Read the internal topology map

Summary

The Internal Network Map rebuilds the network your probe scanned: each subnet is a cluster with its gateway in the middle and its devices around it. This lesson shows you how to move around the map, where each device's type and posture come from, and how to spot a flat network.

Networks and gateways

Open an internal scan and scroll down to Internal Network Map. Scanned networks: lists the subnets that were analysed.

• A gateway with the Gateway badge is confirmed by the probe's routing table ("Confirmed from the routing table").
• The Gateway? badge marks the most likely gateway for that subnet: it is inferred, not confirmed by a routing table.
• When no gateway was found in a subnet, its label reads "no gateway detected" and the subnet itself sits in the middle of the cluster.
• Links are inferred too: you see which network each device belongs to, not how the switches are cabled.

Moving around the map

• Click a device: it stays highlighted together with what it connects to (for example its gateway); everything else fades.
• Double-click a device: the map zooms in on that card and keeps it selected.
• Click a gateway: isolates the whole subnet.
• Click the background: clears the selection.
• Fit View shows every network; Centre gateway and Centre probe host move the view to the main gateway and to the machine running Scout.

Cards, fingerprinting, confidence and posture

Each card shows the device's type, name, IP address, open ports and technologies. The type comes from fingerprinting: the probe cross-checks service banners, SMB, SSH, SNMP, DHCP and the network card's manufacturer, and works out the operating system, model and role.

• Confidence measures how much evidence was collected on a device: the more signals agree, the higher it gets. It is not a probability.
• Posture is a grade from A to F. It starts from 100 points and loses points for weak configurations such as SMBv1 enabled, deprecated TLS, or Telnet or RDP exposed.

The Legend colours each device type and marks the Probe host and Internet-exposed devices.

Chapters

Key points

• A Gateway? badge is an inference: check it before you act on that device.
• The map shows subnet membership, not cables: use it to understand segmentation, not to trace wiring.
• One click highlights, a double-click zooms, a click on the background resets.
• High confidence means many signals agree; a D or F posture points to weak configurations to fix.
• The Flat network detected on finding appears under Vulnerabilities when different device types share one subnet with no separation (for example industrial machines and servers). A compromised computer on that network can reach the line controllers directly. The fix is to separate OT from IT with VLANs or firewall zones.

Transcript

The full transcript of the video (in Italian) is in the player's Transcript tab.

Next steps