05 Networking · Nmap · Inventory comparison

Network inventory drift

In an isolated Docker network, an Nmap comparison identifies one missing device, one new device, one address change, and one uncertain observation.

Issue: Which differences between the expected inventory and the observed target list need action, and which observation is too uncertain to treat as fact?
Decisive evidence: The inserted state reported a changed address, a missing device, a new device, and an uncertain observation.E02
Result: The report separates confirmed changes from one uncertain observation, then returns zero findings after correction.
Boundary: This is an isolated container network with explicit owned targets.Full limit

Completion: Complete within stated scope
Execution: Isolated Docker and Nmap run
Review: Manifest and technical review
Evidence: Selected evidence on this page

Docker internal network
Nmap
Python
Graphviz

Project scope

What was built and checked.

Project record: The comparison tool, expected inventory, scan scope, isolated container states, reviewed output, and public package.

Interactive view

Compare the declared and observed states.

Only the four inserted differences change between the baseline and failure views.

Choose a viewBaselineInserted differencesRetest

All declared targets are present and no additional target is observed.

01
Edge routerExpected
02
WorkstationAddress check
03
Backup NASPresence check
04
PrinterObservation confidence
05
New deviceUnexpected target

Comparison sequence

Declare the expected inventory, insert the differences, then compare the corrected state.

01
Declare the expected devices, addresses, and the exact owned scan targets before execution.
02
Record a zero-finding baseline, then introduce one missing device, one new device, one address change, and one uncertain observation.
03
Run the same comparison after correction and after rebuilding the original state.
04
Export only documentation addresses, sanitized topology files, result JSON, and checksums.

Evidence from the lab

The checks used to reach the conclusion.

Selected outputs from the lab. Sensitive and unnecessary details are omitted.

Baseline network inventory with four expected devices — E01 · Derived from lab evidenceExpected stateThe baseline topology shows the four declared devices before a difference is introduced.
View artifact Back to C01

Network inventory comparison showing four inserted difference types — E02 · Derived from captured lab outputObserved differencesThe failure topology visualizes the changed, missing, new, and uncertain observations reported by the comparison.
View artifact Back to C01

Corrected network inventory returned to the expected four-device state — E03 · Derived from captured lab outputCorrection and retestThe correction topology returns to the declared inventory, and the result JSON reports zero findings.
View artifact Back to C02

Full evidence archive2 additional artifacts

baseline      : 0 findings
failure       : 4 findings
  changed_ip · missing_device · new_device · uncertain_observation
correction     : 0 findings
rollback       : 0 findings
clean repeat   : 0 findings

E04 · Captured lab outputState evaluationThe run evaluator records four finding types in the inserted state and zero in correction, rollback, and repeat.

View artifact Back to C01

Public package
• state JSON and topology files
• sanitized Nmap XML
• environment and dependency records
• test output and SHA-256 checksums

E05 · Captured lab outputPublic evidence packageThe checksum list covers the published JSON, Nmap XML, topology files, environment record, and test result.

View artifact Back to C01

Result and limits

What changed, and what this lab does not prove.

Result

The inserted state produced four expected finding types. Correction, rollback, and the repeat each returned zero findings.

Limit

This is an isolated container network with explicit owned targets. It does not claim real-time monitoring, 802.1Q behavior, or an enterprise deployment.

Claims and evidence

What the evidence supports.

The inserted state reported a changed address, a missing device, a new device, and an uncertain observation.

The finding types apply only to the declared lab inventory.

EvidenceE02 E04

Correction, rollback, and the final repeat each returned zero findings.

The retests use the same isolated target list and expected inventory.

EvidenceE03 E04