IVRE is an open source network reconnaissance framework designed to collect, process, and analyze intelligence gathered from network scans and traffic data. It provides tools for both active and passive reconnaissance, enabling users to understand how networks behave and identify exposed services or infrastructure. The framework integrates with well known security and scanning tools such as Nmap, Masscan, ZGrab2, ZDNS, and Zeek to gather large amounts of network intelligence. IVRE stores the collected data in a database and offers multiple ways to explore and analyze it, including a web interface, command line tools, and a Python API. This allows security professionals to query scan results, inspect network flows, and identify patterns across large datasets. The project can be used to build self hosted alternatives to internet scanning services such as Shodan or Censys, giving organizations full control over their own reconnaissance infrastructure.
Features
- Performs both active and passive network reconnaissance
- Integrates with scanning tools such as Nmap, Masscan, and ZGrab2
- Collects intelligence from network traffic using tools like Zeek and Argus
- Provides a web interface for browsing and analyzing scan results
- Includes CLI utilities and a Python API for automation and scripting
- Stores and analyzes large scale scan data to identify services, hosts, and patterns