Network map and scan

Network Map shows the network the way your servers see it. Everything here runs on a server you already monitor over SSH, so it also works from Legit AI’s cloud and installs nothing.

What a server reports

Network Map → Through servers lists, for each monitored server, its router with address and vendor, its neighbours and its open connections. Each connection is checked against threat intelligence. These are the server’s own tables, not a scan of the network.

Scan a network

1. Open the server and choose Scan this network.

2. Check Ranges. Only private ranges are accepted, up to 4,096 addresses; separate several with a comma.

3. Confirm that the network is yours or that you are authorised to scan it, and type your authenticator code. The scan is recorded in the audit log under your name.

The scan needs an ADMIN. It runs on the server with Python, without root, and reads only: it logs in to nothing and changes nothing. It uses TCP and ARP, service banners, NetBIOS, DNS, NTP, mDNS and UPnP, and SNMP when you add the router’s read-only access with Add SNMP access.

Policy sets how often it repeats, the rate limit, and whether to use nmap if the server already has it. Stop ends a scan under way.

Every fact is marked confirmed or estimated, with what it rests on.

No passwords are guessed

Legit AI never tries default or guessed credentials, on SNMP or anywhere else. It uses only what the owner gives it.

Read a router from inside

A scan sees a router from outside. With a login, Read the router from inside lists the router’s connected devices, firmware, interfaces and routes. It only reads.

Add router access needs an ADMIN, a fresh code and your confirmation that you may read the router. Under How to reach it choose:

Connection	For
MikroTik	RouterOS 6 and 7
SSH	Cisco, Huawei, Juniper, VyOS, Fortinet, OpenWrt, Linux
Ubiquiti UniFi	UniFi controllers
OpenWrt API	OpenWrt
OPNsense API	OPNsense

Tested on real devices: RouterOS 7.16.2, OpenWrt 24.10.4, OPNsense 25.7 and UniFi 9.0.114. The others follow each maker’s documentation.

The password is sealed in the vault and never reaches the monitored server: that server only relays the encrypted connection. The router’s key or certificate is locked at the first connection, before the password is sent, and a refused login is not tried again.

On your own server

Discovery and Live Capture read the network of the platform’s own server, so they work only on a platform in your network. In the cloud they are refused: the cloud shows you your servers, never its own network.