ConnectMyAssets is a network discovery tool built for production networks. Our network scanner sends two tiny probes per address, opens no connection and keeps no state per address: it finds every host on large and sensitive networks, OT included, without weighing on them. Every host found is then audited (open ports, identified services, TLS certificates) and the devices reachable over SSH are collected into your inventory.
Request a demoTaking over a network you did not build? Sweep the whole address plan and get, in one pass, the hosts that answer, their open ports and the services behind them. Devices reachable over SSH become assets of your CMDB; the others are listed as unmanaged devices, never lost.
Sweep /16 blocks and hundreds of sites without saturating WAN links. A single rate ceiling, set for the whole platform, caps what every scan sends together, and silent addresses cost a few dozen bytes instead of a connection timeout each.
Scan OT networks with the care they require. For each subnet you decide what ConnectMyAssets may do: nothing, discovery only, discovery and ports, or full collection. On the ports of PLCs and industrial protocols (Modbus, S7, DNP3, EtherNet/IP, IEC 60870-5-104, BACnet), service identification never writes a byte: it only listens.
Declare the ports that must stay closed (Telnet, RDP, SMB, VNC...) and get an alert as soon as a scan finds one open. Every scan is dated and repeatable, which gives auditors an inventory they can trust.
Finding the hosts is only the start. Each scan audits what it finds and keeps your inventory, your topology and your alerts in step with the real network.
Our network probes are built by us, packet by packet, to discover very large estates without overloading customer networks. They are considerably lighter than the probes most discovery tools rely on (full TCP connections, SNMP requests, the standard 84-byte ping), and that lightness is what makes discovery so fast: in a customer production network, a full 10.0.0.0/8, more than 16 million addresses, is discovered in around fifteen minutes.
One TCP SYN to port 22 and one ICMP echo per address, written directly on the wire. No connection is opened and no table grows with the size of the network, so a /16 costs ConnectMyAssets no more memory than a /24. Hosts that answer only to ping are found too.
Choose the TCP ports to audit on every host found. Port 22 and ICMP are always audited; about thirty well-known ports (HTTPS, LDAPS, RDP, SMB, databases, WinRM...) are preloaded and switch on in one click. The page shows what each port added costs on the wire.
Every open port is identified: the service, the product and its version when the service names them (OpenSSH 10.0, nginx 1.27...), the TLS certificate and version, the HTTP status, server and page title. A service that is not recognised is reported as not identified, never as a guess.
Tick "alert if open" on a port that must stay closed. The next scan that finds it open raises an alert in Soron, sent in-app, by e-mail, syslog or webhook to the team in charge.
Protect what must not be touched. Each IPv4 range gets a level: Blocked (nothing is sent), Discovery only, Discovery and ports (all audited ports or a subset, with or without identification) or full collection. Where rules overlap, the most restrictive one wins, port by port.
Schedule scans per asset group with a cron expression, down to every 5 minutes, and start an instant scan from any asset page when you need an answer now. A port probe of a single host lets you audit any port range on one device.
Devices reachable over SSH are collected without an agent and identified by their serial number. Inventory and topology are rebuilt from every scan: the real map of connected devices, always up to date, not a diagram drawn a year ago.
For network and security engineers: what goes on the wire, how replies are trusted, and how ConnectMyAssets protects itself.
A 44-byte TCP SYN to port 22 (IPv4 header without options, DF set, one MSS option) and a 36-byte ICMP echo request, written on raw sockets. The handshake is never completed during discovery. A silent address is probed once more; nothing else is sent to it.
Each probe carries a SipHash-1-3 cookie under a 128-bit key drawn for the scan, in the TCP sequence number or in the ICMP identifier, sequence and data. A reply is accepted only for the address and port it answers, in the scan it belongs to: forged and replayed replies are rejected.
You set the ceiling your network tolerates, in addresses or packets per second. Every scan draws on it, so several scans together never exceed it, and two scans never cover the same addresses at the same time.
The two raw sockets are opened at start-up, before anything is read from disk or from the network. The process then drops every privilege (unprivileged user 65532, no capability left, no core dump) and checks the result against the kernel; if a single check fails, it refuses to start.
ConnectMyAssets pre-identifies the sensitive ports: raw printing (9100 to 9107, 515), industrial protocols (502, 102, 20000, 44818, 2404, 47808) and BGP (179). They are not audited by default. If you want them scanned, you enable them explicitly, and identification then only listens for a greeting: no byte is printed, no malformed frame reaches a controller.
On an open port, the service may speak first (SSH, FTP, SMTP...); otherwise a dedicated probe runs for the known port, then a TLS ClientHello, then a plain HTTP request. Everything a device sends back is cleaned and bounded before it is stored.
Declare scan rules for the ranges that must not be touched or only observed.
Enable the TCP ports to audit and mark those that must stay closed.
Start a scan now or schedule it per asset group, under your rate ceiling.
Review new assets, unmanaged devices, open ports and the alerts raised by Soron.
Prepare your project and define your scope.
Very fast, because every probe is ultra-light: a 44-byte TCP SYN and a 36-byte ICMP echo per address, with no connection to open. In a customer production network, a full 10.0.0.0/8, more than 16 million addresses, is discovered in around fifteen minutes. The pace follows the rate ceiling you set in ConnectMyAssets, so you stay in control of the load on your network.
A network discovery tool finds the devices connected to your network and tells you what they are. ConnectMyAssets sweeps your IPv4 ranges, audits the open ports of every host found, identifies the services behind them and collects the devices reachable over SSH into a CMDB, so your inventory reflects the network as it really is.
The discovery sends two small packets per address (44 and 36 bytes) and opens no connection. Every scan runs under the rate ceiling you set in ConnectMyAssets, and two scans never sweep the same addresses at once. Port audits and identification add one short exchange per open port, only on the ports you enabled.
Yes. Scan rules let you choose, subnet by subnet, between Blocked, Discovery only, Discovery and ports, and full collection, so you decide whether ConnectMyAssets only finds devices or also connects to and audits them. On industrial protocol ports (Modbus, S7, DNP3, EtherNet/IP, IEC 104, BACnet), identification only listens and never writes.
Probably, and that is expected: auditing several ports on a host is what an intrusion detection system reports as a port scan. Declare the address of your ConnectMyAssets instance in your IDS and firewall policies as an authorised scanner, as you would for any audit tool.
No. Discovery and port audits need nothing on the devices. The devices you want in the inventory are then collected over SSH with credentials stored in the Vault: no agent, no SNMP.
ICMP and TCP port 22 are always audited. You add any TCP port from 1 to 65535 to the global list; each enabled port found open is identified. UDP ports are not probed.
Recurring scans follow a cron expression, with a minimum interval of 5 minutes. You can also start an instant scan at any time, from the scans page or from the page of an asset.
Discovery and scan rules cover IPv4 networks today.
See what ConnectMyAssets can change for your team. On your infrastructure, with your requirements.
Request a demo