Nmap
The classic network scanner. I use it to attack my own honeypot and prove the alerting works end to end.
#What it is
Nmap discovers hosts on a network and the services they run. It sends carefully built probes, reads the responses, and reports which ports are open and, with -sV, what software is answering on them.
#Why I use it here
A detection you've never seen fire is a detection you can't trust. After setting up OpenCanary and the Grafana alert, I scan the honeypot from another machine:
nmap -sV -p 21,23,2222,3306,8080 192.168.1.213Within a minute or two the honeypot logs the connections, Loki has them, and a Telegram alert arrives. That one command tests every link in the chain.
#Also useful for
- Checking what your Pi exposes:
nmap -p- 192.168.1.213from another device shows every open port. Anything you don't recognise deserves an answer. - Inventory:
nmap -sn 192.168.1.0/24lists what's alive on your network.
#The rule
Only scan networks and devices you own or have written permission to test. Scanning your own LAN is fine; scanning anything else can be illegal and will certainly annoy someone.