Warda looks at the network of its default gateway only (a /23 at most), and nothing leaves it:
- an empty UDP datagram to the discard port of each address, so that the kernel fills its neighbour table (ARP): no raw socket, no capability;
- multicast DNS and SSDP queries, and their announcements heard all the time (ports 5353 and 1900; a machine that runs avahi-daemon shares the port); the UPnP description of a machine is read only from that machine, once a day, and only if it is in the neighbour table; a multicast DNS answer gives the name and model of the machine that sends it only when it carries its own address and no other (a router relaying the announcements of a printer does not become a printer);
- reverse lookups at the box for the names;
- the title of the home page of each machine (128 at most per scan, port 80, following a redirection to HTTPS on the same machine without checking its certificate: nothing is sent, only the title is kept), which gives the model of routers, firewalls and NAS.
The box is recognised from the title of its home page, its reverse name and the maker of its network card. A router that is not a box of a provider is shown with its model (Synology, Fritz!Box…), and the other routers and firewalls of the network (OPNsense, pfSense…) are listed. Every 15 minutes Warda looks again which machines answer (ARP only, no name asked): a machine or a device seen once is never forgotten, and is shown as not available, with the last time it was seen, when it was not seen for 45 minutes (only the machines with a private, random hardware address given to no device are forgotten after 90 days: phones change it often). The machines are not in backups. Docker needs the host network for this, as for DNS.
A client whose hardware address Warda cannot find (a router that forwards every query, another network) is a device known only by its IP address. Such new devices are created 32 at once at most, then one every 2 minutes (the addresses of the box itself are not counted): past that, their queries are recorded without a device, and a warning is logged at most every 10 minutes.
Managed switches#
Warda listens, on every Ethernet interface of the box, to the
announcements of the equipment it is plugged into: LLDP (IEEE 802.1AB,
01:80:c2:00:00:0e, type 0x88cc) and CDP (Cisco, 01:00:0c:cc:cc:cc).
A managed switch (or a router, an access point) sends them on each of its
ports every 30 to 60 seconds; an unmanaged switch says nothing, and these
frames do not cross a switch. Network → Network analysis shows the
equipment heard: its name, model and version, its capabilities (switch,
router, Wi-Fi access point…), the port the box is plugged into, its VLAN
and its address of administration; with none after a few minutes, the box
is plugged into an unmanaged switch, straight into the router, or the
announcements are turned off. Warda sends nothing: two raw packet sockets
(AF_PACKET, CAP_NET_RAW, allowed by warda.service) receive the LLDP
frames and the 802.2 (LLC) frames, of which only CDP is read; their texts are cut to 200 characters and 32
equipments at most are kept, in memory, a day after their last
announcement (internal/lldp, Linux only). Docker needs the host network
and NET_RAW.