Network scanning

The scanner discovers devices on IP ranges, identifies them, and (with credentials) collects their full inventory. Everything runs from the Steward IT Census server, and nothing is installed on the scanned devices.

Scan targets#

Scanning › Scan targets › Add scan target

Field	Description
Name	Any label, e.g. "Head office LAN".
IP ranges / hosts	One entry per line (or comma separated): a CIDR (`192.168.1.0/24`), a range (`10.0.0.10-10.0.0.50` or `10.0.0.10-50`), a single IP, or a host name. Prefix `!` to exclude (`!192.168.1.1`). Up to a /16 (65,536 hosts) per target.
	Entries can also come from your inventory, looked up again at every run: `ou:corp.local/Workstations` (enabled Active Directory computers in that OU and the OUs below it, by DNS name), `group:Finance PCs` (the members of an asset group), `type:Printer` (the active assets of a type), `report:<report ID>` or `report:sreport:<ID>` (the assets a built-in or saved report lists; the ID is in the report's address). They can be excluded with `!` too, e.g. `!type:IP Phone`. Assets found by another site's scanner are left out.
Schedule	Manual, hourly, every 4 or 12 hours, daily or weekly.
Credentials	Credentials for this target: only the ticked ones are tried here, after the ones mapped to each device. Global credentials are tried on every target anyway (shown grayed out); to use one only where you tick it, untick Global on the credential. A global credential set to known devices only can be ticked to use it on every device this target finds. Nothing ticked: mapped and global credentials only.

Quick scan scans a few hosts once without saving a target. Scan history shows each run: hosts alive, assets updated and any problems (login failures, license limit).

How a scan works#

Liveness: each address is probed on 47 common TCP ports. An open port or a refused connection proves the host is up, so no special privileges are needed. Hosts with every port filtered get a ping as fallback.
Identification:
- reverse DNS name
- MAC address from the server's ARP table (same subnet only) and its vendor from the built-in IEEE registry
- the title of any web interface
- the pattern of open ports
Deep inventory with matching credentials:
- WinRM on Windows (port 5985/5986 open)
- SSH on Linux/macOS/Unix (port 22)
- ONVIF on IP cameras and video recorders (a web port, or the credential's own port)
- Redfish on server management controllers (iLO, iDRAC, XClarity…; HTTPS port 443): see Server hardware health
- SNMP on anything that answers
When no credential works, the device's page shows The last scan couldn't log in with what the device answered to each credential tried (for example "access denied", a refused SSH key, or a camera's ONVIF fault), until a later scan logs in. SNMP is listed when the device answered with an error (wrong password, unknown user, wrong encryption password…), or when the SNMP credential is used only where it's mapped (so it was meant for that device), including "No answer". A global SNMP credential that a device simply ignores isn't listed: most devices don't answer SNMP.

Computers with a Census agent that reported in the last 24 hours are skipped here: the agent's inventory (taken as root/SYSTEM) is more complete than a remote login, and a scan would otherwise replace it. They still get the ping/port check. This includes the Census server's own computer when it's inside a scan range.
Asset matching: results are merged into existing assets by serial number, then MAC address, then name + domain, then IP. A device that changes IP (DHCP) stays one asset. A computer with several network cards or addresses stays one asset too: its inventory lists every network card's MAC address and address (on Windows also cards without an address), and a discovery of any of them finds the computer. If a scan found its other addresses before its first inventory, those discovery-only entries are merged into it at the inventory (the asset's history says so); entries you changed by hand are left alone.

Scan queue#

Scanning › Scan queue shows what Census is scanning right now:

Running on this server: each scan with its phase (discovery: checking which addresses answer; inventory: logging in to the devices that did), a progress bar, how long it has been running, and the addresses being inventoried at this moment with how long each has taken (a device that takes minutes usually has a slow or unresponsive WinRM/SSH service). Stop ends a scan; devices already scanned keep their results.
Remote sites: scans waiting for their remote scanner or running there. A scan the scanner hasn't picked up yet can be removed.
Scheduled next: when each scheduled scan target runs next.

Several scans run side by side; each checks up to 64 addresses at a time. Finished scans are under Scan history. Anyone can watch the queue; stopping a scan needs the Scan permission.

Ports probed#

21, 22, 23, 25, 53, 80, 81, 110, 135, 139, 143, 389, 443, 445, 515, 548, 554, 631, 636, 873, 1433, 2020, 2049, 3000, 3306, 3389, 5000, 5001, 5060, 5432, 5900, 5985, 5986, 8000, 8008, 8080, 8081, 8291, 8443, 8888, 8899, 9000, 9090, 9100, 9443, 10000, 62078, plus your custom ports.

Open ports are listed on each asset's Network tab, with an Open button for web interfaces and SSH / Remote Desktop / VNC links.

Custom ports#

To find a service the built-in list doesn't cover (a PLC on Modbus 502, a line-of-business application, a database on a non-standard port), add its TCP port under Scanning › Custom ports, with a name (＋ Add a port for each further one, ✕ to remove one). Every network scan then checks these ports on each address too, on this server and on remote scanners (version 0.71.0 or later), and so does Ping / check ports on an asset. A port counts as open when it accepts a connection; Census sends nothing to it.

Open custom ports appear with their name on the asset's Network tab, in the asset list's Open ports column and in the Custom ports open report (Reports › Network). For an email when a new device with one of these ports turns up, open that report and choose Alert me. Up to 100 ports; each one adds a connection attempt per scanned address, so list only the ones you care about. UDP ports can't be checked this way.

Device classification#

Discovered devices are typed automatically. For example:

Clue	Type
RPC (135), RDP (3389) or WinRM (5985/5986)	Windows
SMB (139/445) without Windows ports, or a FreeNAS / TrueNAS / Synology / QNAP web title	NAS
Printing ports (9100, 515) or a printer web title	Printer
SIP (5060) without SSH or database services	IP Phone
RTSP (554)	Camera
MikroTik Winbox (8291)	Router
SSH only	Linux
MAC vendor (e.g. Obihai, Polycom, Hikvision, Ubiquiti, Synology)	IP Phone / Camera / Access Point / NAS…
Host name such as `Galaxy-S24`, `Quest-3`, `Johns-iPhone`	Mobile Device / VR Headset…

Built-in device fingerprints#

Census also recognizes common devices by what they show without a login, from one built-in table (about 200 rules, no internet lookup): the SNMP device ID and description, the model a device announces over mDNS/Bonjour, its UPnP server name and DHCP vendor class (both heard by passive discovery), its web page title and web server name, manufacturers' default host names (for example NPI1A2B3C for HP printers, BRN… for Brother), and some ports (an iPhone's sync port, MikroTik Winbox). It names the manufacturer, the type and often the model: printers, NAS boxes, UPSs and PDUs, firewalls, routers, switches, access points, cameras, IP phones, server management controllers (iDRAC, iLO), hypervisors, smart TVs and media players, and IoT devices.

The evidence is listed on the asset's Summary tab under Recognized by. A fingerprint replaces the port-based guess above. For devices inventoried over SNMP, it only replaces a generic type (network device, Linux), unless it identifies the exact product from the SNMP device ID. Your own type rules, vendor types and types you set by hand always win.

Computers inventoried by WinRM, SSH or the agent use their real OS. You can refine classification with vendor types and rules and custom MAC vendors, or change any asset's type by hand.

Randomized ("private") MAC addresses#

Phones, tablets, smart TVs, VR headsets and many laptops use a randomized MAC address on Wi-Fi. These addresses belong to no manufacturer, so such devices show as Private MAC (randomized) unless their host name gives them away. Add an entry under Configuration › MAC vendors to name a specific device.

Remote sites and other subnets#

The scanner can scan any routed network, but MAC addresses are only visible on the server's own subnets. For other sites, install a remote scanner there: it scans the site locally (MAC addresses included) and needs no open ports at the site. Then choose the site under Scanned by on its scan targets. For roaming laptops, use the Census agent.

Virtual machines#

VMware vCenter/ESXi hosts are inventoried through their API rather than a network scan: see Virtualization. Hyper-V hosts report their VMs in their normal inventory.

Registry and file scanning#

You can have every computer read extra registry keys and files: a policy setting, the version of an in-house program, whether a configuration file exists. Define them under Scanning › Registry & file scanning (administrators). The Census agent and WinRM/SSH scans read them right after each inventory; computers pick up new items at their next inventory (use Rescan now to get a result immediately).

Scan	Path	Notes
Windows registry	`HKLM\SOFTWARE\Vendor\App`	Hives HKLM, HKU, HKCR and HKCC (64-bit view; give `WOW6432Node` paths explicitly for 32-bit programs). Value name empty = every value of the key, `(Default)` = the key's default value. Include subkeys reads up to 8 levels below.
Windows file or folder	`%ProgramFiles%\App\app.exe`	A drive letter or an environment variable such as `%ProgramFiles%`, `%SystemRoot%`, `%ProgramData%`. Network (UNC) paths aren't supported. Reports size, file version, company, description, product name, created and modified times.
Linux / macOS file or folder	`/etc/app/app.conf`	An absolute path. Reports size, modified time, owner and permissions.

* and ? match within one name: C:\Users\*\AppData\Local\App\app.exe, /home/*/.ssh/authorized_keys, HKU\S-1-5-21-*\Software\Vendor.
The agent runs as SYSTEM (root on Linux/macOS), so HKCU and %APPDATA% would mean the system account's own. Use the wildcards above for per-user locations. HKU only holds the hives of users who are logged on.
A key, value or file that doesn't exist is recorded as not found, so you can report computers missing something.
At most 100 enabled items, and 200 values or files per item and computer. Long registry data is cut at 2,048 characters; binary data is shown as hex.

Results are on the asset's Registry & files tab, in the Registry & files reports, and (click found / scanned) per item on the configuration page. With Track changes on, added, changed and removed values and files are written to the asset history (Changes › Registry & files). Turn it off for items that change all the time, such as log files. Changing an item's path or value discards its old results.

Requires Census agent 0.19 or later; older agents keep sending their normal inventory without these results. SNMP devices and discovered-only devices aren't scanned.

Passive discovery#

Scans run on a schedule, so a device that joins the network in between isn't known until the next scan. Passive discovery (Scanning › Passive discovery, off by default) closes that gap: the Census server and every remote scanner listen to what devices announce by themselves, and never send anything:

Once devices have been heard, the page shows a radar of the last 24 hours: each blip is a device (teal = in inventory, amber = not yet), the closer to the center the more recently it was heard, and blips that pulse were heard in the last five minutes. Point at a blip for its name.

Heard	From	Gives
DHCP requests	every device that joins the network or renews its address	MAC address, IP address, host name, a hint of the device type (e.g. `MSFT 5.0`, `android-dhcp-14`)
mDNS / Bonjour	Macs, iPhones, printers, Apple TVs, Chromecasts, smart speakers	host name, model
UPnP (SSDP)	TVs, media players, routers, NAS	the device's software name
ARP (Linux servers and scanners only)	every device talking on the segment	MAC and IP address

What happens with what's heard:

A device already in your inventory gets its last seen time updated, and its Summary tab shows when it was last heard on the network. A device is recognized by its MAC address wherever it's heard: a remote scanner on a computer with several networks also hears computers that belong to this server or another site, and they stay the assets they are.
A virtual machine heard before its Hyper-V or VMware host reported its network card is merged into the VM's asset at the host's next inventory.
A device Census doesn't know yet is added as an asset (with the vendor from its MAC address) and scanned right away with your credentials, at most once a day; the New asset discovered alert fires as for any new asset. Either can be turned off; then new devices are only listed.
Devices with randomized (private) MAC addresses (phones and tablets of visitors, mostly) are only listed, not added, unless you choose otherwise.
The list on the page shows every device heard, with what heard it and where; Not in inventory shows the unknown ones. The page updates itself: every few seconds while listeners are starting, then every 30 seconds.

Requirements and limits:

The server and scanners must run as administrator/root to listen to DHCP (port 67) and ARP, as the installed services do. A computer that is itself a DHCP server can't listen to DHCP requests; mDNS, UPnP and ARP still work.
Broadcasts don't cross routers, so each listener only hears its own network segments (VLANs). Put a remote scanner in the other segments, or add the Census server as a second DHCP relay target (an ip helper-address) on your router so it sees the requests of every VLAN.
ARP listening is Linux only; Windows servers use DHCP, mDNS and UPnP.
Firewall: on Windows, Census adds a Windows Firewall rule Steward IT Census - passive discovery while listening (inbound UDP 67, 1900 and 5353, for the Census program only) and removes it when passive discovery is turned off. Without it Windows Firewall silently drops everything the listeners would hear. On Linux, if ufw or firewalld is active, allow inbound UDP 67, 1900 and 5353 yourself; the Listeners list says when one is active.

Printer supplies#

Network printers scanned with SNMP report their supplies: toner and ink cartridges, drums, fusers, transfer units and waste toner boxes, with how much is left (for a waste box: how much room is left). They're shown on the printer's Summary tab, in the reports Printer supplies and Printer supplies running low, and the Low printer supplies alert (Configuration › Alerts & scheduled reports) emails a list on a schedule. Some printers only say a supply is "OK" without a level; those show as OK (level not measured). Levels are as fresh as the last scan of the printer, so scan printers daily if you rely on the alert. The same scans read the printers' page counters: see Printing for pages per month and cost per page.

Custom SNMP values#

Under Scanning › Custom SNMP values, add values that Census reads from every device it scans with SNMP: give each a name and a numeric OID (＋ Add a value for each further one, ✕ to remove one; up to 50), for example a printer's page count (.1.3.6.1.2.1.43.10.2.1.4.1.1) or a UPS's battery charge (.1.3.6.1.2.1.33.1.2.4.0). A single value is read directly; a table column is read as a list of up to 20 values. Devices that don't answer an OID don't show it. The values appear on the device's Summary tab and in the Custom SNMP values report. Remote scanners read them too (from 0.42.0).

MIB files#

To pick values by name instead of number, upload the device maker's MIB files under MIB files on the same page (several at once; a file may hold several modules). Then search under Find a value by name, by object name (upsEstimatedMinutesRemaining), module and name (ACME-UPS-MIB::battery), or a word from the description. Click Add, then Save. Census adds .0 for single values. Saved values show their MIB name under the OID.

Most makers' MIBs build on a base module of theirs (often called …-SMI, …-REG or …-PRODUCTS). Upload it too: the list says which modules are still missing. The standard roots (iso, enterprises, mib-2, …) are built in. MIBs are only used to name values; nothing is sent to devices. Deleting a MIB doesn't affect values already saved, because they are stored as numbers.

IP addresses#

Scanning › IP addresses shows the address ranges of your scan targets (their networks such as 192.168.1.0/24 and from-to ranges; single addresses and names are left out) and how they're used: per range the number of addresses, how many are in use (an active asset with that address was seen in the last 30 days), not seen lately (the asset hasn't been seen for longer: a candidate to reclaim) and free. Open a range for a map of every address (hover a cell for the asset, click it to open the asset), the list of used addresses with their assets and MAC addresses, and the free addresses grouped into runs. An address that several assets reported is marked, which points to an address conflict or a DHCP address that moved. Ranges of remote scanners only count the assets of their own site, since addresses repeat between sites. Ranges with more than 4,096 addresses show their totals only. Logins limited to some assets don't see this page.

Rescanning one asset#

Use Rescan now in an asset's left panel. If the asset has an online Census agent, it is asked for a fresh inventory immediately (this works for laptops anywhere). Otherwise the asset's IP address is scanned.