在局域网中部署的专用传感器节点「RoamSwitch Sensor」
RoamSwitch Sensor 是部署在局域网内的专用节点，从外部审计同一局域网上的 RoamSwitch 终端（Mac / Linux Client / Server Edition）。会确认「从同一局域网的其他设备看过来是什么样子」（开放端口、无需认证即可访问的服务、横向移动的立足点），这是主机自我诊断在原理上无法看到的。同时还提供局域网设备台账与 ARP 欺骗检测。
🛡️ 主动漏洞审计（仅针对已配对端点）
由全端口扫描 → 已知特征检测（Redis/dockerd/Memcached/MongoDB/Elasticsearch/CouchDB/Jenkins/VNC 未授权暴露、SMBv1 与未强制 SMB 签名、RDP 未强制 NLA、SMTP 开放中继等）→ 通用 Banner 获取 → nmap NSE 补充扫描共 4 个阶段构成，全程不含任何破坏性操作。
📋 掌握网络构成（主动 ARP 扫描）
通过 ARP 扫描找出局域网内的设备。将 IP、MAC、主机名、厂商、在线状态、首次/最近发现时间和 IP 历史整理成设备清单，并可为每台设备自由填写名称、用途等备注。没有备注的设备会被标为“需确认”，可用于与资产清单核对。未安装 nmap 时，会退回到只显示 Sensor 自己通信过的设备的被动模式。
👁️ ARP 事件与“下一步操作”
新设备出现，以及已知 IP 对应的 MAC 变化（ARP 欺骗的迹象），会连同发生时间、严重程度（严重～信息）、判断依据、相关设备的身份和具体的核实步骤一并给出。网关 IP 的 MAC 变化被视为“严重”。启用可选的被动抓包后，还能检测单台设备对大量 IP 发送 ARP 请求（内网侦察）。
🔎 掌握局域网内其他设备与可疑行为（仅检测）
以参考信息的形式给出：MAC 厂商与设备类别、依据 mDNS/SSDP/DHCP 自我通告的型号识别、连接已知恶意 IP 或管理端口、僵尸网络/DDoS 参与迹象（连接大量目的地）、DNS 隧道/C2 迹象。多数功能需要启用可选的被动抓包配置（如镜像端口），且 Sensor 不会阻断任何流量。
🔑 配对码方式（Ed25519・固定 IP）
初始状态下不信任任何设备。在端点侧输入 Sensor 运营者发放的、10 分钟内有效的一次性配对码，并配合 Sensor 的固定 IP 地址，即可在一次操作中同时建立双向信任。公钥会自动交换，无需提前获知。无需云端注册或创建账号。
📅 定期审计与差异对比（可选启用）
按计划自动审计所有已配对的端点，并显示与上一次审计相比的变化——新增发现、已解决项和新开放的端口。若之前开放的端口全部看不到了，将按“疑似不可达”处理，而不是“已解决”。即使无人值守，Sensor 也会在每次审计前后确认端点仍是其认证时的 MAC 地址；若该 IP 已属于其他设备，则不进行审计。默认关闭，可设置执行间隔和允许执行的时间段。
📣 通知与审计证据（可选启用）
可将回归、新设备、ARP 欺骗等通知到 Webhook（Slack、Discord、Teams 等）和 syslog（RFC 5424）。配对、解除配对、审计和配置变更会连同执行者记录到具备防篡改能力的操作日志（哈希链）中，审计结果、设备清单和操作日志可导出为 CSV、JSON 或 HTML 报告（可在浏览器中另存为 PDF）。所有通知目的地均由运维人员自行设置，默认不发送任何内容。
🗂️ 汇总多个 Sensor（中央收集器，可选启用）
面向在多个站点部署 Sensor 的组织，随附一个收集带签名摘要的中央收集器（默认不启用）。提供按站点查看状态的仪表板和 CSV 导出，并能检测 Sensor 端审计日志被截断或回滚。仅接受已登记 Sensor 发来的带签名请求，未启用 TLS 时不允许对局域网之外开放。
如需对 Sensor 自身进行攻击防护，建议在同一台机器上另行安装 RoamSwitch for Linux 的 Server Edition，两者可作为完全独立的进程共存。
审计报告输出示例
这是通过 roamswitch-sensor export all --format html（TUI 中为 e 键）导出的报告示例。它是单个 HTML 文件，用浏览器打开后选择“另存为 PDF”即可得到可提交给审计人员的 PDF。
RoamSwitch Sensor 审计报告
| 创建时间 (UTC) | 2026-09-20T02:30:12.508136294+00:00 |
|---|---|
| 站点 | 总部 3 楼服务器机房 |
| Sensor 公钥 | +kbYCoN5jJSykTAr8zDv/VCs2SdBcrwYbkCrzCRgsLM= |
| 审计日志 | 完整性验证：正常（未被篡改），18 条，head #18 771a265c58fa2f0a8990bc6be79ff5259d96a76a0a3fea472f308df02eaa087f |
各设备最新审计结果
| 设备 | 地址 | 执行时间 | 发现 | 开放端口 |
|---|---|---|---|---|
| web-prod-01 | 192.168.20.21 | 2026-09-20T02:00:43.318204577+00:00 | 1 项 | 2 |
| db-prod-01 | 192.168.20.22 | 2026-09-20T02:01:14.774390215+00:00 | 2 项 | 3 |
| dev-laptop-07 | 192.168.20.35 | 2026-09-20T02:02:07.120765432+00:00 | 无问题 | 1 |
发现事项
| 时间 | 设备 | 端口 | 描述 | 建议措施 |
|---|---|---|---|---|
| 2026-09-20T02:01:14.774390215+00:00 | db-prod-01 | 22 | SSH 版本横幅暴露 该 SSH 服务器在连接时会暴露版本横幅。横幅本身属于正常行为，但会成为攻击者缩小已知漏洞范围的线索。 | 请将 SSH 更新到最新版本，并根据需要精简横幅内容。 |
| 2026-09-20T02:01:14.774390215+00:00 | db-prod-01 | 6379 | 已知漏洞：CVE-2021-32626 (Redis) NVD 说明（英文原文）：Redis is an open source, in-memory database that persists on disk. In affected versions specially crafted Lua scripts executing in Redis can cause the heap-based Lua stack to be overflowed, due to incomplete checks for this condition. This can result with heap corruption and potentially remote code execution. This problem exists in all versions of Redis with Lua scripting support, starting from 2.6. The problem is fixed in versions 6.2.6, 6.0.16 and 5.0.14. | 请尽快将 Redis 升级到不受 CVE-2021-32626 影响的版本，在此之前请限制未经认证的网络访问。 |
| 2026-09-20T02:00:43.318204577+00:00 | web-prod-01 | 22 | SSH 版本横幅暴露 该 SSH 服务器在连接时会暴露版本横幅。横幅本身属于正常行为，但会成为攻击者缩小已知漏洞范围的线索。 | 请将 SSH 更新到最新版本，并根据需要精简横幅内容。 |
| 2026-09-19T08:33:18.402118906+00:00 | db-prod-01 | 22 | SSH 版本横幅暴露 该 SSH 服务器在连接时会暴露版本横幅。横幅本身属于正常行为，但会成为攻击者缩小已知漏洞范围的线索。 | 请将 SSH 更新到最新版本，并根据需要精简横幅内容。 |
设备台账（在局域网中观测到的所有设备）
| MAC | IP | 主机名 | 厂商 | RoamSwitch 管理 | 备注 |
|---|---|---|---|---|---|
| 00:1b:8b:3c:9a:07 | 192.168.20.1 | _gateway | NEC Platforms | 未管理 | 总部网关路由器 |
| 7c:8b:ca:61:d2:4e | 192.168.20.2 | TP-Link Technologies | 未管理 | 3 楼 Wi-Fi 接入点 | |
| e4:e7:49:2b:70:c1 | 192.168.20.3 | Hewlett Packard | 未管理 | 2 楼多功能一体机 | |
| 90:61:ae:17:4d:e2 | 192.168.20.21 | Intel Corporate | 已管理 | 生产 Web 服务器 | |
| 90:61:ae:17:4d:f9 | 192.168.20.22 | Intel Corporate | 已管理 | 生产数据库服务器 | |
| 04:20:9a:cc:31:8f | 192.168.20.31 | sensor-hq-01 | Panasonic AVC Networks Company | 未管理 | RoamSwitch-Sensor |
| a0:c9:a0:5e:83:2b | 192.168.20.35 | Murata Manufacturing | 已管理 | 开发用笔记本电脑 | |
| 8e:0f:95:a2:64:5d | 192.168.20.44 | 未管理 | |||
| 5e:e2:59:1d:c8:03 | 192.168.20.45 | 未管理 | |||
| a8:3b:76:9c:20:e4 | 192.168.20.52 | Cloud Network Technology Singapore PTE. | 未管理 |
1 / 2
操作与审批日志
| # | 时间 | 执行者 | 操作 | 适用对象 | 详情 |
|---|---|---|---|---|---|
| 18 | 2026-09-20T02:02:07.120765432+00:00 | scheduler | audit_completed | dev-laptop-07 (Q9mW3sLp0xVc) | trigger=scheduled host=192.168.20.35 findings=0 open_ports=1 new_findings=0 resolved_findings=0 |
| 17 | 2026-09-20T02:02:05.402816653+00:00 | scheduler | audit_started | dev-laptop-07 (Q9mW3sLp0xVc) | host=192.168.20.35 |
| 16 | 2026-09-20T02:01:14.774390215+00:00 | scheduler | audit_completed | db-prod-01 (Zt4Kb8NwY1eR) | trigger=scheduled host=192.168.20.22 findings=2 open_ports=3 new_findings=1 resolved_findings=0 |
| 15 | 2026-09-20T02:01:12.117409552+00:00 | scheduler | audit_started | db-prod-01 (Zt4Kb8NwY1eR) | host=192.168.20.22 |
| 14 | 2026-09-20T02:00:43.318204577+00:00 | scheduler | audit_completed | web-prod-01 (Xk3F9aLm2QzB) | trigger=scheduled host=192.168.20.21 findings=1 open_ports=2 new_findings=1 resolved_findings=0 |
| 13 | 2026-09-20T02:00:41.029385714+00:00 | scheduler | audit_started | web-prod-01 (Xk3F9aLm2QzB) | host=192.168.20.21 |
| 12 | 2026-09-19T09:11:40.318842077+00:00 | cli:uid=1000 | config_changed | schedule.window_end_hour | value=5 |
| 11 | 2026-09-19T09:11:32.640571920+00:00 | cli:uid=1000 | config_changed | schedule.window_start_hour | value=1 |
| 10 | 2026-09-19T09:10:02.205197346+00:00 | cli:uid=1000 | config_changed | schedule.enabled | value=true |
| 9 | 2026-09-19T08:47:19.771263084+00:00 | control_api: | pair | dev-laptop-07 (Q9mW3sLp0xVc) | endpoint redeemed an operator-issued pairing code and was added to the audit scope |
| 8 | 2026-09-19T08:46:52.093718455+00:00 | cli:uid=1000 | pairing_code_issued | single-use, valid 10 minutes | |
| 7 | 2026-09-19T08:33:18.402118906+00:00 | cli:uid=1000 | audit_completed | db-prod-01 (Zt4Kb8NwY1eR) | trigger=manual host=192.168.20.22 findings=1 open_ports=2 new_findings=1 resolved_findings=0 |
| 6 | 2026-09-19T08:33:15.588240391+00:00 | cli:uid=1000 | audit_started | db-prod-01 (Zt4Kb8NwY1eR) | manual audit; host=192.168.20.22 |
| 5 | 2026-09-19T08:31:07.336914608+00:00 | control_api: | pair | db-prod-01 (Zt4Kb8NwY1eR) | endpoint redeemed an operator-issued pairing code and was added to the audit scope |
| 4 | 2026-09-19T08:30:41.874526103+00:00 | cli:uid=1000 | pairing_code_issued | single-use, valid 10 minutes | |
| 3 | 2026-09-19T08:12:26.152083967+00:00 | control_api: | pair | web-prod-01 (Xk3F9aLm2QzB) | endpoint redeemed an operator-issued pairing code and was added to the audit scope |
| 2 | 2026-09-19T08:11:58.960417225+00:00 | cli:uid=1000 | pairing_code_issued | single-use, valid 10 minutes | |
| 1 | 2026-09-19T08:00:03.415602838+00:00 | daemon | daemon_started | version 0.3.4 |
2 / 2
RoamSwitch Sensor Audit Report
| Generated (UTC) | 2026-09-20T02:30:12.508136294+00:00 |
|---|---|
| Site | HQ – 3F server room |
| Sensor public key | +kbYCoN5jJSykTAr8zDv/VCs2SdBcrwYbkCrzCRgsLM= |
| Audit log | Integrity check: OK (no tampering detected) — 18 entries, head #18 771a265c58fa2f0a8990bc6be79ff5259d96a76a0a3fea472f308df02eaa087f |
Latest audit per endpoint
| Endpoint | Address | Timestamp | Findings | Open ports |
|---|---|---|---|---|
| web-prod-01 | 192.168.20.21 | 2026-09-20T02:00:43.318204577+00:00 | 1 finding(s) | 2 |
| db-prod-01 | 192.168.20.22 | 2026-09-20T02:01:14.774390215+00:00 | 2 finding(s) | 3 |
| dev-laptop-07 | 192.168.20.35 | 2026-09-20T02:02:07.120765432+00:00 | clean | 1 |
Findings
| When | Endpoint | Port | Finding | Recommendation |
|---|---|---|---|---|
| 2026-09-20T02:01:14.774390215+00:00 | db-prod-01 | 22 | SSH Version Banner Disclosed This SSH server discloses its version banner on connect. This is normal SSH behavior, but the banner gives an attacker a starting point to look up known vulnerabilities for that version. | Keep SSH updated to the latest version, and minimize the banner's detail if your SSH implementation allows it. |
| 2026-09-20T02:01:14.774390215+00:00 | db-prod-01 | 6379 | Known Vulnerability: CVE-2021-32626 (Redis) Redis is an open source, in-memory database that persists on disk. In affected versions specially crafted Lua scripts executing in Redis can cause the heap-based Lua stack to be overflowed, due to incomplete checks for this condition. This can result with heap corruption and potentially remote code execution. This problem exists in all versions of Redis with Lua scripting support, starting from 2.6. The problem is fixed in versions 6.2.6, 6.0.16 and 5.0.14. | Upgrade Redis to a version not affected by CVE-2021-32626 as soon as possible, and restrict unauthenticated network access to it in the meantime. |
| 2026-09-20T02:00:43.318204577+00:00 | web-prod-01 | 22 | SSH Version Banner Disclosed This SSH server discloses its version banner on connect. This is normal SSH behavior, but the banner gives an attacker a starting point to look up known vulnerabilities for that version. | Keep SSH updated to the latest version, and minimize the banner's detail if your SSH implementation allows it. |
| 2026-09-19T08:33:18.402118906+00:00 | db-prod-01 | 22 | SSH Version Banner Disclosed This SSH server discloses its version banner on connect. This is normal SSH behavior, but the banner gives an attacker a starting point to look up known vulnerabilities for that version. | Keep SSH updated to the latest version, and minimize the banner's detail if your SSH implementation allows it. |
Device inventory (every device observed on the LAN)
| MAC | IP | Hostname | Vendor | Managed | Note |
|---|---|---|---|---|---|
| 00:1b:8b:3c:9a:07 | 192.168.20.1 | _gateway | NEC Platforms | no | HQ gateway router |
| 7c:8b:ca:61:d2:4e | 192.168.20.2 | TP-Link Technologies | no | 3F Wi-Fi access point | |
| e4:e7:49:2b:70:c1 | 192.168.20.3 | Hewlett Packard | no | 2F multifunction printer | |
| 90:61:ae:17:4d:e2 | 192.168.20.21 | Intel Corporate | yes | Production web server | |
| 90:61:ae:17:4d:f9 | 192.168.20.22 | Intel Corporate | yes | Production database server | |
| 04:20:9a:cc:31:8f | 192.168.20.31 | sensor-hq-01 | Panasonic AVC Networks Company | no | RoamSwitch-Sensor |
| a0:c9:a0:5e:83:2b | 192.168.20.35 | Murata Manufacturing | yes | Development laptop | |
| 8e:0f:95:a2:64:5d | 192.168.20.44 | no | |||
| 5e:e2:59:1d:c8:03 | 192.168.20.45 | no | |||
| a8:3b:76:9c:20:e4 | 192.168.20.52 | Cloud Network Technology Singapore PTE. | no |
1 / 2
Operation & approval log
| # | When | Actor | Action | Target | Detail |
|---|---|---|---|---|---|
| 18 | 2026-09-20T02:02:07.120765432+00:00 | scheduler | audit_completed | dev-laptop-07 (Q9mW3sLp0xVc) | trigger=scheduled host=192.168.20.35 findings=0 open_ports=1 new_findings=0 resolved_findings=0 |
| 17 | 2026-09-20T02:02:05.402816653+00:00 | scheduler | audit_started | dev-laptop-07 (Q9mW3sLp0xVc) | host=192.168.20.35 |
| 16 | 2026-09-20T02:01:14.774390215+00:00 | scheduler | audit_completed | db-prod-01 (Zt4Kb8NwY1eR) | trigger=scheduled host=192.168.20.22 findings=2 open_ports=3 new_findings=1 resolved_findings=0 |
| 15 | 2026-09-20T02:01:12.117409552+00:00 | scheduler | audit_started | db-prod-01 (Zt4Kb8NwY1eR) | host=192.168.20.22 |
| 14 | 2026-09-20T02:00:43.318204577+00:00 | scheduler | audit_completed | web-prod-01 (Xk3F9aLm2QzB) | trigger=scheduled host=192.168.20.21 findings=1 open_ports=2 new_findings=1 resolved_findings=0 |
| 13 | 2026-09-20T02:00:41.029385714+00:00 | scheduler | audit_started | web-prod-01 (Xk3F9aLm2QzB) | host=192.168.20.21 |
| 12 | 2026-09-19T09:11:40.318842077+00:00 | cli:uid=1000 | config_changed | schedule.window_end_hour | value=5 |
| 11 | 2026-09-19T09:11:32.640571920+00:00 | cli:uid=1000 | config_changed | schedule.window_start_hour | value=1 |
| 10 | 2026-09-19T09:10:02.205197346+00:00 | cli:uid=1000 | config_changed | schedule.enabled | value=true |
| 9 | 2026-09-19T08:47:19.771263084+00:00 | control_api: | pair | dev-laptop-07 (Q9mW3sLp0xVc) | endpoint redeemed an operator-issued pairing code and was added to the audit scope |
| 8 | 2026-09-19T08:46:52.093718455+00:00 | cli:uid=1000 | pairing_code_issued | single-use, valid 10 minutes | |
| 7 | 2026-09-19T08:33:18.402118906+00:00 | cli:uid=1000 | audit_completed | db-prod-01 (Zt4Kb8NwY1eR) | trigger=manual host=192.168.20.22 findings=1 open_ports=2 new_findings=1 resolved_findings=0 |
| 6 | 2026-09-19T08:33:15.588240391+00:00 | cli:uid=1000 | audit_started | db-prod-01 (Zt4Kb8NwY1eR) | manual audit; host=192.168.20.22 |
| 5 | 2026-09-19T08:31:07.336914608+00:00 | control_api: | pair | db-prod-01 (Zt4Kb8NwY1eR) | endpoint redeemed an operator-issued pairing code and was added to the audit scope |
| 4 | 2026-09-19T08:30:41.874526103+00:00 | cli:uid=1000 | pairing_code_issued | single-use, valid 10 minutes | |
| 3 | 2026-09-19T08:12:26.152083967+00:00 | control_api: | pair | web-prod-01 (Xk3F9aLm2QzB) | endpoint redeemed an operator-issued pairing code and was added to the audit scope |
| 2 | 2026-09-19T08:11:58.960417225+00:00 | cli:uid=1000 | pairing_code_issued | single-use, valid 10 minutes | |
| 1 | 2026-09-19T08:00:03.415602838+00:00 | daemon | daemon_started | version 0.3.4 |
2 / 2
所示的机器名称、MAC 地址、IP 地址和密钥均为虚构。报告正文以日语或英语输出（日语以外的界面显示英文版）。