03 Networking · Nmap · Evidence normalization

Network inventory drift

A fail-closed inventory analyzer that distinguishes new, missing, moved, and uncertain devices while retaining field-level provenance.

Validated result

The controlled failure produced four exact drift types; correction, rebuilt rollback, and clean repeat returned to zero findings.

Python
Nmap XML
Docker
Graphviz

06Native states

04Drift types

15/15Automated tests

01 · The support question

What needed to be known?

Inventory comparisons become misleading when a scan is partial or a device identity is uncertain. This project refuses to call a device missing until the exact target coverage is proven complete.

02 · The build

A controlled path from fault to retest.

01
Normalized Nmap XML and interface evidence into stable device, address, interface, and link records.
02
Retained source type, source ID, locator, and confidence on every observation.
03
Created a controlled missing device, new device, changed IP, and uncertain observation.
04
Rebuilt the topology from source for rollback and repeated the clean scan.

CheckFailure evidencePost-change

Baseline0 findings0 findings

Controlled drift4 exact types0 findings

Rebuilt rollback4 exact types0 findings

Clean repeat0 findingsByte-identical

Selected evidence summary · full claims remain bounded below

03 · What proves it

Evidence tied to the claim.

Failure state

Exactly four findings appeared: changed_ip, missing_device, new_device, and uncertain_observation.

Absence discipline

A missing-device result is allowed only when the explicit target list, run statistics, and complete coverage agree.

Repeatability

Baseline, correction, rollback, and clean-repeat JSON outputs are byte-identical.