I wrote a guide explaining how to use a network scanner on Qubes OS
https://dataswamp.org/~solene/2023-07-11-qubes-os-network-scanner.html
I'd be glad to read some feedback about it 🙂 especially for about the use of sys-net for the task.