SEK SystemsDocs Open console

How it works

External and internal probes

Whether a vulnerable service is reachable makes a large difference to its risk (see Exposure). Calculating reachability from firewall rules is useful, but a measurement is better. SEK Systems has three kinds of measurement, all limited to your own addresses and networks, all rate-limited, and all carried out as signed, read-only jobs.

Important

SEK Systems never probes addresses that are not yours, never tries to log in, and never runs an exploit.

External probe

What: a probe on the internet tries to connect to the listening services of your hosts on their public addresses, the way an attacker would see them.

Switch on: Settings → External probe → External probing (Probe my public listeners from the internet), owner or admin, with a step-up. It is off by default. Run now starts a run by hand (at most once every 15 minutes).

Which addresses: only:

  • public addresses on the network interfaces of your own agents, combined with the ports they listen on;
  • public WAN addresses that your agents use towards the internet, after you confirmed them;
  • own addresses you added (for example a NAT firewall without an agent), after verification: a DNS TXT record or a token file on the host (port 80) proves the address is yours.

Private and reserved address ranges are never probed; this is checked both by SEK Systems and by the probe agent itself.

What it does per target: a TCP handshake, without sending data. When needed to tie a port forward to the right host, it may read one identifying fact that the service offers to anyone: the SSH host key, the TLS certificate, or the HTTP Server header.

Limits:

Limit Value
Targets per run at most 64, on at most 32 addresses
Rate at most 5 connections per second
Attempts one per target per hour
Rounds one round every 6 to 168 hours (default 24)

The result is open (confirmed reachable from the internet, R3), or closed/filtered. See the observations and runs under Settings → External probe.

Peer probes between your own hosts

What: one of your hosts tests, with one TCP handshake, whether a listening service of another host in your environment is reachable from there. This turns "probably internal" into measured internal reachability, which attack paths use for lateral movement.

Details:

  • TCP: one handshake. UDP: only a DNS query for the root name servers on port 53, or an SNMPv3 engine discovery on port 161; nothing else.
  • At most 5 connections per second, one attempt per target per hour.
  • Never across networks that only look the same (overlapping private ranges behind a different gateway).
  • On by default (Settings → External probe → Let my hosts test each other). A host can refuse with [probe] internal = false in its local policy.
  • Requires agent version 0.3.64 or later.

Network discovery

What: find devices without an agent on your networks, such as printers, NAS devices, cameras and switches.

  • Passive, on every agent: the neighbour table (ARP/NDP), DHCP leases if the host is the DHCP server, and a short listening window for mDNS, SSDP and LLMNR. Nothing is sent.
  • Active, only when SEK Systems sends a signed request, and only if the local policy allows it ([discovery] active): TCP connects to a fixed list of 40 common ports (management, web, printers, NAS, databases), on the directly connected private subnet of the host, /22 or smaller. Before a run, the agent itself checks that the subnet is still the same network (same gateway), that it is not a VPN, tunnel, container bridge or a Windows "Public" network, and that the last run on that subnet is at least an hour ago. A laptop that is taken home does not scan the home network. At most 100 connections per second (default 50). SNMP only with the read-only community public and only if your environment enabled it.

Network devices with a read-only account are read by a connector host instead; see Requirements.

The probe role

A host with the probe role tests reachability between network segments you choose. The host must allow it first:

sudo sec-agent role allow probe --cidr 192.168.10.0/24

The probe only tests the segments in [probe] allow_cidrs, at most 10 connections per second and 64 targets per run. See role.

How you recognise SEK Systems traffic

  • Probes are TCP handshakes without data; for HTTP fingerprints a HEAD request.
  • Address verification (for Own addresses) fetches the token file with the User-Agent SEK-probe-verify/1 (+https://sek.systems).
  • The hourly check of the public address goes to ip4.sek.systems / ip6.sek.systems with User-Agent SEC-agent-egress/1.