Scan your first VLAN · ShellGraph

You use the same lab as in Make your first map. You need approximately 15 minutes.

Before you start

Make sure that your Linux computer has Podman, and Go 1.27, Node.js 24 and pnpm 11 to build ShellGraph.

Clone the repositories in the same directory.

git clone https://git.rda.run/shellgraph/server.git
git clone https://git.rda.run/shellgraph/collector.git

Start and register the lab

Build the server image and the collector.

make -C server image
make -C collector build-local

Go to the lab directory and start the containers.
```
cd collector/testlab
./lab.sh up
```
Register the Environment “Lab” and its VLAN “lab-net”.
```
./lab.sh setup
```

Create a collector token

The collector needs a token to use the server.

Open http://127.0.0.1:8088 and log in with the login alice and the password alice-lab-pass.
Open Collector tokens and select Create token.
Type the name my-collector.
Copy the token. The UI shows it one time only.

Log in to the server

Open a shell in the collector container.
```
podman exec -it sg-collector sh
```
Log in with your token. In the lab, the server uses http, so add --insecure-http.
```
shellgraph login --server http://10.89.70.5:8080 --token <token> --insecure-http
```
The collector tests the token and keeps it in its configuration file.

Scan from the menus

Start a scan without arguments.
```
shellgraph scan --insecure-http
```
The collector shows the Environments. Type 1 and press Enter.
```
Environment:
  1) Lab
Select the Environment [1-1]: 1
```
The collector shows the VLANs of the Environment. Type 1 and press Enter.
```
VLAN:
  1) lab-net (10.89.70.0/24)
Select the VLAN [1-1]: 1
```

The collector tests each address of the VLAN, collects the hosts that answer, and sends one report:

Scanning Lab / lab-net (10.89.70.0/24) with user "shellgraph"...
  10.89.70.11     ok       app, 3 services
  10.89.70.10     ok       lb, 2 services
  10.89.70.12     ok       db, 2 services
Done: 3 ok, 0 partial, 0 auth_failed, 0 hostkey_changed, 0 error, 251 no_ssh.
Report sent (scan 1). Map: http://10.89.70.5:8080/environments/1/map

Each line is one address with SSH. ok tells that the collection is complete. The other 251 addresses have no SSH server (no_ssh).

In the browser, open the Environment “Lab”, then Open map. The map shows lb, app and db.

Stop a server and scan again

In a different terminal on your computer, stop the database server.
```
podman stop sg-db
```
In the collector shell, scan again. This time, give the Environment and the VLAN, so that the collector does not show the menus.
```
shellgraph scan --env Lab --vlan lab-net --insecure-http
```
The summary now has 2 hosts ok and 252 addresses no_ssh.
Open the map again.
The host db and its services are not on the map. The server deleted it, because it did not answer on the SSH port. Rescans gives the reason for this rule.

Remove the lab

Leave the collector shell.
```
exit
```
Remove the lab.
```
./lab.sh down
```

Next steps

For your own network, continue with these pages:

Prepare the target hosts of your network.
Schedule scans.
How the collector works.