Targets
Discovered hosts and open ports from Gearbox's SQLite database, with enrichment data and per-port tool coverage.
Overview
The Targets tab shows all IP addresses and open ports discovered by Gearbox during the assessment. This data comes from the project's SQLite database (discovered_hosts and open_ports tables), which Gearbox populates as its network scanning modules (NmapLive, NmapPort, Nessus, BannerGrab, etc.) run.
Discovered Hosts
Each discovered host displays:
| Field | Description |
|---|---|
| IP Address | The host's IPv4 address, sorted numerically |
| Hostname | Reverse DNS or discovered hostname (when available) |
| MAC Address | Hardware address (when on the same L2 segment) |
| OS | Detected operating system (from nmap OS fingerprinting or service banners) |
| Instances | Which sub-device/interface/instance combinations discovered this host (e.g., MainBoard.Ethernet.eth0) |
| First Seen | Timestamp of first discovery |
Open Ports
Expanding a host row reveals its discovered open ports:
| Field | Description |
|---|---|
| Port | Port number |
| Protocol | TCP or UDP |
| Service | Detected service name (http, ssh, ftp, smb, etc.) |
| Version | Service version string when detected |
| State | Port state (open, filtered, etc.) |
| Tools | Which Gearbox modules have tested this port |
Data Sources
Target data is aggregated from multiple Gearbox modules. The same host may be discovered by multiple interfaces (e.g., two Ethernet ports on different sub-devices both seeing the same IP). Gauntlet deduplicates by IP and merges the instance sources.
Port data can come from nmap scans, banner grabs, Nessus results, and other network-aware modules. CSV fallback files are also checked when the SQLite database is not available or incomplete.