Scan Methods

The Discovery Scans page lets you launch network scans to find devices. Click New Discovery to open the scan form, which has four tabs.

1. Subnet Scan (Ping Sweep)

Sends ICMP echo requests to every host in a network range to find live devices. This is the fastest and broadest scan method — use it for general device discovery.

Options

Intensity Levels

OS Fingerprinting (TTL Analysis)

When enabled, the scanner examines the TTL value of ping responses to estimate the OS:

Notes

• Ping sweep only finds devices that respond to ICMP echo. Devices with ICMP disabled (firewalled) will not appear.
• On macOS, the ping -W flag takes milliseconds; on Linux it takes seconds. The scanner handles this automatically.

2. Active Directory (LDAP)

Queries an Active Directory Domain Controller via LDAP to enumerate computer objects. Useful for discovering domain-joined Windows machines that may not appear on the network scans.

Options

What It Discovers

For each computer object found, the scanner reads:

• cn (Common Name)
• dNSHostName (FQDN)
• operatingSystem and operatingSystemVersion
• whenCreated, lastLogonTimestamp
• distinguishedName

3. Single IP

Deep inspection of a single device. The scanner is selected based on the anticipated device type.

Options

Anticipated Types

Requirements

• WMI Scanner: Requires pywinrm package and WinRM enabled on the target Windows host
• SSH Scanner: Requires paramiko package and SSH access to the target

4. SNMP

Queries devices via SNMP (Simple Network Management Protocol) to discover network equipment like routers, switches, and managed devices.

Options

SNMP Versions

What It Discovers

The scanner queries two OIDs on each host:

• sysDescr (1.3.6.1.2.1.1.1.0) — System description (hardware/software info)
• sysName (1.3.6.1.2.1.1.5.0) — System hostname

Devices that respond are classified as network_device type.

Important Notes

• SNMP must be enabled on the target device. Most consumer routers and devices ship with SNMP disabled. You need to enable it in the device’s admin interface.
• The community string must match what is configured on the device. If public doesn’t work, check the device’s SNMP settings.
• Maximum 1024 hosts per scan to prevent runaway scans.
• Hosts are scanned concurrently (20 at a time for medium intensity), so a /24 subnet completes in about 1 minute.

When to Use SNMP vs. Ping Sweep

Scan Lifecycle

All scans go through these states:

pending → running → completed
                  → failed
                  → cancelled

Scan Page Actions

Live Progress

Click on a scan to open its detail page. Active scans show real-time progress via WebSocket updates, including:

• Progress percentage
• Items discovered as they are found
• Completion or failure status