Beacon: Network Field Audit

About

Every consulting engagement starts the same way: you walk into a building you have never seen and someone asks what is on this network, is any of it about to fall over, and where are the holes. Beacon answers that from your phone, and turns the visit into a document you can hand over before you leave. Nothing leaves the device. No account, no cloud, no analytics. The client's network map stays on your phone, which for a security conscious client is the entire procurement conversation. FIND EVERY DEVICE, INCLUDING THE QUIET ONES One tap sweeps the real subnet, derived from your interface netmask rather than assuming a /24, so a client on a /22 gets all of it. Beacon treats a refused connection as proof a host exists, reads the kernel neighbour table for devices that answer nothing at all, and browses Bonjour throughout. Firewalled and silent kit still lands in the device count, and the app tells you which devices were seen only at layer 2 instead of quietly dropping them. Plugged into the switch with a USB-C adapter instead of joining the wifi? Beacon scans that interface too. IDENTIFY WHAT EACH BOX ACTUALLY IS Vendor from the MAC, hostname from reverse DNS and Bonjour, open ports, advertised services, and a role guess for each host. Privacy randomised MAC addresses are named as such rather than shown as an unknown vendor, which is also why that device will not hold a DHCP reservation. AUDIT THE HOSTS THAT MATTER, READ ONLY TLS and certificates: expiry, weak protocol versions, self signed and untrusted chains, key strength, subject alternative names. SSH host audit: sign in with a key or password held in the Keychain behind Face ID, and Beacon runs one combined read only playbook. Operating system and end of life status, disk and memory headroom, listening sockets, running services, pending updates, sshd hardening, crypto algorithms, firewall state, failed login volume. It reads. It never installs, changes, starts or stops anything. Exposed services: Telnet, FTP, RDP, VNC, unauthenticated databases and caches, Docker APIs, building and industrial control ports on a flat corporate network. Web headers: HSTS, redirect to HTTPS, CSP, clickjacking and sniffing protection, server version disclosure. SNMP: whether the device answers the default community, and what it says about itself. Default credentials: identified from the device fingerprint, never by trying one. FINDINGS THAT SHOW THEIR WORKING Every finding carries the evidence line it came from, ranked by severity. When a check cannot run, Beacon says so rather than reporting a clean result. An auditor will not sign a black box, and a tool that quietly passes a host it never read is worse than no tool. THE DOCUMENT IS THE PRODUCT One tap turns the visit into a branded multi page PDF: site, client and technician on the cover, the device inventory, and every finding grouped by host with its evidence. That artefact is what the engagement is paid to produce. WHAT CHANGED SINCE LAST VISIT Save a site, come back next quarter, and Beacon diffs it. New devices, devices that fell off, ports that opened or closed. Scans are organised by client, then site, then dated visit, the way a consultant already thinks about the work. STRAIGHT ABOUT WHAT iOS ALLOWS iOS forbids raw sockets, so there is no ICMP ping, no ARP sweep and no packet capture, and Beacon does not pretend otherwise. It discovers by TCP connect, the neighbour table, Bonjour and reverse DNS, and it tells you plainly what a silent host can still hide. Handled honestly, the boundary is a credibility signal rather than a hidden failure. AUTHORISED USE ONLY Beacon is for networks you own or are contracted to assess. It is defensive and read only throughout. It never exploits, never brute forces and never attacks anything. iPhone and iPad. Buy once, no subscription.