shellgraph

How the map is made

The server finds a destination for each connection. When the destination is not a collected host, the arrow goes to Internet, No access or Outside environment.

The server makes the map each time that you open it, from the data of the last scans. The ignore rules and the tag rules apply at that moment. Change a rule, open the map again, and the change is there without a new scan.

Outbound connections

For each outbound connection, the server finds the destination in this sequence:

  1. A service on the same host.
  2. A service on a host of this Environment that listens on the destination port.
  3. A host of a different Environment. The node shows the hostname and the Environment.
  4. An address in a VLAN of this Environment without collected data: the No access group.
  5. A private address that is not in the VLANs: the Outside environment group.
  6. A public address: the Internet node.

Only the routable addresses of a host identify it. The loopback address and the addresses of bridges and containers (for example docker0) exist on many hosts with the same value. The server uses them only inside the same host.

Inbound connections

  • If the client is a host of this Environment, the server ignores the inbound side. The outbound side of the client already gives the arrow.
  • If the service is internet facing, the arrow comes from the Internet node.
  • If not, the server uses the rules 3 to 6 above, with the arrow in the opposite direction.

Why “internet facing” is a setting

A firewall or a NAT gateway often changes the source address of an Internet client to a private address. The server then sees a private client. Nothing in the socket tells it that the real client is on the Internet.

You tell it. Mark the services at the edge, for example the load balancers, as internet facing. Such a service always has an arrow from the Internet node to each of its ports, even when the scan saw no traffic.

When a service gets connections from public addresses and is not internet facing, the map shows it with a dashed yellow border. Examine the service. If it is at the edge, mark it.

Stale data

A host that the last scan could not collect keeps its last data. The map shows it with a dashed red border, and its arrows with dashed red lines. See Rescans.