菜单
Network host and port discovery with nmap. Use when scanning TCP ports, enumerating hosts on a subnet, or identifying running services and versions.
默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。
决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/laurigates/claude-plugins --skill network-discovery命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
Install, configure and troubleshoot MCP servers. Use when adding/enabling servers, editing .mcp.json, fixing OAuth, or when a server runs stale code after an upstream fix.
FinOps snapshot — org billing, workflow stats, cache usage. Use when you want a high-level view of CI spending or workflow health before diving deeper.
GitHub Actions billing, workflow efficiency, and waste analysis at org or repo level. Use when investigating CI/CD costs, wasted runs, or optimizing triggers.
正在显示 SKILL.md
基于 SOC 职业分类
| name | network-discovery |
| description | Network host and port discovery with nmap. Use when scanning TCP ports, enumerating hosts on a subnet, or identifying running services and versions. |
| user-invocable | false |
| allowed-tools | Bash(nmap *), Bash(ping *), Bash(arp *), Bash(ip *), Read, Grep, Glob, TodoWrite |
| created | "2026-01-01T00:00:00.000Z" |
| modified | "2026-04-25T00:00:00.000Z" |
| reviewed | "2026-04-25T00:00:00.000Z" |
| Scenario | Use this skill | Alternative |
|---|---|---|
| Scan all 65,535 TCP ports on a target quickly |
| Yes (RustScan) |
| Enumerate live hosts on a subnet | Yes (arp-scan-rs) |
| Identify running services and versions on open ports | Yes (nmap -sV) |
| Run NSE vulnerability or enumeration scripts | Yes (nmap --script) |
| Detect OS fingerprint of a remote host | Yes (nmap -O) |
| Discover which switch port a server is on (LLDP) | layer2-discovery (lldpcli) |
| Trace the route or diagnose latency to a host | network-diagnostics (trippy, gping) |
| Resolve DNS records for a domain | dns-tools (dog, dig) |
| Stress test an HTTP endpoint under load | http-load-testing (oha) |
| Monitor which process is using bandwidth | network-monitoring (bandwhich) |
| Inspect or configure the host's own IPs, links, or routes | interface-state (ip) |
Network discovery follows a two-phase approach: fast enumeration followed by deep analysis.
| Phase | Tool | Purpose | Time |
|---|---|---|---|
| Discovery | RustScan | Scan all 65,535 TCP ports | Seconds |
| Discovery | arp-scan-rs | Find hosts on local network | Sub-second |
| Analysis | nmap | Service detection, scripts | Minutes |
# Scan single host (all 65k ports)
rustscan -a 192.168.1.100
# Scan with nmap service detection
rustscan -a 192.168.1.100 -- -sV
# Scan with nmap scripts (default safe scripts)
rustscan -a 192.168.1.100 -- -sV -sC
# Scan multiple hosts
rustscan -a 192.168.1.100,192.168.1.101
# Scan from file
rustscan -a hosts.txt
# Scan specific ports only
rustscan -a 192.168.1.100 -p 22,80,443
# Scan port range
rustscan -a 192.168.1.100 -r 1-1000
# Adjust for reliability (slower but more accurate)
rustscan -a 192.168.1.100 --ulimit 5000 --batch-size 2500
# Scan local network (auto-detect interface)
arp-scan-rs -l
# Scan specific interface
arp-scan-rs -i en0
# Scan specific range
arp-scan-rs 192.168.1.0/24
# Fast profile (less accurate, faster)
arp-scan-rs -l --profile fast
# Stealth profile (slower, harder to detect)
arp-scan-rs -l --profile stealth
# JSON output for parsing
arp-scan-rs -l --format json
# With VLAN tagging
arp-scan-rs -l --vlan 100
# Resolve hostnames
arp-scan-rs -l --resolve
Use nmap after RustScan identifies open ports:
# Service version detection
nmap -sV -p 22,80,443 192.168.1.100
# Service + default scripts
nmap -sV -sC -p 22,80,443 192.168.1.100
# OS fingerprinting (requires root)
sudo nmap -O -p 22,80,443 192.168.1.100
# Aggressive scan (version, scripts, OS, traceroute)
sudo nmap -A -p 22,80,443 192.168.1.100
# Vulnerability scripts
nmap --script vuln -p 80,443 192.168.1.100
# Specific service scripts
nmap --script http-* -p 80,443 192.168.1.100
# UDP scan (slower, requires root)
sudo nmap -sU -p 53,161 192.168.1.100
# 1. Discover live hosts
arp-scan-rs -l --format json > hosts.json
# 2. Extract IPs and scan ports
arp-scan-rs -l | awk '{print $1}' > hosts.txt
rustscan -a hosts.txt -- -sV -oN scan-results.txt
# 3. Deep dive on specific services
nmap -sV -sC --script vuln -p 22 -iL hosts.txt
# Find hosts with web servers
rustscan -a 192.168.1.0/24 -p 80,443,8080,8443 -- -sV
# Enumerate web technologies
nmap --script http-headers,http-title -p 80,443 192.168.1.100
# Slow ARP discovery
arp-scan-rs -l --profile stealth
# RustScan with lower batch (less noisy)
rustscan -a 192.168.1.100 --batch-size 500 --ulimit 1000
# nmap timing template (T0=paranoid, T1=sneaky)
nmap -T1 -sV -p 22,80 192.168.1.100
# SSH enumeration
nmap --script ssh-* -p 22 192.168.1.100
# SMB enumeration
nmap --script smb-* -p 445 192.168.1.100
# DNS enumeration
nmap --script dns-* -p 53 192.168.1.100
| Context | Command |
|---|---|
| Quick port check | rustscan -a $IP -p $PORTS 2>/dev/null |
| Host discovery | arp-scan-rs -l --format json 2>/dev/null |
| Minimal output | rustscan -a $IP --greppable |
| JSON parsing | arp-scan-rs -l --format json | jq -r '.[].ip' |
| Service IDs only | nmap -sV -p $PORTS $IP -oG - | grep open |
| Suppress banners | rustscan -a $IP -q -- -sV |
| Fast local scan | arp-scan-rs -l --profile fast --format json |
| Flag | Description |
|---|---|
-a | Target address(es) or file |
-p | Specific ports (comma-separated) |
-r | Port range (e.g., 1-1000) |
--ulimit | Max file descriptors (default: 5000) |
--batch-size | Ports per batch (default: 4500) |
--timeout | Timeout in ms (default: 1500) |
-g, --greppable | Greppable output format |
-q | Quiet mode |
-- | Pass remaining args to nmap |
| Flag | Description |
|---|---|
-l | Scan local network |
-i | Interface to use |
--profile | Scan profile (default/fast/stealth) |
--format | Output format (plain/json) |
--vlan | VLAN ID for tagging |
--resolve | Resolve hostnames |
--timeout | Response timeout in ms |
| Flag | Description |
|---|---|
-sV | Service version detection |
-sC | Default script scan |
-O | OS detection (requires root) |
-A | Aggressive (version + scripts + OS) |
-p | Port specification |
-T<0-5> | Timing template (0=slowest) |
-oN | Normal output to file |
-oG | Greppable output |
-oX | XML output |
--script | Run specific NSE scripts |
-iL | Input from host list file |
| Template | Name | Use Case |
|---|---|---|
-T0 | Paranoid | IDS evasion |
-T1 | Sneaky | IDS evasion |
-T2 | Polite | Less bandwidth |
-T3 | Normal | Default |
-T4 | Aggressive | Fast networks |
-T5 | Insane | Very fast networks |
"Too many open files":
# Reduce ulimit and batch size
rustscan -a $IP --ulimit 2000 --batch-size 1000
Slow scans:
# Increase batch size (if system allows)
rustscan -a $IP --batch-size 8000 --ulimit 10000
"Permission denied":
# ARP scanning requires raw socket access
sudo arp-scan-rs -l
No hosts found:
# Verify interface
arp-scan-rs -l -i en0 # Specify correct interface
"requires root":
# OS detection and some scans need root
sudo nmap -O -p 22 $IP
Slow service detection:
# Limit version intensity
nmap -sV --version-intensity 2 -p $PORTS $IP