Single file, no external resources. Served from http://beef.hidtv.hu/ (use the plain-http copy: over https every
http:// probe dies as mixed content and only the TLS ports get tested). A public origin probing 10.x is also
exactly what Edge's Local Network Access gate blocks, so if the preflight banner below turns red, use
download — it arrives as netreach.txt, rename it to .html and open it
from file://.
Hosts and ports, one per line, # comments ignored. A host line may be a name, an address, or a CIDR.
| host | port | scheme | verdict | ms | service |
|---|
Reading the verdicts. A browser cannot open a raw socket, so each row is what fetch() did. The table
lists only what you act on — open and blocked. Everything else is in the counters and the CSV; tick the box
above to list the no answer and refused rows too.
open the promise resolved — the TCP handshake completed and the service answered, which is hard proof of reach.
blocked Edge refuses the port (ERR_UNSAFE_PORT) without emitting a packet. 139, 389, 636, 53, 22 and 23 fall in that set, so SMB and LDAP reach must be tested with scan_targets.sh or the Flipper payload instead.
no answer (hidden) nothing came back before the timeout — a firewall dropped it, or a service is listening that never replies; the two are indistinguishable from a browser. On an unreachable segment this is every single row, which is why it is folded away. Unfold it when a host answers on one port and times out on another: that difference is a filtered port on a live host.
refused (hidden) the promise rejected quickly — RST, DNS failure, or a service that hangs up on a non-HTTP request; packets were not silently dropped.
skipped (CSV only) served over https while the port needs plain http, so the request died as mixed content inside the page — not a network verdict. Use the plain-http copy for those ports.
Preflight. Before scanning, the page fetches itself and reads the local-network-access permission.
A failed self-fetch means the page is not running from a usable origin; a denied permission means Edge will swallow
every probe into 10.x before it reaches the wire, turning the whole run into false "no answer" rows. The banner says
which of the two happened instead of letting you misread the table.