Scans and Settings
Scan depth, intervals, duration limits, and the settings that govern how a discovery runs.
Scanning Lifecycle
Discovery alternates between two scan depths on a configurable interval.
Light scans
Light scans focus on host and service discovery using a targeted port set — the ports defined in the discovery's port configuration plus any credential-specific ports (e.g., SNMP port 161). This is faster and sufficient for detecting new hosts and tracking port changes.
Deep scans
Deep scans perform a full 65,535-port TCP scan on each host. This catches open ports that aren't covered by the light scan's targeted port set.
Scan interval
The Full Scan Interval setting controls how often deep scans run — a value of 3 means every third scan is deep, with light scans in between:
| Setting | Behavior |
|---|---|
1 | Every scan is deep |
3 | Light, light, deep, light, light, deep, ... |
0 | Never deep scan (light scans only) |
You can also force a deep scan at any time from the discovery session controls.
Scan Settings
Everything that governs how a discovery scans, configured per-discovery rather than per-daemon, so one daemon can scan different networks at different rates:
| Setting | Required | Default | Description |
|---|---|---|---|
| Port Scanning | |||
| Port Scan Rate | Optional | 500 | Probes per second during port scanning. Lower values reduce network impact. |
| Port Scan Batch Size | Optional | 200 | Ports scanned concurrently per host. Range: 16-1000. |
| ARP | |||
| ARP Scan Rate | Optional | 50 | ARP packets per second during host discovery. Keep low on networks with strict switch policies. |
| ARP Retries | Optional | 2 | Additional ARP rounds for non-responsive hosts. Total attempts = retries + 1. |
| ARP Scan Cutoff | Optional | 15 | Interfaced subnets larger than this CIDR prefix are truncated during ARP scanning. Lower values scan more IPs — increase ARP Scan Rate accordingly for large subnets. |
| Use Npcap ARP (Windows) | Required | false | Use Npcap broadcast ARP instead of Windows SendARP. Requires Npcap installed. |
| Detection | |||
| Probe Raw Socket Ports | Required | false | Scan ports 9100-9107. May cause ghost printing on some printers. |
| Full Scan Interval | Optional | 3 | Run a full 65k port scan every N scans. Other scans use a lighter port set for faster results. Set to 0 for light scans only, 1 for every scan to be full. |
| Max Discovery Duration (seconds) | Optional | 21600 | Hard time limit for a single discovery run, in seconds (default 21600 = 6 hours). When reached, the run stops and any hosts not yet scanned are left for the next run. Raise this for very large networks that need a longer window. |
Run Types
| Type | Behavior |
|---|---|
| Scheduled | Runs automatically on a cron schedule (default: daily) |
| AdHoc | Manual execution only, for testing or one-time scans |
Discovery Duration
Duration depends primarily on the number of active hosts on the network, and will be estimated by the daemon during initial scan setup. You can view the estimated duration in Scans > Sessions
Factors affecting speed:
- Number of active hosts — more hosts means more deep scanning work
- Scan depth — deep scans take longer than light scans
- Network latency and host responsiveness
- Network prefix size — only a limiting factor without a Layer 2 interface, since the daemon must probe every IP individually via TCP
If scan time is longer than expected, see discovery takes hours.
Time limit
A single discovery run has a hard ceiling, set by Max Discovery Duration in Scan Settings.
A run that hits the ceiling completes rather than failing, keeping everything collected so far. Queued hosts are left for the next run, and the finished run warns how many were skipped and roughly how much time they needed.
Raise the limit for large networks that need a longer window. A run hitting it unexpectedly means the scan is slower than it should be — see discovery finished with hosts unscanned.