Need help, network discovery across multiple subnets

[GitUserGhost]

Hello,

We need your help. We're trying to implement a network discovery tool in our company. The problem is that we have several subnets, and the tool can't scan the other networks (via NMAP or SNMP).

We suspect we haven't configured the tool correctly in the settings, but we can't figure out the source of the problem.

We've correctly added the subnet with the single network interface we have to the subnet, but nothing happens. Furthermore, we have to add the physical machine's IP address to the subnet to find devices on the same network using the ARP protocol. Is this normal?

Thank you in advance for your help.

[jokob-sk]

Hi there,

Here is probably relevant documentation:

• https://jokob-sk.github.io/NetAlertX/REMOTE_NETWORKS/?h=remote
• https://jokob-sk.github.io/NetAlertX/SUBNETS/?h=vlans#vlans-on-a-hyper-v-setup

As mentioned in the docs, try to SSH into the container and execute the commands directly. If the networks are reachable you should be able to configure NAX as well. If not, you will need to use supplementary plugins.

Providing logs and your relevant settings might give me more information so that I can help, but read the above docs first. I'm also not sure what you mean by your last paragraph so logs and settings are essential.

[jokob-sk]

Hummm... If you have want you can try to adjust the scrip to be more permissive, but I can't implement it myself as it's working fine for me. Happy to accept a PR.

[GitUserGhost]

Indeed, if Nmap works in your container, then the problem lies elsewhere. We're using Debian 12 as our OS and Docker version 29.0.4.

[GitUserGhost]

I just did a test with a Debian container in host mode that has nmap installed, and it works.

[GitUserGhost]

Here is my configuration file:

services:
  netalertx:
  #use an environmental variable to set host networking mode if needed
    container_name: netalertx                       # The name when you docker contiainer ls
    image: ghcr.io/jokob-sk/netalertx:latest
    network_mode: ${NETALERTX_NETWORK_MODE:-host}   # Use host networking for ARP scanning and o>

    read_only: true                                 # Make the container filesystem read-only
    cap_drop:                                       # Drop all capabilities for enhanced security
      - ALL
    cap_add:                                        # Add only the necessary capabilities
      - NET_ADMIN                                   # Required for ARP scanning
      - NET_RAW                                     # Required for raw socket operations
      - NET_BIND_SERVICE                            # Required to bind to privileged ports (nbts>

    volumes:
      - type: volume                                # Persistent Docker-managed named volume for>
        source: netalertx_data
        target: /data                               # `/data/config` and `/data/db` live inside >
      #  read_only: true

      - type: bind                                  # Bind mount for timezone consistency
        source: /etc/localtime
        target: /etc/localtime
        read_only: false

    # tmpfs mount consolidates writable state for a read-only container and improves performance
    # uid=20211 and gid=20211 is the netalertx user inside the container
    # mode=1700 grants rwx------ permissions to the netalertx user only
    tmpfs:
      # Comment out to retain logs between container restarts - this has a server performance im>
      - "/tmp:uid=20211,gid=20211,mode=1700,rw,noexec,nosuid,nodev,async,noatime,nodiratime"

      # Retain logs - comment out tmpfs /tmp if you want to retain logs between container restar>
      # Please note if you remove the /tmp mount, you must create and maintain sub-folder mounts.
      # - /path/on/host/log:/tmp/log
      # - "/tmp/api:uid=20211,gid=20211,mode=1700,rw,noexec,nosuid,nodev,async,noatime,nodiratim>
      # - "/tmp/nginx:uid=20211,gid=20211,mode=1700,rw,noexec,nosuid,nodev,async,noatime,nodirat>
      # - "/tmp/run:uid=20211,gid=20211,mode=1700,rw,noexec,nosuid,nodev,async,noatime,nodiratim>

    environment:
      LISTEN_ADDR: ${LISTEN_ADDR:-0.0.0.0}                   # Listen for connections on all int>
      PORT: ${PORT:-20211}                                   # Application port
      GRAPHQL_PORT: ${GRAPHQL_PORT:-20212}                   # GraphQL API port (passed into APP>
  #    NETALERTX_DEBUG: ${NETALERTX_DEBUG:-0}                 # 0=kill all services and restart >

    # Resource limits to prevent resource exhaustion
    mem_limit: 2048m            # Maximum memory usage
    mem_reservation: 1024m      # Soft memory limit
    cpu_shares: 512             # Relative CPU weight for CPU contention scenarios
    pids_limit: 512             # Limit the number of processes/threads to prevent fork bombs
    logging:
      driver: "json-file"       # Use JSON file logging driver
      options:
        max-size: "10m"         # Rotate log files after they reach 10MB
        max-file: "3"           # Keep a maximum of 3 log files

    # Always restart the container unless explicitly stopped
    restart: unless-stopped

volumes:                        # Persistent volume for configuration and database storage
  netalertx_data:

  LOG_LEVEL=debug

[jokob-sk]

You can try running this inside the container:

1. sudo nmap -sn -oX - X.X.X.0/24 ; echo "exit=$?"

this however removes the interface and it's not currently supported in NAX. I can add support for this scenario, but not sure if this then allows you to scan across subnets.

Not sure if NMAP if feasible for your scenario - maybe looking back into SNMP makes sense?

I'm confused though as you said this worked in the NAX container previously:

sudo nmap -sn -PR -oX - -e eno1 X.X.X.0/24

Can you confirm that's the case? If so, can you run this?

2. sudo nmap -sn -PR -oX - -e eno1 X.X.X.0/24; echo "exit=$?"
3. Are you running these commands in the NAX container?

Please post the full output and answer 1,2,3 to make sure we are on the same page I don't see a reason why the command should run directly, but not by being triggered by NAX.

PS:

LOG_LEVEL=debug doesn't do anything, if you want you can set it via APP_CONF_OVERRIDE, e.g.:

...
environment:
   ...
   - APP_CONF_OVERRIDE={"SCAN_SUBNETS":"['192.168.1.0/24 --interface=eth1']","GRAPHQL_PORT":"20223","UI_theme":"Light","LOG_LEVEL":"debug"}
   ...
...