---
title: "Full Network Port & Service Assessment"
canonical: https://trickest.com/library/full-network-port-and-service-assessment
description: "Point one domain, ASN or CIDR at it and get a graded report of every open port and exposed service, distributed and token-free."
---

# Full Network Port & Service Assessment

## Overview

Knowing what your network exposes means starting from whatever you happen to
have, a domain, an ASN, or a raw CIDR, and ending with a straight answer: which
hosts have dangerous services open to the internet. This workflow takes one input
of any of those types, resolves it to the addresses worth scanning, and guards
the blast radius so a single cloud ASN cannot turn into a million-host sweep. It
then port-scans the range across the fleet, fingerprints the web services it
finds, checks the rest for known service issues, and grades each host A to F by
the worst thing it exposes. What comes back is a ranked exposure report rather
than a wall of open ports, which is what makes it usable for
[exposure management](/use-cases/exposure-management) rather than just another
scan. It is token-free and safe by default.

## Pipeline

1. Read the input: a domain, an ASN, or a CIDR, one per line.
2. Normalize it to addresses. An ASN becomes its announced prefixes, a hostname
   resolves to its A records over DNS-over-HTTPS, and the blast radius is
   guarded: any block larger than a `/16` is skipped and the target list is
   capped, so a cloud ASN cannot explode the scan.
3. [mapcidr](/tools/mapcidr) expands the CIDRs to individual hosts, and
   [rustscan](/tools/rustscan) sweeps their ports, sharded across the fleet.
4. The open ports are normalized to `ip:port`, then [httpx](/tools/httpx)
   fingerprints the web services and [nuclei](/tools/nuclei) runs its network
   service checks against the rest.
5. Each host is graded A to F by the most dangerous service it exposes, and the
   ranked result is written to a report.

## Inputs

- **Target.** One domain, ASN, or CIDR per line. Point it at scope you are
  authorised to scan.

## Outputs

- **Per-host exposure.** For each host: its open ports, the dangerous ones
  (database, remote-access or plaintext services), and a letter grade for how
  exposed it is.
- **Overall grade.** The worst host's grade taken as the assessment's headline,
  with the count of hosts exposing a dangerous service.
- **Report.** The graded hosts and their services in one file, sorted so the
  worst exposure is first.

## Sample output

Illustrative, in the record shape the workflow emits. Real runs name live IPs, so
the hosts here are TEST-NET documentation addresses.

Each host is graded by its most dangerous open port, worst first:

```jsonl
{"ip": "192.0.2.10", "ports": [22, 443, 3306], "risk": 4, "grade": "F", "dangerous": [3306], "web": true}
{"ip": "192.0.2.23", "ports": [23, 80], "risk": 4, "grade": "F", "dangerous": [23], "web": true}
{"ip": "192.0.2.41", "ports": [443, 6379], "risk": 3, "grade": "D", "dangerous": [6379], "web": true}
{"ip": "192.0.2.11", "ports": [443], "risk": 1, "grade": "A", "dangerous": [], "web": true}
{"ip": "192.0.2.12", "ports": [22, 443], "risk": 1, "grade": "A", "dangerous": [], "web": true}
```

The assessment summary is the headline grade in one line:

```json
{"hosts": 42, "open_ports": 118, "dangerous_hosts": 3, "overall_grade": "F"}
```

## FAQ

### What can I give it as a target?

One input of any of three kinds: a domain, an ASN (as `AS13335` or `13335`), or a
CIDR. It works out which it is and resolves each to the addresses to scan, so you
do not pre-expand anything yourself.

### How does it avoid scanning half the internet?

The normalize step guards the blast radius. It skips any block larger than a
`/16`, caps the total target list, and falls back to a reserved address if a
target resolves to nothing. Expanding a large cloud ASN therefore cannot turn
into an unbounded scan.

### What does the A to F grade mean?

Each host is graded by the most dangerous service it leaves open. A database,
remote-access or plaintext protocol exposed to the internet is the worst case and
drives the grade down; a host with only a hardened web port grades well. The
assessment's overall grade is the worst host in the set.

### Does it need credentials or an API key?

No. ASN lookups use a public prefix API, hostnames resolve over DNS-over-HTTPS,
and the scan itself needs no account. The whole run is token-free.

## Related workflows

- [ASN-Wide Vulnerability Scan](/library/asn-vulnerability-scanner). Reach for this
  when you want CVEs and misconfigurations across an ASN's web surface rather than
  a port-and-service exposure grade.
- [Find Exposed Databases](/library/exposed-database-scanner). Reach for this
  when you specifically want databases left open, checked and confirmed, rather
  than every port graded.

---
_Markdown source of https://trickest.com/library/full-network-port-and-service-assessment._