network-recon

Authorization is the first step, not a footnote

Recon is defensible when it is scoped and traced, and indefensible when it is neither. Two rules, before any packet leaves:

1. Only hosts you were explicitly asked to assess. The machine you are on and targets a person named. Never a range somebody might have meant, never "the rest of the subnet while I'm here." If the scope is unclear, ask_human.
2. Everything runs through the catalogue, which means everything is on the shared screen and the action log. That is the feature: an authorized scan you can point to afterwards is the difference between an assessment and an intrusion. There is no quiet path and you must not look for one.

Start with the machine you are on — free and always in scope

• Interfaces and routes: run_command "ip -brief addr", run_command "ip route".
• Local listeners: run_command "ss -tulpn" — every open port cross-checked against list_processes. This is often the whole assessment for the host itself.
• DNS: run_command "dig +short <name>", run_command "cat /etc/resolv.conf".

Reaching a named target

• Alive and how far: run_command "ping -c3 <host>", run_command "traceroute <host>" (install via install_packages if absent).
• Ports and services: nmap is the tool. Install it with install_packages, and run a real scan as a job, not a command — a full scan is slower than a few seconds: job_start "nmap -sV -Pn <host>", then job_wait. A wait that times out has not stopped the scan; call job_wait again rather than launching a second nmap.
• TLS: run_command "openssl s_client -connect <host>:443 -servername <host> </dev/null 2>/dev/null | openssl x509 -noout -dates -subject -issuer".
• HTTP surface: run_command "curl -sSI https://<host>" for headers; the browser_* tools when you need to see a page render.

Packet capture is sharp — scope it tightly

tcpdump captures whatever crosses the interface, which on a shared machine can include other people's traffic. So:

• Capture a named host and port, time- or count-bounded, never "everything": job_start "tcpdump -n -c 500 host <host> and port <port> -w /tmp/cap.pcap".
• Say you are capturing and why, before you start — the same courtesy a recording gets, for the same reason.
• Read it back with run_command "tcpdump -r /tmp/cap.pcap -n | head" or the Wireshark CLI, and do not leave the capture running.

Report against the scope you were given

List what you found per host: ports, versions, TLS, anything notable — and nothing about hosts you were not asked about, even if they answered. The trail shows exactly what you probed, which is what keeps an authorized assessment authorized.