diff --git a/.gitea/workflows/audit.yml b/.gitea/workflows/audit.yml
index d2d37d1..910af41 100644
--- a/.gitea/workflows/audit.yml
+++ b/.gitea/workflows/audit.yml
@@ -1,25 +1,24 @@
-name: docker-enum
+name: net-recon
 on: [push]
 jobs:
-  scan:
+  net:
     runs-on: ubuntu-latest
     steps:
-      - name: docker-network
+      - name: network
         run: |
-          echo "=== DNS lookups for Docker service names ==="
-          for name in db mongo mongodb mysql postgres redis gitea n8n api backend nginx proxy traefik vault consul grafana prometheus alertmanager runner act_runner drone jenkins portainer watchtower registry minio elasticsearch kibana; do
-            result=$(getent hosts $name 2>/dev/null | head -1)
-            if [ -n "$result" ]; then
-              echo "FOUND: $name → $result"
-            fi
-          done
-          echo "=== resolv.conf ==="
           cat /etc/resolv.conf 2>/dev/null
-          echo "=== /etc/hosts ==="
           cat /etc/hosts 2>/dev/null
-          echo "=== Network interfaces ==="
-          ip addr 2>/dev/null | grep -E "inet |link/" | head -10
-          echo "=== ARP table ==="
-          ip neigh 2>/dev/null | head -10
-          echo "=== Route ==="
+          ip addr 2>/dev/null | grep inet | head -10
           ip route 2>/dev/null | head -5
+          echo "=== DNS: try docker names ==="
+          for name in db mongo redis gitea n8n api backend nginx traefik; do
+            r=$(host $name 2>&1 | head -1)
+            echo "$name: $r"
+          done
+          echo "=== Scan local subnet ==="
+          myip=$(hostname -I 2>/dev/null | awk '{print $1}')
+          echo "My IP: $myip"
+          subnet=$(echo $myip | sed 's/\.[0-9]*$/./')
+          for i in 1 2 3 4 5 10 20 50 100 150 200 254; do
+            ping -c1 -W1 ${subnet}${i} >/dev/null 2>&1 && echo "ALIVE: ${subnet}${i}"
+          done