Two-phase scan pipeline
The Flutter app first performs preflight to identify the active network, phone address, gateway, and candidate CIDR. Discovery finds responsive hosts; fingerprinting then gathers deeper evidence only for those hosts. Results stream to the UI as each device row becomes available.
| Fast and balanced profiles | 16 concurrent host tasks, 8 concurrent fingerprint tasks |
|---|---|
| Per-probe timeout | 1.2 seconds fast; 1.8 seconds balanced and accurate |
| Accurate profile | Adds HTTP content analysis |
| Cancellation | Shared cancel token stops new work and progress publication |
Multiple discovery sources
TCP liveness checks run alongside UDP and native reachability work so one silent protocol does not erase a real device. The scanner merges evidence by IP and keeps protocol-only responders inside the requested CIDR.
- Selected TCP ports cover web, SSH, RTSP, Windows, mobile, printer, and industrial services.
- SSDP/UPnP, media discovery, mobile-device discovery, printer discovery, and LS PLC browse run in parallel.
- Native reachability can retain a host even when every selected TCP port is closed.
- The phone's own IP is inserted explicitly so the local endpoint is visible.
Evidence before labels
Classification consumes a probe summary rather than one port number. It combines open ports, banners, HTTP signatures, host names, MAC OUI, gateway identity, SSDP and mDNS metadata, printer records, media records, and vendor-specific industrial responses.
Confirmed and candidate are different product states. A device type is confirmed only when the evidence contract is strong enough; otherwise the UI preserves uncertainty instead of presenting a guess as fact.
Each row carries localized evidence text alongside its kind and confidence. This makes a wrong classification diagnosable and allows future rules to be tested against the same input facts.
Resource and privacy boundaries
Concurrency is bounded at both discovery and fingerprint stages. The fast profile's initial TCP fan-out is capped rather than multiplying every host by every port at once. Printer and content probes have separate smaller limits.
- Scanning and classification happen on the phone.
- Sessions are saved locally; export happens only through an explicit user action.
- The app does not send the device inventory to a droidactor server.
- Results are observations from one time and network, not a permanent asset registry.
Verification and known limits
Tests cover CIDR enumeration, bounded pools, cancellation, protocol parsers, OUI lookup, device models, classification rules, export, session persistence, and UI progress.
- Client isolation, firewalls, sleep, and rate limiting can hide devices.
- An open port is evidence of a service, not proof of ownership or authorization.
- Vendor and device labels can become stale as firmware and network roles change.
- Scanning must be limited to networks the user owns or is authorized to inspect.