From 1313d95e90d4b20b304b6acdbd8d5f88abfc539f Mon Sep 17 00:00:00 2001
From: Matteo Di Lorenzi <matteo.dilorenzi@nethesis.it>
Date: Wed, 28 Jan 2026 09:09:10 +0100
Subject: [PATCH 1/2] fix(scan-network): block network scan for large network
 (/19 or lower)

---
 .../standalone/dns_dhcp/ScanInterfaceCard.vue | 36 +++++++++++++++----
 .../standalone/dns_dhcp/ScanNetwork.vue       | 11 ++++--
 src/i18n/en.json                              |  3 +-
 src/i18n/it.json                              |  3 +-
 4 files changed, 42 insertions(+), 11 deletions(-)

diff --git a/src/components/standalone/dns_dhcp/ScanInterfaceCard.vue b/src/components/standalone/dns_dhcp/ScanInterfaceCard.vue
index 4dee4befa..0d636a935 100644
--- a/src/components/standalone/dns_dhcp/ScanInterfaceCard.vue
+++ b/src/components/standalone/dns_dhcp/ScanInterfaceCard.vue
@@ -4,12 +4,13 @@
 -->
 
 <script setup lang="ts">
-import { NeButton } from '@nethesis/vue-components'
+import { NeButton, NeTooltip } from '@nethesis/vue-components'
 import { type PropType } from 'vue'
 import { useI18n } from 'vue-i18n'
 import { useFirewallStore } from '@/stores/standalone/firewall'
 import { getZoneBorderColorClasses } from '@/lib/standalone/network'
 import type { ScanInterface } from './ScanNetwork.vue'
+import { faMagnifyingGlass } from '@fortawesome/free-solid-svg-icons'
 
 defineProps({
   iface: {
@@ -23,6 +24,10 @@ defineProps({
   scanButtonDisabled: {
     type: Boolean,
     default: false
+  },
+  scanButtonDisabledNetworkTooLarge: {
+    type: Boolean,
+    default: false
   }
 })
 
@@ -51,18 +56,37 @@ function getBorderColorForInterface(iface: string) {
             <br />
             {{ iface.device }}
           </p>
+          <NeTooltip
+            v-if="scanButtonDisabledNetworkTooLarge"
+            trigger-event="mouseenter focus"
+            placement="top-start"
+          >
+            <template #trigger>
+              <NeButton
+                kind="tertiary"
+                :loading="scanButtonLoading"
+                :disabled="scanButtonDisabled"
+                @click="emit('startScan', iface)"
+              >
+                <template #prefix>
+                  <FontAwesomeIcon :icon="faMagnifyingGlass" class="h-4 w-4" aria-hidden="true" />
+                </template>
+                {{ t('standalone.dns_dhcp.scan_network') }}
+              </NeButton>
+            </template>
+            <template #content>
+              {{ t('standalone.dns_dhcp.scan_network_too_large') }}
+            </template>
+          </NeTooltip>
           <NeButton
+            v-else
             kind="tertiary"
             :loading="scanButtonLoading"
             :disabled="scanButtonDisabled"
             @click="emit('startScan', iface)"
           >
             <template #prefix>
-              <font-awesome-icon
-                :icon="['fas', 'magnifying-glass']"
-                class="h-4 w-4"
-                aria-hidden="true"
-              />
+              <FontAwesomeIcon :icon="faMagnifyingGlass" class="h-4 w-4" aria-hidden="true" />
             </template>
             {{ t('standalone.dns_dhcp.scan_network') }}
           </NeButton>
diff --git a/src/components/standalone/dns_dhcp/ScanNetwork.vue b/src/components/standalone/dns_dhcp/ScanNetwork.vue
index 8502c4986..54011280f 100644
--- a/src/components/standalone/dns_dhcp/ScanNetwork.vue
+++ b/src/components/standalone/dns_dhcp/ScanNetwork.vue
@@ -29,6 +29,7 @@ import type { StaticLease } from './StaticLeases.vue'
 export interface ScanInterface {
   name: string
   device: string
+  netmask: number
 }
 
 export interface ScanResult {
@@ -91,7 +92,8 @@ async function listInterfaces() {
     const res = await ubusCall('ns.scan', 'list-interfaces')
     interfaces.value = res.data.interfaces.map((iface: any) => ({
       name: iface.interface,
-      device: iface.device
+      device: iface.device,
+      netmask: iface.netmask
     }))
   } catch (err: any) {
     error.value.listInterfaces = t(getAxiosErrorMessage(err))
@@ -150,7 +152,7 @@ async function scanNetwork(iface: ScanInterface) {
   loading.value.scanNetwork = true
 
   try {
-    const res = await ubusCall('ns.scan', 'scan', { device: iface.device })
+    const res = await ubusCall('ns.scan', 'scan', { device: iface.device, interface: iface.name })
     scanResults.value = res.data.hosts.map((host: ScanResult) => ({
       ip: host.ip,
       mac: host.mac,
@@ -230,7 +232,10 @@ function addDnsRecord(scanResult: ScanResult) {
               :key="ifaceName"
               :iface="iface"
               :scan-button-loading="loading.scanNetwork && scanningInterface === iface.name"
-              :scan-button-disabled="loading.scanNetwork && scanningInterface === iface.name"
+              :scan-button-disabled="
+                (loading.scanNetwork && scanningInterface === iface.name) || iface.netmask < 20
+              "
+              :scan-button-disabled-network-too-large="iface.netmask < 20"
               @start-scan="scanNetwork"
             />
           </template>
diff --git a/src/i18n/en.json b/src/i18n/en.json
index 6eca090ef..cabb54f6f 100644
--- a/src/i18n/en.json
+++ b/src/i18n/en.json
@@ -1280,11 +1280,12 @@
       "dhcp_option_combobox_placeholder": "Search key",
       "force_start": "Force DHCP server start",
       "force_start_tooltip": "When force option is enabled, DHCP will start even if there is another DHCP server in the network. Disable force option only if you want to avoid conflicts with other DHCP servers.",
-      "scan_network_description": "Scan the network to discover devices and assign them IP reservations or DNS records.",
+      "scan_network_description": "Scan the network to discover devices and assign them IP reservations or DNS records. This operation is only allowed for network interfaces with a /20 netmask or larger.",
       "scan_results": "Scan results",
       "interface_name": "Interface: {name}",
       "description": "Description",
       "scan_network": "Scan network",
+      "scan_network_too_large": "Scan available only for networks with a /20 netmask or larger",
       "scan_not_requested_empty_state": "Click 'Scan network' on an interface to discover devices",
       "scan_no_results_empty_state": "No devices found on interface '{iface}'",
       "reservation_location_info_description": "This reservation will appear in:",
diff --git a/src/i18n/it.json b/src/i18n/it.json
index 15513d13e..9116b6deb 100644
--- a/src/i18n/it.json
+++ b/src/i18n/it.json
@@ -1200,11 +1200,12 @@
       "inactive": "Inattivo",
       "force_start": "Forza l'avvio del server DHCP",
       "force_start_tooltip": "Quando l'opzione di forzatura è abilitata, il DHCP verrà avviato anche se nella rete è presente un altro server DHCP. Disabilitare l'opzione di forzatura solo se si desidera evitare conflitti con altri server DHCP.",
-      "scan_network_description": "Scansiona la rete per scoprire i dispositivi di rete e assegnargli una reservation o un record DNS.",
+      "scan_network_description": "Scansiona la rete per scoprire i dispositivi di rete e assegnargli una reservation o un record DNS. Questa operazione è consentita solamente per le interfacce di rete con una maschera /20 o superiore.",
       "scan_results": "Risultati della scansione",
       "description": "Descrizione",
       "interface_name": "Interfaccia: {name}",
       "scan_network": "Scansiona rete",
+      "scan_network_too_large": "Scansione disponibile solo per reti con maschera /20 o superiore",
       "scan_not_requested_empty_state": "Fare clic su 'Scansiona rete' su un'interfaccia per individuarne i dispositivi",
       "scan_no_results_empty_state": "Nessun dispositivo trovato sull'interfaccia '{iface}'",
       "reservation_location_info_description": "Questa reservation apparirà in:",

From 9ed052e8b386e8e80e18fad943e14ad584fc2af7 Mon Sep 17 00:00:00 2001
From: Matteo Di Lorenzi <matteo.dilorenzi@nethesis.it>
Date: Thu, 29 Jan 2026 09:52:26 +0100
Subject: [PATCH 2/2] fix(scan-network): remove interface parameter from
 network scan call

---
 src/components/standalone/dns_dhcp/ScanNetwork.vue | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/components/standalone/dns_dhcp/ScanNetwork.vue b/src/components/standalone/dns_dhcp/ScanNetwork.vue
index 54011280f..8946ed72c 100644
--- a/src/components/standalone/dns_dhcp/ScanNetwork.vue
+++ b/src/components/standalone/dns_dhcp/ScanNetwork.vue
@@ -152,7 +152,7 @@ async function scanNetwork(iface: ScanInterface) {
   loading.value.scanNetwork = true
 
   try {
-    const res = await ubusCall('ns.scan', 'scan', { device: iface.device, interface: iface.name })
+    const res = await ubusCall('ns.scan', 'scan', { device: iface.device })
     scanResults.value = res.data.hosts.map((host: ScanResult) => ({
       ip: host.ip,
       mac: host.mac,