Socket Search: Making nmap Legible

A Ruby wrapper that turns a network scan into a visual report, because a port list only helps you if you can read it.

Socket Search came out of a recurring problem with clients who aren't engineers. nmap will tell you exactly what's open on a network, but the output is a wall of text that means nothing unless you already know how to read it. An audit isn't done when the scan completes. It's done when someone who isn't a security engineer looks at the result and knows what to change.

A thin wrapper, on purpose

The nmap gem does the real work. It sweeps the local host and every device on the connected subnet and matches open ports against known service signatures. I didn't try to reinvent scanning. nmap has decades of refinement behind it. Socket Search's whole value is what happens to the result afterward, which is exactly the part nmap leaves to you.

From a port list to a posture

Every host and port gets classified against a baseline of what should be open on that kind of device, and lands in one of a few buckets. Expected and closed. Expected and open. Open and unexpected. Then it renders as a visual map rather than a table, because position and color land faster than rows do. A port open on a device with no reason to expose it gets flagged in red and explained in plain language: what usually runs there, and why you probably want it shut.

• No command line. The report is the deliverable, not the raw scan.
• Severity reads visually first — color and layout carry the finding before anyone reads a word.
• Every flag comes with a plain explanation of what that port normally does.
• It has to survive being handed to a non-engineer and still drive a decision.

A finding nobody reads isn't a finding. It's a row in a file.

Most of the work was leaving things out

A thorough scan surfaces a lot of noise. Expected services, internal-only ports, things open entirely on purpose. A report that shows all of it is exactly as useless as raw nmap. The tool is only worth anything if it stays quiet about the boring majority and spends its visual weight on the few findings that matter. Deciding what not to show turned out to be most of the design.

One rule sits above the rest. Socket Search only ever points at networks you're authorized to scan. A tool built to make findings legible has to be at least as clear about its own scope.