nmapscand

Purpose

nmapscand is a worker daemon that processes queued nmap scan tasks — running an nmap port/service/OS scan against a target host and storing the results (open ports, detected services and versions, OS fingerprint) in ClickHouse. Tasks are enqueued by hostsync for newly discovered hosts, or by the dashboard/API (POST /api/hosts/{uuid}/nmapscan).

Usage

nmapscand -c <config.yaml> [-debug]

Flag	Default	Description
`-c`	—	Path to config file (required)
`-debug`	`false`	Enable debug logging

Configuration

nmapscand.yaml:

name: nmapscand
clickhouse:
  host: localhost
  port: 19000
  database: insights
  username: <clickhouse-user>
  password: "<clickhouse-password>"
redis:
  host: localhost
  port: 6379
  password: "<redis-password>"   # Redis AUTH is required
debug: false
concurrency: 3        # max concurrent scans, default 3 if unset/0 (nmap is resource-intensive)
scan_interval: 24h     # minimum time between re-scans of the same host

On startup, nmapscand checks the database schema and loads the capture and scanner settings configured in the dashboard (the same settings tlsscand uses for internal-network classification).

Example

# Run as a daemon
nmapscand -c nmapscand.yaml

# Run with debug logging
nmapscand -c nmapscand.yaml -debug

tlsscand tlsscan