Problem - NMAP scanning not working

[Marcussjogren]

Hi,

I'm having issues port scanning with network-discovery. The documentation says that only specifying targets will be the same as running "nmap " so that it will discover services / open ports.

However, I cannot get port scanning working no matter what I do,

I have tried to only specify targets and I have tried to specify "ports" or "top_ports" etc. But when I do that I get the error message below. This message appears when adding "ports: 1-1000" under "targets:"

I have forced it to use netboxlabs/orb-agent:2.0.0 in the run command.

Any ideas?

{"time":"2025-05-09T09:34:34.235534801Z","level":"INFO","msg":"network-discovery stdout","log":"time=2025-05-09T09:34:34.235Z level=INFO msg=\"starting network-discovery server at: localhost:8073\""}
{"time":"2025-05-09T09:34:35.050969955Z","level":"INFO","msg":"network-discovery process started","pid":23}
{"time":"2025-05-09T09:34:35.056401266Z","level":"INFO","msg":"network-discovery readiness ok, got version ","network_discovery_version":"1.0.0"}
{"time":"2025-05-09T09:34:35.056454667Z","level":"INFO","msg":"managing agent policy from core","action":"manage","name":"discovery_1","dataset":"afb755f6-c519-420a-a47f-84ecfadc23c2","backend":"network_discovery","id":"28bbc0b2-2539-501e-97b0-3a6d1882b89f","version":1}
{"time":"2025-05-09T09:34:35.058598111Z","level":"WARN","msg":"policy application failure","policy_id":"28bbc0b2-2539-501e-97b0-3a6d1882b89f","policy_name":"discovery_1"}
{"time":"2025-05-09T09:34:35.058710413Z","level":"WARN","msg":"policy failed to apply","policy_id":"28bbc0b2-**2539-501e-97b0-3a6d1882b89f","policy_name":"discovery_1","error":"400 yaml: unmarshal errors:\n  line 13: cannot unmarshal !!str `1-1000` into []string"}**

[Marcussjogren]

Also, what does the parameters host and port point to in the below configuration? No explanation of this in the documentation.
orb
...
backend:
network_discovery:
host: 192.168.5.11 # default 0.0.0.0
port: 8863 # default 8073

[Marcussjogren]

Also, what does the parameters host and port point to in the below configuration? No explanation of this in the documentation. orb ... backend: network_discovery: host: 192.168.5.11 # default 0.0.0.0 port: 8863 # default 8073

Ah now I think I understand, this is for which network discovery server to report results to.

[leoparente]

hi @Marcussjogren a config file for orb-agent that wants to deploy a network-discovery policy should look like this

orb:
  config_manager:
    active: local
  backends:
    network_discovery:
    common:
      diode:
        target: grpc://192.168.31.113:8080/diode
        client_id: diode-ingest
        client_secret: ${DIODE_API_KEY}
        agent_name: agent02
  policies:
    network_discovery:
      discovery_1:
        config:
          schedule: "* * * * *"
        scope:
          targets: [192.168.31.1-122]
          fast_mode: True
          scan_types: [udp, syn]
          top_ports: 3

the backend config is related to the internal rest API do deploy/delete policies, you don't need to care about it
host: 192.168.5.11 # default 0.0.0.0
port: 8863 # default 8073

[leoparente]

if you want to specify ports it must be a array of strings:

      scope:
          targets: [192.168.31.1-122]
          ports : [1-1000] # or [1-100, 300-400]

Yaml also suports this format:

scope:
  targets:
     - 192.168.1.12/24
  ports:
     - 1-100
     - 300-400
     - 8080 

[Marcussjogren]

ports:
- 1-100

Yup - thats exactly what I've tried. Now that I format it your way, I dont get the error. However, the scan ends within 2-3 seconds (shown in timestamp below) and it does not perform any port scanning as far as I can see.

{"time":"2025-05-09T11:40:00.004004596Z","level":"INFO","msg":"network-discovery stdout","log":"time=2025-05-09T11:40:00.003Z level=INFO msg="running scanner" targets=[] policy=discovery_1"}
{"time":"2025-05-09T11:40:03.935118897Z","level":"INFO","msg":"network-discovery stdout","log":"time=2025-05-09T11:40:03.934Z level=INFO msg="entities ingested successfully" policy=discovery_1"}

[leoparente]

hi @Marcussjogren , that is strange and maybe a issue. are your targets available?
Also, can you try:

scope:
  targets [<your_targerts>]
  fast_mode: True

So we can narrow down the issue to the port scanning or not.

[Marcussjogren]

hi @Marcussjogren , that is strange and maybe a issue. are your targets available? Also, can you try:

scope:
  targets [<your_targerts>]
  fast_mode: True

So we can narrow down the issue to the port scanning or not.

I'll post my full anonymized agent.yaml below, but no, that did not make any difference. The agent runs in the same subnet as the targets, so no firewall blocking.

orb:
  config_manager:
    active: local
  backends:
    network_discovery:
      log_level: DEBUG
    common:
      diode:
        target: grpc://10.10.28.2:8089/diode
        api_key: ${DIODE_API_KEY}
        agent_name: agent01
        client_id: diode-ingest
        client_secret: <client_secret>
  policies:
    network_discovery:
      discovery_1:
        config:
          schedule: "* * * * *"
          timeout: 5
          defaults:
            comments: none
            description: IP discovered by network discovery
            tags: [net-discovery, orb-agent]
        scope:
          targets: [10.10.28.0/28]
          fast_mode: True
          scan_types: [udp,syn]
          ports: [22,80,443,53]

The IP 10.10.28.2 definitely has ports opened. I ran "nmap 10.10.28.2" from the orb container and this is the first ports:

root@server:/opt/netbox-docker/diode# docker exec -it 296c5bc61dea sh
# nmap 10.10.28.2
Starting Nmap 7.80 ( https://nmap.org ) at 2025-05-09 14:15 UTC
Nmap scan report for 10.10.28.2
Host is up (0.000017s latency).
Not shown: 982 closed ports
PORT      STATE    SERVICE
22/tcp    open     ssh
53/tcp    open     domain

[Marcussjogren]

any idea what I can do to troubleshoot this further @leoparente?

[leoparente]

Hi @Marcussjogren sorry for the delay. I was off this past week. I would try the following:

in the policy config, only passes target and fast_mode to ensure that it is at least working:

        scope:
          targets: [10.10.28.0/28]
          fast_mode: True

[Marcussjogren]

scope:
targets: [10.10.28.0/28]
fast_mode: True

I did that, did not make any difference.

Is there any way I can really make sure that the port scanner is running? So that I'm not trying to troubleshoot something that is really working but doesn't make any visual apperance?

Should it add found services to the IP in netbox for example or what should happen?

[leoparente]

Hi @Marcussjogren You are right, sorry for that. To help on the debug I've improved the log messages for the network_discovery backend.

So you can pull latest develop image that should contain network_discovery version 1.2.0:

docker pull netboxlabs/orb-agent:develop

and run your agent using this image.

Then on container logs you will see the version, something like this:

{"time":"2025-05-22T17:23:48.064846782Z","level":"INFO","msg":"network-discovery readiness ok, got version ","network_discovery_version":"1.2.0"}

Now, if the discovery works you will see the logs:

{"time":"2025-05-22T17:23:09.67145161Z","level":"INFO","msg":"network-discovery stdout","log":"time=2025-05-22T17:23:09.671Z level=INFO msg=\"discovery complete\" hosts_found=3 policy=discovery_1"}
{"time":"2025-05-22T17:23:09.684928765Z","level":"INFO","msg":"network-discovery stdout","log":"time=2025-05-22T17:23:09.684Z level=INFO msg=\"entities ingested successfully\" policy=discovery_1"}

If it does not find any host, you will have the following:

{"time":"2025-05-22T17:26:00.535882177Z","level":"INFO","msg":"network-discovery stdout","log":"time=2025-05-22T17:26:00.535Z level=WARN msg=\"discovery complete: no hosts found\" targets=[192.168.31.110/31] policy=discovery_1"}

Should it add found services to the IP in netbox for example or what should happen?

We are not able to add port as services at this stage. So, currently it shows the open ports closed and so on as comments:

[Marcussjogren]

I tried as suggested, but for some reason it does not ingest any port numbers into the comments.

I can however see that it says "snmp_discovery" for some reason?

This is my config:

orb:
  config_manager:
    active: local
  backends:
    network_discovery:
      log_level: DEBUG
    common:
      diode:
        target: grpc://10.10.28.2:8089/diode
        api_key: ${DIODE_API_KEY}
        agent_name: agent-srv01
        client_id: diode-ingest
        client_secret: <removed>
  policies:
    network_discovery:
      discovery_1:
        config:
          schedule: "* * * * *"
          timeout: 5
          defaults:
            comments: none
            description: IP discovered by network discovery
            tags: [net-discovery, orb-agent]
        scope:
          targets: [10.10.28.0/28]
          fast_mode: True

This is the output:

root@-srv01:/opt/netbox-docker/orbagent# docker run --net=host -v /opt/netbox-docker/orbagent:/opt/orb/ netboxlabs/orb-agent:develop run -c /opt/orb/agent.yaml
Contains default config file
Setting default_pcap as visor tap
Running with config file parameter
Starting orb-agent : /usr/local/bin/orb-agent with args 3
{"time":"2025-06-02T15:02:43.659490209Z","level":"INFO","msg":"backends loaded","backends":{"common":{"diode":{"agent_name":"agent--srv01","api_key":"${DIODE_API_KEY}","client_id":"diode-ingest","client_secret":"<removed>","target":"grpc://10.10.28.2:8089/diode"}},"network_discovery":{"log_level":"DEBUG"}}}
{"time":"2025-06-02T15:02:43.659632912Z","level":"INFO","msg":"no secrets manager specified or invalid type, skipping"}
{"time":"2025-06-02T15:02:43.659666913Z","level":"INFO","msg":"agent started","version":"v2.0.0","routine":"agentRoutine"}
{"time":"2025-06-02T15:02:43.659675613Z","level":"INFO","msg":"requested backends","values":{"common":{"diode":{"agent_name":"agent--srv01","api_key":"${DIODE_API_KEY}","client_id":"diode-ingest","client_secret":"<removed>","target":"grpc://10.10.28.2:8089/diode"}},"network_discovery":{"log_level":"DEBUG"}}}
{"time":"2025-06-02T15:02:43.659699714Z","level":"INFO","msg":"registered backends","values":["otel","device_discovery","network_discovery","worker","snmp_discovery","pktvisor"]}
{"time":"2025-06-02T15:02:43.659906418Z","level":"INFO","msg":"network-discovery startup","arguments":["--host","localhost","--port","8073","--diode-target","grpc://10.10.28.2:8089/diode","--diode-client-id","diode-ingest","--diode-client-secret","********","--diode-app-name-prefix","agent--srv01"]}
{"time":"2025-06-02T15:02:43.939852618Z","level":"INFO","msg":"network-discovery stdout","log":"time=2025-06-02T15:02:43.938Z level=INFO msg=\"starting network-discovery server at: localhost:8073\""}
{"time":"2025-06-02T15:02:44.660394547Z","level":"INFO","msg":"network-discovery process started","pid":22}
{"time":"2025-06-02T15:02:44.662590393Z","level":"INFO","msg":"network-discovery readiness ok, got version ","network_discovery_version":"1.3.0"}
{"time":"2025-06-02T15:02:44.662628994Z","level":"INFO","msg":"managing agent policy from core","action":"manage","name":"discovery_1","dataset":"6eb05e88-63e4-4770-ac9b-cd4b1e6733d4","backend":"network_discovery","id":"28bbc0b2-2539-501e-97b0-3a6d1882b89f","version":1}
{"time":"2025-06-02T15:02:44.663573913Z","level":"INFO","msg":"network-discovery stdout","log":"time=2025-06-02T15:02:44.663Z level=INFO msg=\"policies started\" policies=[discovery_1]"}
{"time":"2025-06-02T15:02:44.663810718Z","level":"INFO","msg":"policy applied successfully","policy_id":"28bbc0b2-2539-501e-97b0-3a6d1882b89f","policy_name":"discovery_1"}
{"time":"2025-06-02T15:02:44.663850119Z","level":"INFO","msg":"heartbeat routine started"}

[leoparente]

hi @Marcussjogren you are adding the string "none" in the comments, That is probably the issue; Please, try to replace

....
          defaults:
            comments: none
            description: IP discovered by network discovery
            tags: [net-discovery, orb-agent]
....

With

....
          defaults:
            description: IP discovered by network discovery
            tags: [net-discovery, orb-agent]
....

[Marcussjogren]

hi @Marcussjogren you are adding the string "none" in the comments, That is probably the issue; Please, try to replace

....
          defaults:
            comments: none
            description: IP discovered by network discovery
            tags: [net-discovery, orb-agent]
....

With

....
          defaults:
            description: IP discovered by network discovery
            tags: [net-discovery, orb-agent]
....

Yeees, thank you! I must have totally missunderstood that config.

Again, thank you for helping me troubleshoot this!

[leoparente]

Great! I will close it then. Thanks for the issue report!