods: icmp, arp, and/or tcp
EnrichedBy	Collectors that contributed non-liveness data
LimitedReasons	Actionable data gaps aggregated from protocol outcomes
DiscoveryLimited	Whether the scanner found no identifying or inventory evidence beyond liveness
ProtocolStatuses	Compact per-protocol status and reason summary
DiscoveredAt	Time this local scan observed the device
ScanID	Identifier shared by records from the scan

Read CSV by header name rather than column position so import automation remains compatible if optional columns are added in a future release.

JSON

JSON is the preferred format for integrations and detailed troubleshooting. It retains nested protocol statuses, OS and hardware inventory, network interfaces, identity signals, classification signals, evidence sources, and scan metadata that cannot be represented cleanly in CSV.

Phase 2 does not yet populate software, patch, VLAN, switch-port, or persistent first-seen/last-seen history.

Confidence

The top-level classification confidence (high, medium, or low) describes the strength of evidence behind DeviceType and DeviceSubType. It is not a probability and does not describe scan completeness.

JSON may also contain confidence on individual signals:

• Identity-signal confidence describes how strongly the value identifies a particular device.
• Classification-signal confidence describes how strongly the evidence supports a device category.

Use DiscoveryLimited, LimitedReasons, and ProtocolStatuses to judge data completeness.

Interpret Protocol Results

Each enabled protocol records a status, machine-readable reason, human-readable message, duration, and any credential reference that was attempted.

Typical status meanings:

Status	Meaning
success	The collector completed and contributed its expected evidence
partial	Some useful evidence was collected, but part of the operation was incomplete
failed	The collector ran but did not produce usable evidence
skipped	It was intentionally not run, unsupported on this platform, or not applicable

Common reasons:

Reason	Interpretation or action
no_credentials	Add an applicable credential or remove the collector from this scan profile
credential_not_in_scope	Update credential CIDR scope after confirming authorization
auth_failed	Verify the secret and account state; repeated rejection can lock an account
insufficient_permissions	Authentication succeeded, but the account cannot read required data
winrm_cert_untrusted	Add the issuing CA, map the expected server name, or deliberately use scoped learning
winrm_cert_changed	Stop and independently verify the target before replacing its pin
no_encrypted_listener	Configure a WinRM HTTPS listener on port 5986
no_usable_auth_scheme	Review the target WinRM authentication configuration
protocol_timeout	Confirm reachability, then raise the relevant timeout if the device is simply slow
protocol_unavailable	The selected collector is not available on this scanner platform or build
mdns_link_not_permitted	Cover the complete local link or explicitly allow link-wide mDNS queries
arp_not_local_subnet	Expected for routed targets; ARP cannot discover a remote Layer 2 MAC
arp_mac_locally_administered	The MAC has no registered vendor OUI; it may be randomized or administratively assigned
arp_vendor_unknown	The observed global MAC prefix is missing from the embedded OUI table

DiscoveryLimited is not a product-tier limit. It is true when the scanner established liveness but learned no identifying or inventory data about the device. It is not set for every failed collector. LimitedReasons separately aggregates actionable method-level gaps. A disabled or inapplicable collector does not by itself make a record limited.

Discovery and enrichment are deliberately separate:

• DiscoveredBy answers how the scanner established that the IP was live.
• EnrichedBy answers which collectors added identity or inventory.
• A device may be discovered successfully and still have one or more failed enrichment collectors.

The top-level MAC remains an on-link observation. A MAC claimed through NetBIOS, WinRM, or WMI is retained as lower-trust signal or interface evidence and does not overwrite the ARP-observed value.

Platform Notes

Linux

• Run with sudo for complete ICMP and ARP coverage.
• WinRM, SNMP, DNS, mDNS, DNS-SD, and NetBIOS collectors are available.
• WMI reports protocol_unavailable because native Windows COM/DCOM is needed.
• Protect configuration, credential, trust, audit, output, and fixture files with restrictive ownership and modes.

macOS

• Run with sudo for complete ICMP and ARP coverage.
• WinRM, SNMP, DNS, mDNS, DNS-SD, and NetBIOS collectors are available.
• WMI is unavailable.
• Local firewalls and privacy controls can affect multicast and raw network access.

Windows

• Run from an Administrator PowerShell or Command Prompt for best discovery.
• WMI fallback is available only on this platform.
• WMI requires RPC/DCOM access to targets and can be affected by Windows Firewall, domain policy, UAC filtering, and account permissions.
• Protect newly created credential and trust directories with explicit Windows ACLs.

Troubleshooting

The config file cannot be found

Initialize it or pass the correct path:

./bin/assetloom-scanner --init-config --config ./config.json
./bin/assetloom-scanner --config ./config.json --dry-run 192.168.1.0/24

The old dns protocol is rejected

Replace it with one or more of dns_ptr, mdns, mdns_sd, and netbios. These collectors are independent in Phase 2.

SNMP returns no inventory

Check that:

• snmp is enabled.
• The community credential scope includes the target.
• The agent permits the scanner source IP.
• UDP 161 is reachable.
• The configured SNMP versions include the target's supported version.
• The community is read-only and correct.

Use credential test to confirm that the credential exists, decrypts, is supported, and covers the host. It does not send an SNMP request in this release, so use a narrow authorized scan to verify the community on the wire.

WinRM reports an untrusted certificate

Do not bypass verification. Add the internal CA bundle, configure the expected certificate server name, or enable trust learning only for a narrow authorized range. Review the target certificate independently before trusting it.

WinRM finds port 5985 but collects nothing

Port 5985 is unencrypted HTTP and is used only as a readiness signal. Configure a WinRM HTTPS listener on 5986. The scanner will not send a credential over the unencrypted listener.

WMI does not run

WMI requires all of the following:

• The scanner host is Windows.
• wmi is enabled.
• Port 135 is reachable.
• An applicable winrm credential exists.
• WinRM did not already produce inventory for that host.
• Target WMI/DCOM services, firewall rules, and permissions allow remote reads.

mDNS or DNS-SD returns little data

Confirm the scanner and target are on the same local link and UDP 5353 multicast is permitted. For narrow targets, inspect mdns_link_not_permitted. Enable link-wide mDNS only when the entire segment is authorized.

Some responders answer multicast browse queries but ignore direct per-host follow-up, so a restricted scan can legitimately collect less DNS-SD detail.

A discovered device has no MAC or vendor

Routed targets do not expose their local MAC through ARP. A local device may also use a locally administered MAC, which has no registered OUI vendor. A MAC reported by NetBIOS or Windows inventory remains a signal and is intentionally not promoted to the observed MAC field.

The scan is slow

• Run --dry-run and review candidate counts and estimated cost.
• Scan a smaller approved range.
• Disable collectors that are unnecessary for the objective.
• Check protocol timeouts before increasing concurrency.
• Use ["v2c"] when the SNMP estate is known not to require v1.
• Confirm target firewalls reject closed ports promptly instead of silently dropping probes.

The result is marked limited

Inspect LimitedReasons and ProtocolStatuses. Address only actionable gaps. Expected conditions such as WMI being unavailable on Linux, a deliberately disabled protocol, or a routed target being ineligible for ARP should not be treated as scanner failure.

Security and Privacy

• Obtain written authorization and define approved target ranges.
• Keep allow_routed, allow_public, and link-wide mDNS disabled unless the scan requires them.
• Scope every credential to the smallest practical CIDR.
• Use read-only SNMP communities and least-privilege Windows accounts.
• Never pass secrets in command-line arguments or store them in config.json.
• Protect the encrypted credential store, salt, trust pins, audit log, scan output, and fixtures with restrictive permissions.
• Treat machine-id encryption as protection against casual file disclosure, not as protection from an attacker who fully controls the scanner host.
• Remember that SNMP v1/v2c communities are plaintext on the wire.
• Never disable or work around WinRM certificate verification.
• Validate an unexpected certificate change before removing a trust pin.
• Treat scan results as sensitive infrastructure data. They can contain IPs, hostnames, serial numbers, operating systems, interfaces, and service names.
• Delete temporary secret files and diagnostic fixtures when they are no longer needed, following your organization's retention policy.

Release Verification

Verify the release checksum before extracting a downloaded archive:

sha256sum assetloom-scanner-linux-amd64.tar.gz
sha256sum -c checksums.txt

On macOS:

shasum -a 256 assetloom-scanner-darwin-arm64.tar.gz
shasum -a 256 -c checksums.txt

On Windows PowerShell:

Get-FileHash .\assetloom-scanner-windows-amd64.zip -Algorithm SHA256

Compare the result with the checksum published on the official release page. The release bundle may also include an SBOM for dependency and compliance review.

Check embedded build metadata:

./assetloom-scanner --version

The output identifies the version, commit SHA, build date, and target OS and architecture.

FAQ

Does the scanner modify target devices?

No. It performs network discovery and read-only inventory requests. Target systems can still log connections and authentication attempts.

Are Phase 2 credentials required?

No. The default scan remains credential-free. Credentials are required only when snmp, winrm, or wmi is enabled and applicable.

Can one configuration be shared across platforms?

Yes. Unsupported collectors degrade to a recorded skipped status. For example, WMI is skipped on Linux and macOS while the remaining collectors continue.

Why did WMI not run after WinRM succeeded?

That is expected. WMI is a fallback, not a duplicate Windows inventory pass. It runs when WinRM produced no inventory and the host/platform prerequisites are met.

Can the scanner use SNMPv3?

Not in this release. Do not assume a stored SNMPv3 credential enables collection. The scanner will not downgrade it to v1/v2c.

Why is a hostname different when protocols change?

Each collector runs independently, and the normalizer chooses the strongest available hostname source. Disabling a collector removes its evidence from the next scan.

Does DiscoveryLimited mean a free-product limit?

No. It reports an actionable data-completeness issue for that device. It is not related to licensing or product tiers.

Should I use CSV or JSON?

Use CSV for quick review and spreadsheet import. Use JSON for automation, detailed inventory, evidence provenance, and troubleshooting.

Does the local scanner upload data?

No. This release writes results locally and does not interact with AssetLoom Cloud.