Checks

Every check a satellite runs: what it does, on which targets, and every parameter with its default.

Parameters below show the built-in defaults. A plan stores its own values; a value missing from a plan falls back to the default (order of values). Before anything reaches nmap, traceroute or ping, the satellite validates targets and options again (pulsar/validate.py), so no value can become a command-line option.

Every check of an address also gets a reverse DNS lookup with forward confirmation: the PTR name counts only if it resolves back to the address.

Ping

ICMP echo: reachability, round-trip times (min / avg / max / mdev) and packet loss. Planned automatically: hourly on every host from every satellite.

Traceroute

The path to the host, hop by hop with PTR names and round-trip times. Polaris stores a path when it changes and adds the origin AS of every public hop. Hops in Docker bridge pools (172.17–172.31.0.0/16), Kubernetes default networks (10.42/16, 10.43/16, 10.96/12, 10.244/16) and PULSAR_TRACE_HIDE are hidden on the satellite: address, name and time never leave it. Planned automatically: hourly.

Port & service scan (nmap)

Scans host by host and splits the work, reporting each part as soon as it is done:

1. open ports: nmap -sS (SYN; -sT without raw sockets) on ports, or the top_ports most common ports,
2. a fingerprint of every open port: -sV and the scripts ssh-hostkey, ssl-cert, http-title,
3. OS detection (-O) on the open ports, if enabled,
4. UDP top 50 (-sU), if enabled.

Networks and ranges are expanded on the satellite; every host found becomes a host in Polaris. Single hosts are scanned with -Pn (no ping first), so firewalled hosts are scanned too; in networks nmap first looks for live hosts. SSH host keys found here merge hosts; TLS certificate fingerprints are stored but never merge.

HTTP

Plain HTTP on the discovered and/or manual ports: status code, response time, redirects, Server header, page title. Redirects to HTTPS are reported but not followed.

HTTPS

HTTPS endpoints including the TLS handshake and certificate validity. Every known hostname of the host is used as SNI; on a bare IP without a known name only the chain is checked, not the name.

TLS certificates

Certificates of every TLS service and STARTTLS service (SMTP, FTP, IMAP, POP3), once per known hostname (SNI) plus the default certificate of the bare IP. Validity, chain trust, hostname match, revocation (OCSP, then CRL), protocol, cipher, key and signature algorithm. SAN names are resolved and correlated with hosts and domains.

SMTP server

Banner, EHLO and its extensions, STARTTLS and its certificate, and whether PTR, banner, EHLO and certificate agree. Optional open-relay test: MAIL FROM / RCPT TO to a foreign domain followed by RSET — never DATA.

FTP server

Banner, AUTH TLS and the certificate, optionally an anonymous login test (off by default).

Service details

Looks at what discovery found and reads what the protocol reports, never logging in: SSH algorithms, SMB version and signing, database versions, TLS on PostgreSQL, open DNS recursion. Test access without a password (Redis, Memcached, Elasticsearch, SNMP community public) only runs on satellites in a zone, never from external — Polaris forces it off for external satellites.

Segmentation

TCP connection attempts from a zone to the hosts of another zone, built by Polaris from the segmentation matrix. Reports which of the tested ports opened.

No parameters: Polaris builds these plans itself.

Domain DNS

Records of the domain and its watched names through the satellite’s resolver (or public / own resolvers), compared with the authoritative name servers found via the parent’s delegation and asked directly over UDP and TCP. Reports differences as manipulation per resolver, name server serials and authority, DNSSEC, SPF, DMARC, DKIM (known selectors plus common ones), CAA, wildcards and subdomains. CT names come from Polaris; the satellite resolves them.

With PULSAR_DNS set, every query goes to that server: authoritative servers are not asked, so delegation, SOA serials and manipulation are not checked on that satellite.

Domain mail servers

Every MX of the domain: addresses, PTR and forward confirmation, banner and EHLO, STARTTLS and certificate against the MX name, optional relay test, plus SPF, DMARC and DKIM as published.