Raspberry Pi / ARM Deployment

NetVuln Tool is fully compatible with Raspberry Pi OS and other Debian-based ARM distributions, which makes a Raspberry Pi an excellent always-on network scanner. Combined with the scheduling daemon and portal auto-upload, you get a low-cost, low-power scanning appliance you can drop on any network segment.

Compatibility

• ARM-compatible: all scan logic is Bash with no compiled binaries; the netvuln Python CLI is pure Python.
• Tested on Raspberry Pi 3B+, Pi 4, and Pi 5 running Raspberry Pi OS (Debian-based).
• Recommended hardware: Pi 4+ with 2GB+ RAM for large-subnet scans.

Install

The recommended path on a Pi is the deployment installer, install.sh, which auto-installs dependencies via apt-get, installs the netvuln CLI, writes the license key, scaffolds a per-engagement config, installs and enables the systemd daemon, and verifies portal connectivity. As an unattended agent:

bash install.sh --non-interactive \
  --license-key nvt_pro_<hex> \
  --api-url https://bullium.com/api/upload \
  --client-id acme \
  --targets 192.168.1.0/24

The daemon is installed but stays idle until a config sets DAEMON_ENABLED="true" with TARGETS and a SCAN_SCHEDULE.

If you prefer to install dependencies by hand (for example, for a developer checkout on the Pi), a one-liner covers the common set before running the developer setup.sh:

sudo apt-get install -y nmap jq dnsutils whois curl snmp && bash setup.sh

Scheduling options

Daemon mode (recommended)

For production deployments, the persistent daemon provides multi-config support, retry with exponential backoff, and portal heartbeats. On Linux it installs as a systemd service, so it starts on boot and restarts on failure. A unit template ships at templates/netvuln_daemon.service.

# Install as a systemd service (also done by install.sh unless --no-daemon)
./scripts/netvuln_daemon_ctl.sh install-service

# Start the daemon
./scripts/netvuln_daemon_ctl.sh start

# Check status
./scripts/netvuln_daemon_ctl.sh status

Enable scanning for a config by setting DAEMON_ENABLED="true", a SCAN_SCHEDULE cron expression, and TARGETS, then reloading the daemon (netvuln_daemon_ctl.sh reload). See Daemon Mode and Scheduling for the full lifecycle.

Cron-based scheduling

For simpler setups without the daemon, scheduled_scan.sh manages recurring scans via cron:

./scripts/scheduled_scan.sh --install-cron -c ~/netvuln-tool/configs/client.conf

Platform validation

Before deploying, run the platform validation script to verify readiness:

bash scripts/pi_validate.sh          # Run the deployment checks
bash scripts/pi_validate.sh --json   # JSON output for monitoring integration
bash scripts/pi_validate.sh --fix    # Auto-install missing dependencies where possible

It checks disk space, available memory, required tools, file permissions, and portal (/api/health) reachability. Flags combine, for example pi_validate.sh --fix --json.

Field appliance (proprietary hardware)

The repository's appliance/ directory holds a purpose-built field-enclosure design: a 3D-printed Raspberry Pi 5 + RTL-SDR case with an open dongle cradle and the Bullium logo on the lid (OpenSCAD source, print-ready STLs, renders, and a print guide).

Not Apache-2.0

The appliance/ subtree is proprietary to Bullium Consulting and All Rights Reserved. It is not covered by the repository's Apache-2.0 license and is excluded from the container image. See Open Source Boundary for the exact split.

Performance considerations

• Large subnet scans (for example a /16) may need increased memory or scan segmentation.
• Use the quick_recon profile to reduce resource usage: -P quick_recon.
• Schedule scans during off-peak hours to minimize network impact.
• The daemon's exponential backoff prevents resource exhaustion on repeated failures.

Containerized alternative

If you would rather not install the toolchain on the Pi at all, the Alpine image runs the full recon stack in a container. Note that --network host (needed for LAN reach) is a Linux Docker feature and works on a Pi running Docker Engine. See the Docker guide for build, run, and privilege details.