Targets and hosts
What you enter, how Polaris turns it into hosts, and what a host page shows.
Targets
| Type | Example | Checks |
|---|---|---|
| IPv4 / IPv6 | 192.0.2.10, 2001:db8::10 | all host checks |
| Hostname | www.example.com | all host checks; resolved by the satellite |
| Network | 192.0.2.0/28 | nmap and the follow-up checks; hosts found inside appear on their own |
| Range | 192.0.2.10-20 | as networks |
| Domain | example.com | dns and mail |
Entering a known target again adds the chosen satellites to it. Targets can sit in groups (a tree, drag and drop); plans can target a group with all its subgroups. A plan only takes the target types its check makes sense on, so groups may hold anything.
How hosts are correlated
A host is one machine with all its addresses. When a result names addresses, Polaris looks for an existing host, strongest signal first:
- an address already known to a host (IP or hostname),
- an SSH host key seen before (unique per machine),
- a PTR name that matches a hostname of a host — only when the name resolves back to the address (forward-confirmed),
- the DNS answer a satellite reported for a hostname target.
If two hosts turn out to be the same, they are merged. TLS certificate fingerprints are stored but never used for merging — a wildcard or shared certificate would glue unrelated machines together. Names that only resolve through a DNS wildcard are marked and not used either.
A host can be merged by hand, and the per-host switch Auto-merge with correlated addresses stops automatic merging for it.
Hostnames of a host
Every name is shown with its source: entered by hand, from DNS, a forward-confirmed PTR, or a certificate SAN that resolves to the host. Every known hostname is also sent as SNI to TLS checks, so the certificate per name is checked.
Service matrix
Rows are ports, columns are satellites. Each cell shows what that satellite sees on that port: open, closed, or not tested — for example the office satellite sees 22/tcp, the cloud satellite does not.
A port counts as closed only after two scans in a row miss it (one scan can lose a port). Each change is an event in the history: appeared, disappeared, fingerprint changed — per satellite and address.
Network paths and neighbors
Ping and traceroute run every hour on every host from every satellite (automatic, not editable). A traceroute is stored when the path changes. The host page shows each path as a chain of hops with the AS path (origin AS of each public hop) and the host’s neighbors: other hosts behind the same last router.
Hops in Docker and Kubernetes default networks, and in PULSAR_TRACE_HIDE, never leave the satellite.
Software versions
Every product and version seen per service (nmap -sV, SMTP/FTP banners, HTTP Server header) with first and last seen. Software lists the inventory across all hosts.
Check now
Check now on a host runs chosen checks immediately on websocket-connected satellites. Afterwards the checks can be turned into test plans with host and satellites preselected.