OpenClaw compares network scans and reports changes

Simon Roses Femerling describes running OpenClaw as AgentX on a Raspberry Pi in his security workflow. One specific recurring task scans his local network every four hours, records discovered hosts and services, and compares them with the previous scan. Anomalies trigger a Telegram summary rather than requiring him to inspect every output manually.

The published job separates host discovery from further investigation. When a new host appears, the agent can run service detection, save the results to a dated file and compare the change with known network state. The account also describes checking externally exposed ports and maintaining a daily summary of scans, hosts and suspicious activity.

The article combines real configuration with illustrative commands and sample reports. Its example address and alert should not be treated as evidence that a particular public service was actually exposed. The supported deployment is the author's configured and used monitoring workflow, with historical records and human inspection. He notes that raw-socket scans need privileges and that overly frequent scanning can trigger intrusion alerts. Elsewhere he describes production restarts requiring approval, so that authority is not inferred from a Telegram request to deploy.

Prompt
Original prompt

Source: Blog · Simon Roses Femerling