Capstone project

Capstone: audit a network inventory

Lesson 20 of 20 · 25 min · Module 6: Policies and audits

Bring every tool together. An inventory lists devices with their address, network, and open ports. Write an audit that a team could run before every change window.

Start this lesson →

Free. No installation: you write and run the code in your browser, and it is checked automatically.

By the end, you’ll be able to…

Combine parsing, membership, and policy checks
Group records to find duplicates
Produce a stable, sorted report

The idea

Each finding is a short, sorted line of text, so the report is easy to read and to compare between runs. Reuse what you learned: ipaddress for parsing and membership, a services dictionary for port names, and a counter to find duplicates.

inventory = [
    {"name": "web-01", "ip": "10.0.1.10", "network": "10.0.1.0/24", "open_ports": [22, 443]},
]
allowed_ports = {22, 80, 443}

01One device at a time

For each device, parse the address first. If parsing fails, record the problem and continue with the next device: the other checks would only produce noise.

02Group to find duplicates

A defaultdict(list) maps every address to the names using it. After the loop, any list with more than one name is a conflict, the kind that causes mysterious, intermittent outages.

from collections import defaultdict
owners = defaultdict(list)
owners["10.0.1.50"].append("cam-1")
print(dict(owners))

Output

{'10.0.1.50': ['cam-1']}

03Sorted output is comparable

Sorting findings means the same inventory always produces the same report. Teams can then compare this week’s audit with last week’s and see exactly what changed.

Your project brief

Write audit(inventory, allowed_ports) that returns a sorted list of findings:
• "NAME: invalid address IP" if the IP cannot be parsed (skip other checks for that device);
• "NAME: IP is outside NETWORK" if the address is not in its network;
• "NAME: port P (SERVICE) should be closed" for every open port not in allowed_ports, using ssh 22, telnet 23, http 80, https 443, smb 445, mysql 3306, rdp 3389, or unknown;
• "IP: used by A, B" when two or more devices share a valid IP, names in alphabetical order.

What the checks look for

Reports nothing for a clean inventory
Flags ports that should be closed, with service names
Flags addresses outside their network and invalid addresses
Finds duplicate addresses
Combines every check and sorts the report

Try it in the editor →

Take this with you

An audit is a set of small, precise checks combined into one stable report.

Go a little further

Add a finding for devices whose open ports include both http (80) and https (443), suggesting a redirect to https.