• Discovers every device on the networks you assign it
• Identifies operating systems and services
• Checks for vulnerabilities
• Can assess Active Directory

Before you start

You will need:

• One Linux VM per network
• Root access
• Outbound HTTPS
• A RECON account with internal scanning enabled

Why one per network

A probe uses ARP to see every device on its own network and read its MAC address. ARP does not cross routers, so a device in another network cannot be identified reliably, and a network with no probe is reported as unreachable rather than empty.

Counting the networks

Count your network segments — each VLAN or subnet with its own address range. That is your probe count.

Three branches with two VLANs each means six probes.

If you are unsure, ask whoever manages your firewall for the list of VLANs in use.

Probe groups

If you have more than one network, create a probe group first and install every probe into it.

Probes in a group share one licence pool covering the whole estate; probes deployed standalone are licensed individually.

A single group scan then covers all members, while still letting you view any probe or site on its own.

How it works

You give the machine one virtual network connection for each VLAN. The probe then treats every VLAN as a local network and scans it with ARP — seeing every device and reading its hardware (MAC) address, exactly like a probe that physically sits in that network. Without this, a network reached only across a router or firewall is scanned poorly: devices the firewall blocks are invisible, no hardware addresses are read, and the firewall can slow or block the scan.

What to do

sudo ip link add link eth0 name eth0.30 type vlan id 30
sudo ip addr add 192.168.30.9/24 dev eth0.30
sudo ip link set eth0.30 up

In RECON you can run one probe that now sees all these networks, or — cleaner and easier to read — install one probe per VLAN and put them in a single group. Each probe then owns one network, and a single group scan covers them all.

If your networks are not on the same switch, or you cannot set up a trunk, put a separate machine with a probe in each network instead (see “How many probes do I need”).

Sizing

Measured in production

Measured in production: the probe uses about 230 MB idle, peaks near 1.25 GB during a scan, occupies 26 MB of disk, and consumed 221 seconds of CPU across 45 days. RAM is the only figure needing headroom; the storage above is almost entirely your Linux installation.

What the installer needs

The installer requires curl, systemctl, ip, grep, awk, sed and useradd — all present by default on every distribution listed, including minimal installs. Installation and operation require root.

Known-good distributions

Not supported

Not supported: Alpine, Devuan, Void and Gentoo/OpenRC (no systemd); Windows and macOS (Linux only); Docker and Podman containers (no systemd, no host network); 32-bit systems including Raspberry Pi OS 32-bit.

Checking a machine qualifies

To check a machine qualifies, run:

systemctl --version
uname -m

The second must print x86_64 or aarch64.

Outbound, required

HTTPS on TCP 443 to recon.orizon.one. Nothing else.

Inbound, none

Firewall rule

Allow by hostname where your firewall supports FQDN rules — Fortinet, Palo Alto, Check Point, Sophos, WatchGuard and pfSense all do.

recon.orizon.one

If hostname rules are unavailable, allow these IPv4 ranges outbound on TCP 443:

And for IPv6:

These are published at https://www.cloudflare.com/ips/ and can be re-checked at any time; point an automatic address list at it if your firewall supports it.

The probe honours HTTPS_PROXY and NO_PROXY.

Verify the rule from the probe host before installing:

curl -I https://recon.orizon.one

Anything other than HTTP/2 200 means the installer will fail too.

Internal traffic

Each probe generates ARP and ICMP sweeps, TCP connections to common service ports, mDNS and NetBIOS queries, and SMB, SSH and HTTP probes on its own network.

sudo scout dashboard

It installs to these locations

• Network reachability to a domain controller
• LDAP on port 389, or LDAPS on port 636
• A Domain Administrator credential, entered once

You paste an administrator account and password once in RECON and press Connect. The probe then creates a dedicated least-privilege read-only collector account, delegates it only the reads the assessment needs, and discards the administrator password — it is never written to disk, stored in a database column, or logged. All collection afterwards runs as that read-only account and performs no writes.

If you prefer not to supply an administrator, you may instead provide an existing read-only account. This is supported but secondary: you must grant it the required reads yourself, and some checks stay locked until you do, such as LAPS (ms-Mcs-AdmPwd) and gMSA password reads.

Removing a probe

Run the installer with the uninstall flag, as root:

curl -fsSL https://recon.orizon.one/scout/install.sh | sudo bash -s -- --uninstall