• Discovers every device on the networks you point it at
• Identifies operating systems and services
• Checks for vulnerabilities
• Can assess Active Directory

Before you start

You will need four things:

• One Linux virtual machine for every network you want to scan
• Root access to those machines (sudo)
• Outbound HTTPS access from them to the internet
• An Orizon RECON account with internal scanning enabled

If you have five networks, you need five VMs, each running its own Scout Probe, each with an interface in the network it scans. One probe cannot cover another network properly, and it is not designed to.

Why one per network

A probe identifies devices on its own network at a level it simply cannot reach across a router:

• It uses ARP to see every live device and read its hardware MAC address. ARP does not cross routers. On its own network the probe finds devices that answer nothing else — printers, cameras, embedded controllers, appliances.
• A device in another network can only be reached through a router, so the probe cannot verify its MAC address. Those devices are recorded as unverified.
• Where a probe is pointed at a network it cannot reach at all, RECON marks that network unreachable rather than reporting an empty result. A missing probe shows up as an honest gap, never as a clean bill of health.

You need one VM and one probe for each of them.

Examples

If you are not sure how many networks you have, ask whoever manages your firewall or switching for the list of VLANs and subnets in use. That list is your probe count.

They still work as one system

Deploying several probes does not mean managing several disconnected scans, and it should not mean paying several times. Create a probe group first and install every probe into it: the group draws on one shared licence pool, and a single group scan covers all its members at once, combining their assets, vulnerabilities and network topology into one result, while still letting you view any individual probe or site on its own. If you have more than one network, the group is the cheaper and simpler arrangement, and it is far easier to set up at the start than to reorganise later.

Virtual machine sizing

Measured in production

These are measured from probes running in production, not estimates:

Known-good distributions

Not supported, and why

Does this machine qualify?

If you are unsure whether a machine qualifies, run these two commands on it. If both succeed, the probe will install:

systemctl --version
uname -m

The first must print a version. The second must print either x86_64 or aarch64.

What must already be present

The installer needs curl, systemctl, ip, grep, awk, sed and useradd. All of these ship by default on every distribution listed above, including minimal server installs. The installer adds no packages and modifies no repositories.

Privileges

Installation and operation require root, via sudo. The installer stops immediately if the host is not Linux, is not running systemd, or is not run as root.

Where to place it

If your firewall supports FQDN or domain-based rules — most modern firewalls do, including Fortinet, Palo Alto, Check Point, Sophos, WatchGuard and pfSense — create the rule against the hostname:

recon.orizon.one

This is the correct approach and the only one that stays accurate over time.

If your firewall cannot do hostname rules, allow the following IPv4 ranges outbound on TCP 443. These are the published ranges of the content delivery network serving the platform:

If your network uses IPv6, also allow:

These ranges are maintained publicly and can be re-checked at any time at https://www.cloudflare.com/ips/. If your firewall supports automatic external address lists, point it at that source so the rule updates itself.

If you use an outbound proxy, the probe honours the standard HTTPS_PROXY and NO_PROXY environment variables. Set them in the service environment before starting the probe.

Verify the rule works from the probe host before installing:

curl -I https://recon.orizon.one

A response beginning HTTP/2 200 confirms the path is open. Anything else — a timeout, a refused connection, a certificate error — means the firewall rule is not yet correct, and the installer will fail for the same reason.

Inbound, none

Traffic on your internal network

To do its job, each probe generates ordinary scanning traffic on its own network:

• ARP and ICMP, to establish which addresses are live
• TCP connections to common service ports, for discovery and fingerprinting
• mDNS and NetBIOS queries, to resolve device names
• SMB, SSH and HTTP probes, to identify operating systems and applications

curl -I https://recon.orizon.one

curl -fsSL https://recon.orizon.one/scout/install.sh | sudo bash -s -- \
  --probe-id <probe-id> \
  --api-key <api-key> \
  --install-token <install-token> \
  --endpoint https://recon.orizon.one \
  --binary-version <version>

It installs to these locations

The probe additionally needs

• Network reachability to a domain controller
• LDAP on port 389, or LDAPS on port 636 where encryption is enforced
• A standard domain user account, read-only

Add the credentials in RECON on the probe's Active Directory page, test the connection, then enable Active Directory when you start a scan.

You only need this on a probe that can reach a domain controller, not on every probe.

Removing a probe

Run the installer with the uninstall flag, as root:

curl -fsSL https://recon.orizon.one/scout/install.sh | sudo bash -s -- --uninstall

This removes the binary, the configuration and the service.