Network footprint
This is the page to hand whoever approves the agent on a network. It lists everything the agent sends, where, and why.
Connections to Infrality
Section titled “Connections to Infrality”| Destination | Port | Protocol | When |
|---|---|---|---|
api.infrality.io |
443 | HTTPS | Registration at start-up; a fallback heartbeat; results posted when the live channel dropped mid-sweep |
api.infrality.io |
443 | WebSocket over TLS | Held open: heartbeat every 20 s, sweep progress and hosts, commands from the dashboard |
www.infrality.io |
443 | HTTPS | Installation only: the installer, the signed manifest and the release archive |
Nothing inbound. The agent never listens on the network. The firewall needs one outbound rule, and no port forwarded to the machine.
The API key travels in the first message of each connection, inside TLS. A plaintext http:// API address is refused anywhere but loopback.
Reconnection is jittered exponential backoff from 1 to 30 seconds, so a fleet that lost the API together does not return in one wave.
Probes on the swept range
Section titled “Probes on the swept range”Only when a sweep runs — when somebody presses Scan, or on the agent’s own interval if one is set.
Once per sweep, for the whole segment
Section titled “Once per sweep, for the whole segment”| Probe | Sent to | Switch |
|---|---|---|
| ARP requests | Each address in the range, broadcast on the segment (Linux; capped at 8192 addresses) | discovery.arp |
| mDNS browse | 224.0.0.251, UDP 5353, from the interface owning the range |
discovery.mdns |
| SSDP search | 239.255.255.250, UDP 1900, from the same interface |
discovery.ssdp |
On macOS and Windows, and on Linux without CAP_NET_RAW, there is no raw ARP sweep: the agent sends one small UDP datagram to each address so the operating system resolves it, then reads the system’s own neighbour table.
To every address in the range
Section titled “To every address in the range”| Probe | Detail |
|---|---|
| ICMP echo request | One per address, from a raw socket |
To each host that answered
Section titled “To each host that answered”| Probe | Port | What is read | Switch |
|---|---|---|---|
| Reverse DNS | your resolver, 53 | The PTR name | discovery.dns |
| NetBIOS node status | UDP 137 | Workstation name, workgroup, MAC | discovery.netbios |
| LLMNR query | UDP 5355 | The name of a Windows host with NetBIOS off | discovery.llmnr |
SNMP v2c get |
UDP 161 | sysName, sysDescr — with the configured community (public by default) |
discovery.snmp |
| TCP connect | the twenty ports below | Open or not. Connected and closed at once | discovery.ports |
| HTTP request | first of 80, 8080, 5000, 8006, 631 that is open | The Server: header and the page title |
discovery.ports |
| TLS handshake | first of 443, 8443 that is open | The certificate’s name and expiry. The certificate is read, not trusted | discovery.ports |
| SSH greeting | 22, if open | The version line the server sends unprompted. Nothing is sent; no authentication is attempted | discovery.ports |
| Hop count | ICMP with rising TTL | Routers between here and an off-segment host. Off by default | discovery.hops |
A banner is read only from a port that was found open, and only from ports in the configured list.
The twenty ports
Section titled “The twenty ports”22 ssh · 23 telnet · 53 dns · 80 http · 139 netbios-ssn · 443 https · 445 smb · 515 lpd · 548 afp · 554 rtsp · 631 ipp · 3389 rdp · 5000 upnp / Synology · 5900 vnc · 8006 Proxmox · 8080 http-alt · 8443 https-alt · 9100 jetdirect · 32400 Plex · 62078 iPhone / iPad
At most eight connections to one host at a time, 500 ms each. It is enough to say a host is a printer, a camera, a hypervisor or a phone; it is not a port scan, and no service is fingerprinted beyond the banners above. discovery.port_list replaces the list.
Whether the network reaches the internet
Section titled “Whether the network reaches the internet”Once per sweep, in parallel, three seconds at most:
| Probe | Switch |
|---|---|
TCP handshake to 1.1.1.1:443, 8.8.8.8:443, 9.9.9.9:443 |
discovery.internet |
cloudflare.com resolved with the system resolver |
discovery.internet |
GET https://1.1.1.1/cdn-cgi/trace — the public address and country |
discovery.public_ip |
Turn off public_ip on a network where no request may leave for a third party; the uplink is still reported as up or down.
- Identification runs for at most 16 hosts at a time, each capped at 4 seconds, whatever
workers.countsays. - Each probe has its own deadline (
discovery.timeout, 1.2 s) and a failure is silence, not a retry. - Between sweeps the agent sends a heartbeat every 20 seconds and nothing else.
What intrusion detection will see
Section titled “What intrusion detection will see”A ping sweep, an ARP sweep, short-lived TCP connections to a fixed list of ports, and a few UDP name queries — the pattern of an inventory scanner. If your IDS alerts on that, allow-list the agent’s address for the swept range rather than turning probes off one by one.
On the machine itself
Section titled “On the machine itself”- Linux service: runs as
infrality-agent, holdingCAP_NET_RAWonly, under a systemd sandbox. See privileges. - Files written:
config.yaml(when a setting changes on the dashboard), andtopology.jsonafter each sweep. - Listener: the metrics endpoint on
127.0.0.1:2112, loopback only unless configured otherwise.