operations-net-discovery

Network environment discovery: local interfaces/gateway/listening ports + authorized CIDR sweep (TCP-responsive probing). Assessment, not exploitation. Composes infrastructure-security-scan.

What it is for

operations-net-discovery — network environment discovery.

Lets an application discover and understand its network environment:

• local_report — self-discovery (no authorization): this host's

interfaces, the subnets it sits on, its default gateway, and the TCP ports it exposes. Introspecting the machine you already run on is not the dual-use case the sweep guards against.

• sweep — authorized discovery: bounded TCP-connect probing over a

CIDR the operator has explicitly authorized (see authorize_range).

• to_scan_findings — bridge open-port observations into

infrastructure-security-scan for assessment.

Posture: assessment, not exploitation. No payloads, no exploits, no writes — the same posture as infrastructure-security-scan, which this crate composes.

Platforms. Supported on Linux, Windows, and FreeBSD only; OS access is isolated behind the Prober seam (SystemProber in production, testkit::FixtureProber for zero-I/O tests). Building on any other target is a hard error.

Capabilities

Ipv4Cidr

Hand-rolled IPv4 CIDR (u32 math) — no external dependency (Gate 1 decision).

Ipv4CidrHosts

Hand-rolled IPv4 CIDR (u32 math) — no external dependency (Gate 1 decision).

DiscoverError

Error types. DiscoverError is the crate-level result; ProbeError is the

ProbeError

Error types. DiscoverError is the crate-level result; ProbeError is the

ListeningTool

The I/O seam. All OS access — interface/gateway enumeration, listening-port

ProbeOutcome

The I/O seam. All OS access — interface/gateway enumeration, listening-port

Prober

The I/O seam. All OS access — interface/gateway enumeration, listening-port

RawInterface

The I/O seam. All OS access — interface/gateway enumeration, listening-port

RawListening

The I/O seam. All OS access — interface/gateway enumeration, listening-port

SystemProber

The I/O seam. All OS access — interface/gateway enumeration, listening-port

FixtureProber

Public test harness: a FixtureProber returning canned OS data so the

How to use it

From `examples/net_report.rs`:

use data_export::{CsvExporter, ExportColumn, ExportConfig, ExportFormat, JsonExporter};
use operations_net_discovery::{
    authorize_range, local_report, sweep, DiscoverError, LocalNetworkReport, ScanTarget,
    SweepOptions, SystemProber,
};
use serde::Serialize;

#[derive(Serialize)]
struct IfaceRow {
    interface: String,
    up: bool,
    loopback: bool,
    address: String,
    prefix: u8,
    network: String,
}

From `examples/self_report.rs`:

use operations_net_discovery::{local_report, SystemProber};

fn main() -> Result<(), Box<dyn std::error::Error>> {
    let report = local_report(&SystemProber)?;

    println!("default gateway: {:?}", report.default_gateway);

    println!("\ninterfaces:");
    for iface in &report.interfaces {
        let flags = match (iface.is_up, iface.is_loopback) {
            (true, true) => "up,loopback",
            (true, false) => "up",
            (false, _) => "down",
        };
        println!("  {} [{}]", iface.name, flags);
        for a in &iface.ipv4 {
            println!(

Module structure

operations_net_discovery

• cidr
• error
• prober
• testkit

flowchart TD
  n_operations_net_discovery["operations_net_discovery"]
  n_operations_net_discovery --> n_cidr["cidr"]
  n_operations_net_discovery --> n_error["error"]
  n_operations_net_discovery --> n_prober["prober"]
  n_operations_net_discovery --> n_testkit["testkit"]

Public surface

`cidr`

`error`

`prober`

`testkit`

Re-exports. Exported here, defined elsewhere.

Boundary

Reaches into infrastructure.

Shares tier operations with 40 other crates: operations-approval-workflow, operations-assessments, operations-block-imaging, operations-boot-media, operations-browser-agent-worker, operations-camera-discovery, operations-camera-liveview, operations-camera-registry, … (40 total).

_What this crate deliberately does NOT own is a judgment. No committed registry records one for it, so none is stated here._

Where it sits

Tier flow. Which tiers this crate's own edges cross.

flowchart LR
  n_operations["operations"] --> n_infrastructure["infrastructure"]

Dependencies

Runtime, in this workspace.

Runtime, from outside the workspace.

Development, in this workspace.

Development, from outside the workspace.

Build. None.

Depended on by. Nothing in this workspace.

Signal flow — what reaches this crate, and what it reaches.

flowchart LR
  SELF["operations-net-discovery"]
  SELF -->|development| n_data_export["data-export"]
  SELF -->|runtime| n_infrastructure_security_scan["infrastructure-security-scan"]
  classDef self fill:#1f883d,stroke:#1f883d,color:#fff;
  class SELF self;

Feature flags

No Cargo features are defined: every capability is unconditional, so no consumer can receive a half-wired crate.

Targets

Error model

Operational characteristics

No unsafe block, unsafe fn, unsafe impl or unsafe trait was found by the parser anywhere in this crate's source.

Configuration

No environment variable is read with a literal name anywhere in this crate. A variable whose key is computed at run time cannot be listed here, and is not claimed to be absent.

Related capabilities

No workspace crate depends on this one.

Verification

Evidence by module. How often each public module is named by something executable.

What the tests establish, by name:

• contains_respects_prefix — src/cidr.rs
• parses_and_canonicalizes — src/cidr.rs
• rejects_bad_input — src/cidr.rs
• slash_24_excludes_network_and_broadcast — src/cidr.rs
• slash_31_yields_both_rfc3021 — src/cidr.rs
• slash_32_is_single_host — src/cidr.rs
• slash_zero_does_not_overflow — src/cidr.rs
• slash_zero_hosts_iterator_does_not_overflow — src/cidr.rs
• emits_one_finding_per_open_port — src/findings.rs
• no_open_ports_yields_no_findings — src/findings.rs
• empty_output_is_empty_not_error — src/listening.rs
• parses_netstat_windows — src/listening.rs
• parses_sockstat — src/listening.rs
• parses_ss — src/listening.rs
• skips_garbage_lines — src/listening.rs
• ss_zone_id_on_ipv4_is_parsed_not_dropped — src/listening.rs
• gateway_error_folds_to_none — src/local.rs
• happy_path_assembles_all_domains — src/local.rs
• interface_error_is_fail_loud — src/local.rs
• listening_error_folds_to_empty — src/local.rs
• maps_well_known — src/service.rs
• unknown_is_none — src/service.rs
• authorized_target_yields_range — src/sweep.rs
• invalid_cidr_is_rejected — src/sweep.rs
• large_range_errors_without_materializing — src/sweep.rs
• refused_only_host_is_responsive_but_has_no_open_ports — src/sweep.rs
• scope_too_large_is_rejected — src/sweep.rs
• sweep_reports_only_responsive_hosts_with_open_ports — src/sweep.rs
• unauthorized_target_is_refused — src/sweep.rs

Documentation coverage

pie showData
    title Public items with rustdoc
    "Documented" : 19
    "No rustdoc detected" : 9

Metrics

pie showData
    title Public API by kind
    "enum" : 4
    "method" : 17
    "struct" : 6
    "trait" : 1

pie showData
    title Rust source composition
    "Code" : 1052
    "Blank or comment" : 385

Generation

Rendered by tools-corpus corpus readme from repository evidence alone, renderer schema 2, lexicon current. No model, network service or database was consulted. Regenerate with tools-corpus corpus readme --write; verify with --check.