OTserver Discovery in Isolated and Critical Infrastructure

Collection and transfer procedure

Keep the scanner inside the isolated environment and write validated scan.otserver.json files locally. Use a controlled gateway or approved file share when policy allows. For a disconnected site, transfer the file on approved removable media after malware scanning and review. Do not store API keys or SNMP credentials in the transfer file.

Linux collection

Run without direct upload:

1
2
3
4
5
6

otserver-scanner scan \
  --target 10.20.0.0/24 \
  --interface eth0 \
  --source-mac 00:11:22:33:44:55 \
  --output /var/lib/otserver-scanner/quarterly-line-20.otserver.json \
  --ack-authorized

Validate at the collection point, transfer only the expected JSON through the approved boundary, validate again, and import it through Imports → Create New at the central manager. Leave the file local when the manager is unavailable; do not weaken the network boundary to make one upload succeed.

Windows collection

1
2
3
4
5
6

.\otserver-scanner.exe scan `
  --target 10.20.0.0/24 `
  --interface '<interface name or GUID>' `
  --source-mac 00:11:22:33:44:55 `
  --output .\quarterly-line-20.otserver.json `
  --ack-authorized

The Windows GUI can run the same offline collection with the target, interface, output, protocol, and authorization controls. Copy only the validated JSON through the approved transfer boundary.

Verify the result

Record collection time, scanner identity, target scope, validation result, transfer owner, and destination site. Compare warnings and asset counts with the previous quarterly collection before accepting the import.

Deploy scanners per production line or review import provenance.