v0.3.4

Port scans now name the software and version a service reports, can check common UDP services, and report closed ports as closed on Windows instead of filtered. The CLI writes CSV and Markdown tables, inspect gives an OS hint, and the desktop app can update itself. Discovery no longer lists the network broadcast address as a device.

Added

• The CLI can write CSV and Markdown tables. --csv and --md work on
  every command that returns a list (discover, scan, sweep, dns,
  ping, arp, interfaces, mdns and pcap). The columns are the same
  field names --json uses, one row per host, port, record or packet, so a
  result opens straight in a spreadsheet or pastes into an issue without
  going through jq. Text a scanned host chose is made safe for each. A
  banner that starts like a spreadsheet formula is defused, the same way the
  desktop app's CSV export already does it, and one containing Markdown or
  HTML is escaped.

• Port scans show the software and version where a service states them.
  An SSH server's identification line, a web server's Server header, an
  FTP or mail server's greeting and a MySQL or MariaDB server's connection
  greeting usually name the software, often with its version:
  OpenSSH 9.6p1, nginx 1.25.3, MariaDB 10.11.6. Redis, Valkey and
  Memcached say nothing until asked, so each gets the one read-only question
  that returns its version. Scans report this as product and version in
  the JSON, and in a Version column in the CLI, the terminal UI and the
  desktop app. It's far narrower than nmap's -sV: a service that doesn't
  announce itself, and isn't one of those three, gets no version.

• UDP scanning. netscli scan <host> --udp checks the UDP services most
  networks run (DNS, NTP, NetBIOS, SSDP and mDNS), each sent the request it
  expects, or the ports you give with -p. A reply reads as open, with what
  came back (NTP v4, stratum 2, a UPnP device's server string, a Windows
  machine's NetBIOS name). A port-unreachable reads as closed, and silence
  reads as open|filtered, because UDP can't tell a quiet service from a
  firewall. It needs no administrator rights. The terminal UI takes
  /scan <host> --udp, the MCP server's scan_ports takes udp: true, and
  the desktop app's Port Scan has a TCP/UDP switch.

• Inspect gives an OS hint. netscli inspect now says what the host
  probably runs, with the clues behind it, such as a Windows machine's exact
  version and build from the start of an SMB connection (no login), the
  distribution an SSH banner names, an (Ubuntu) or IIS web server header,
  Windows' RPC and file-sharing ports, an Apple or Raspberry Pi network card,
  and the ping reply's TTL. It also shows the host's MAC address and vendor
  when it's on the same network. It's a hint, not nmap's packet
  fingerprinting, and needs no administrator rights. The same hint is in the
  terminal UI, the desktop app's Inspect details and the MCP server's
  inspect_host.

• The desktop app can update itself. It already told you when a newer
  release was out and linked to the release page. Now, where it can, the
  notice opens a dialog with the release notes and an Install and
  restart button. The update is downloaded, checked against NetsCLI's
  signing key, installed, and the app reopens. Nothing downloads unless you
  click it, and the existing setting still turns the check off entirely.

  Installs that a package manager owns keep the old link, because an update
  from inside the app would fight it. That covers Scoop, the AUR package and
  .deb installs. The Homebrew cask now declares auto_updates, so
  Homebrew leaves updates to the app.

  This takes effect from the version after this one. An app can only update
  itself if it was built with the updater, so 0.3.4 is the first that can,
  and 0.3.5 is the first update it will install.

Changed

• MCP scan replies leave out closed and filtered ports. scan_ports and
  inspect_host returned one entry for every port scanned, so a 1,024-port
  scan of a machine with two open ports came to 136,834 bytes of mostly
  "closed". They now return open, open|filtered and errored ports only,
  which made the same scan 178 bytes. Pass include_closed: true for every
  port. Replies are also sent as compact JSON instead of indented, which
  took a sweep of the local network from 15,399 bytes to 8,746.

• Defaults now match across the CLI, TUI, desktop app and MCP server.

  • The desktop app scanned five ports by default (22, 80, 443, 8080 and
    8443) where everything else scans 22, 80 and 443. It now uses the same
    three, for port scans and inspect alike.
  • The MCP server applied the timeout it advertises to every step, so an
    MCP inspect or sweep pinged with 500 ms where the others use 1,000, and
    gave name lookups 500 or 1,000 ms where the others give 1,500. Without a
    timeout each step now keeps its usual default.
  • The MCP tool list advertised defaults the server did not use. DNS
    lookups claimed an A record and look up every type, discover and
    sweep claimed 192.168.1.0/24 and use your own network, and background
    captures claimed capture.pcap and name the file after the job. The
    tool list now says what happens.
  • Ping count tops out at 256 everywhere. The desktop app stopped at 50 or
    64, and the TUI had no limit at all.
  • Desktop inspect ignored the concurrency setting in Preferences. It now
    uses it, like scan, discover and sweep.
  • A desktop packet capture lasts 10 seconds by default, as on the CLI and
    MCP server, instead of 5.

• Discovery reads the Windows device table directly instead of running
  arp -a and parsing its text. On an idle machine that makes no measurable
  difference (arp -a took 65 ms), but it removes a program start from every
  discover and sweep, and under heavy CPU load arp -a took about 4 seconds
  on the same machine.

Fixed

• Discovery reported the broadcast address as a device. The network's
  device table on Windows lists x.x.x.255 with the MAC
  ff:ff:ff:ff:ff:ff, and discovery listed it as a host that ignored ping
  (and a sweep then scanned it). The network and broadcast addresses, and broadcast and
  multicast MACs, are no longer reported.
• Closed ports showed as filtered on Windows. Windows waits about two
  seconds before reporting a refused connection, and the scan stops waiting
  after half a second, so a port that was plainly closed came back as
  filtered. The scan now reports it as closed straight away. A scan of 1,024
  ports on a LAN machine went from 1,022 filtered to 1,022 closed.
• The macOS app could be refused as broken on Apple Silicon. Its only
  signature was the one Apple's linker puts on every arm64 program, which
  claims the app's files are sealed when nothing sealed them. macOS's own
  checks fail it with "code has no resources but signature indicates they
  must be present", a broken app rather than one from an unidentified
  developer, so the Open Anyway route the site describes may never be
  offered. The whole app is now ad-hoc signed, which seals it, and the
  release checks the app inside the finished .dmg before shipping it. It is
  still not notarized, so the first launch still goes through Open Anyway in
  System Settings → Privacy & Security.
• Redis, DNS, NFS, SOCKS and Prometheus ports were probed as if they
  spoke TLS. The scanner treated any service name ending in "s" as a TLS
  variant, a rule meant for imaps and pop3s, so these ports got a TLS
  handshake instead of having their greeting read. The TLS services are now
  listed by name.
• Installing the desktop app with Scoop now adds it to the Start menu. The
  manifest's shortcut pointed at NetsCLI.exe, a file that is in no version of
  the package. Scoop extracts the MSI rather than running it, which leaves the
  app at PFiles\NetsCLI\netscli-gui.exe. Scoop reported "Creating shortcut
  ... failed" and finished the install anyway, so the app was installed with no
  way to launch it but finding the folder. The manifest now flattens that
  folder and names the real executable, and the publish job sets both on every
  release.
• The desktop app itself is signed, not only its installer. Since 0.3.3 the
  .msi has carried an Authenticode signature, but netscli-gui.exe inside it
  did not, and that is the file SmartScreen and antivirus look at when the app
  runs. It is now signed during the build, before it is packed into the
  installer, and the release checks the finished MSI's contents before
  shipping it. Measured on the published 0.3.3 installer. The MSI's signature
  is valid, the app inside it is unsigned.

---

Full changelog: v0.3.3...v0.3.4