Result model

NetsCLI keeps result data shared across interfaces. Desktop app tables, CLI JSON/YAML, TUI output, MCP tools, and Rust structs describe the same underlying operation.

Compatibility

Structured output is designed to be additive:

Existing field names remain stable.
New fields may appear as the core library captures richer data.
Missing optional data is represented as absent, null, empty, or - in human output depending on the interface.
Consumers can safely ignore unknown fields.

Port results

Port scans include the existing compatibility fields plus richer status data.

Field	Meaning
`port`	TCP port number.
`open`	Compatibility boolean for older consumers.
`service`	Best-effort service guess.
`status`	`open`, `closed`, `filtered`, or `error`.
`latency_ms`	TCP connect/probe latency where available.
`banner`	Bounded plaintext banner when captured.
`http`	HTTP status/header data when a HTTP-like probe succeeds.
`tls`	TLS metadata when a TLS probe succeeds.
`raw`	Bounded raw diagnostic preview when available.
`error`	Probe error text when the scanner could not complete a normal open, closed, or filtered result.

filtered means the connection attempt timed out or was blocked before connect.

Banner, HTTP, TLS, and raw preview data are probe results. They are useful diagnostics, not proof that a service is trustworthy.

Host inventory

Discovery and sweep results describe hosts.

Field	Meaning
`ip`	Host address.
`hostname`	Reverse DNS or local name when available.
`mac`	MAC address when present in ARP/vendor data.
`vendor`	OUI vendor lookup.
`rtt_ms`	Reachability latency.
`open_ports`	Sweep-only list of open port rows for that host.

Discovery prioritizes inventory. Sweep adds exposed-service data by scanning selected ports on discovered hosts.

DNS records

DNS records expose type and value first, then additive metadata when the resolver provides it.

Field	Meaning
`record_type`	A, AAAA, CNAME, MX, NS, TXT, SRV, PTR, SOA, CAA, or another supported record family.
`value`	Display value for the record.
`ttl_seconds`	TTL when available.
`name`	Owner name when available.
`resolver_source`	Resolver source when NetsCLI can report it.

When ALL records are requested, some record families can fail while others succeed. When at least one record is returned, interfaces present the lookup as partial results rather than a total failure.

Inspect results

Inspect is a host profile. It combines host-level data with optional port scan data.

Field	Meaning
`host`	Original target.
`ip`	Resolved IP address.
`hostname`	Reverse DNS name when available.
`ping`	Reachability object with `alive`, `method`, `rtt_ms`, `seq`, and optional `error`.
`ports`	Port scan rows using the same model as `scan`.
`open_ports`	Convenience list containing only open port rows.

mDNS services

mDNS/DNS-SD returns service announcements rather than generic host rows. A single device can announce multiple services.

Field	Meaning
`full_name`	Full service instance name.
`hostname`	Host that owns the service.
`service_type`	DNS-SD service type, such as `_http._tcp.local.`.
`addresses`	IPv4 and IPv6 addresses resolved for the service host.
`port`	Service port.
`properties`	TXT record key/value properties.

Interfaces and ARP

Interface rows describe local network interfaces. ARP rows describe the local neighbor cache.

Field	Meaning
`name` / `interface`	Interface name or interface address associated with the row.
`ips` / `addresses`	Interface addresses.
`mac`	MAC address when available.
`state`	Interface state such as up or down.
`loopback`	Whether the interface is loopback where known.
`vendor`	OUI vendor lookup for MAC addresses where available.

ARP is not full discovery. It reports entries already known to the operating system.

Packet capture results

Packet capture results are available only in builds compiled with packet-capture support.

Field	Meaning
`index`	Packet number within the capture.
`timestamp`	Packet timestamp where available.
`source`	Best parsed source endpoint.
`destination`	Best parsed destination endpoint.
`protocol`	Parsed protocol family.
`length`	Captured packet length.
`captured_length`	Number of bytes captured for this packet.
`info`	Human-oriented packet summary.
`source_port` / `destination_port`	Transport ports when parsed.
`tcp_flags`	TCP flags when parsed.
`icmp_type` / `icmp_code`	ICMP metadata when parsed.
`arp_operation`	ARP operation when parsed.
`ethernet_source` / `ethernet_destination`	Ethernet addresses when parsed.
`hex_preview`	Bounded byte preview for quick inspection.