A small, friendly read of the network.

SSH is the most-spoken protocol on this network — 13 hosts answer on tcp/22. Every one of them is a device you'd expect to administer (UniFi gear, Pis, Macs, NAS). None of them are advertising a vulnerable banner, but the sheer count means a single weak key would matter.

27 HTTP services are open across the LAN. Many are device admin panels (Mainsail, UniFi OS, hue, Awair, Kasa). The ones served on plain :80 with no redirect to https are the ones to watch — they happily accept credentials in the clear.

The hosts that should be TLS are TLS — UniFi OS, Mainsail's Stalwart Management, and the Hue bridge. Two unknown :443 endpoints are cameras and should be reviewed.

calliope, mainsail, ecb5fa843be9 (Hue), and the UniFi gateway expose :8080. For Mainsail and UniFi this is part of the normal control plane. For the Hue bridge it's the standard local API.

SMB (tcp/445) is open on Mnemosyne (expected for a Windows workstation), the UniFi appliance (expected for backups), and MacBookPro. Mac sharing SMB on a homelab is common but worth a glance.

Only two hosts answer DNS — your UniFi gateway and one MacBookPro. The gateway is expected. The Mac is likely running a local resolver (mDNS, Tailscale magicDNS bridge, or dnsmasq for dev).

Two hosts still answer NetBIOS (tcp/139). Modern Windows doesn't need it. UniFi probably exposes it for legacy compatibility.

Three RTSP endpoints are open. One (calliope:8554) is your go2rtc/Frigate aggregator and that's fine. The other two are the cameras at 192.168.16.48 and 192.168.19.24 speaking rtsp:// directly with no product banner — that's the classic 'cheap IP cam with default creds' signature.

Only two MQTT brokers answer — calliope and mainsail. Both are Mainsail/Klipper hosts, which is the expected pattern. No stray brokers, no public exposure, no unauthenticated brokers on phones or cameras.

tcp/5357 is Windows' WSDAPI for device discovery. Expected on Mnemosyne and on the UniFi-managed Windows host.

tcp/3000 on Mnemosyne is almost certainly a local dev/Grafana/Node service tagged as 'ppp' by nmap's port table.

Mnemosyne exposes tcp/3389 (RDP). On a trusted LAN behind Tailscale this is usually fine, but RDP has a long history of brute-force pain and should be NLA-enforced.

tcp/5000 on MacBookPro is the macOS AirPlay receiver / Control Center port. It's usually fine on a private LAN, but it's also the port that's been a CVE magnet on older macOS releases.

Laboratoryi5Air exposes tcp/5900 (VNC). Default macOS Screen Sharing speaks this. Make sure it requires a password.

tcp/8123 on homeassistant is the Home Assistant frontend. Port-name guess is wrong; this is the real thing.

tcp/8443 on unifi is the UniFi controller's HTTPS port. Expected.

calliope:8554 looks like a go2rtc/Frigate aggregator — that's the recommended pattern for camera streams.

UniFi is healthy and exposing the expected control-plane surfaces (SSH, DNS, HTTP, HTTPS, :8080, :8443).

Windows workstation exposing SMB, NetBIOS, RDP, WSDAPI, and a service on :3000. None of this is wrong, but it's the broadest profile on the LAN.

Plain rtsp:// and an unidentified :443 with no product banner. Almost certainly a cheap IP cam with default credentials.

Same RTSP+HTTPS fingerprint as the other unbranded camera. Treat them as a pair.

SSH, Mainsail/Stalwart on :8080, MQTT broker, and the RTSP aggregator on :8554 — this is the most-trusted node on the LAN and it looks the part.

Same shape as calliope — SSH, Mainsail HTTP+HTTPS+:8080, MQTT broker. Looks like an intentional pair (printer + control host).

SSH, UniFi OS on :80 and :443, NetBIOS, SMB, WSDAPI — that's the expected UDM/UCK profile.

SSH + VNC (:5900). VNC is fine on the LAN if it has a strong password.

DNS, SMB, and AirPlay/UPnP on :5000. Normal for a macOS workstation, but the DNS responder is worth checking.

Single service exposed — :8123 — exactly what you want. This is also the receiver of Porchlight's own MQTT publish.