Scan Settings & Engine Tuning
All discovery policy lives under Settings → SCANNING (Admin role on Business appliances). Portable builds use the same tab for scopes and engine tuning during a session.
This page documents what each control does and when to change it. For how protocols work under the hood, see the Discovery pipeline. For adapter roles and the header quick-switch, see Network control.
Where to find it
- Log in as Admin.
- Open Settings from the main navigation.
- Select the SCANNING tab.
- Click COMMIT ENGINE CHANGES after editing scopes or engine sliders (changes are not auto-saved).
Network scopes
Each scope is one row: a CIDR range plus optional NIC binding and reporting labels.
| Field | Purpose |
|---|---|
| CIDR | Subnet to sweep, e.g. 192.168.1.0/24. Add multiple scopes for VLANs or routed segments where a local Node can reach hosts. |
| BIND TO NIC | Which adapter sends probes for this scope. Auto-Detect uses the NIC assigned the Discovery Fallback role on the Interfaces tab. |
| VLAN OVERRIDE (optional) | Fleet reporting label only (not 802.1Q tagging). Overrides the adapter default VLAN label from Interfaces when set. |
| Protocol chips (PING / ARP / mDNS / UPnP) | Enable or disable discovery methods for this scope only. See table below. |
On first launch, onboarding usually adds your detected local subnet automatically. Edit or add scopes here when you expand to guest Wi-Fi, AV VLANs, or additional routed networks.
Per-scope protocol toggles
Click the colored chips on each scope to turn protocols on or off.
| Protocol | What it does | When to disable |
|---|---|---|
| PING | ICMP reachability and latency baseline. | Rarely. Needed for Layer-3-only paths where ARP is unavailable. |
| ARP | Layer-2 presence and MAC capture on the local segment. | Remote subnets across a router (Layer-3 only). MAC/vendor may stay empty (expected). |
| mDNS | Bonjour/Zeroconf friendly names (Apple TV, printers, IoT). | Noisy multicast environments where you only want ping/ARP inventory. |
| UPnP | SSDP-based device hints on consumer and AV gear. | Strict networks that block SSDP multicast. |
Engine performance
The right column of the SCANNING tab controls sweep timing and stability behavior. Defaults suit most
/24 home and office LANs.| Control | Default | What it controls |
|---|---|---|
| POLLING | 60s (1m) | How often the UI refreshes and the engine runs a full sweep cycle. Presets: 5s, 10s, 30s, 1m, 5m, 15m, 30m, 1h. |
| PARALLEL PINGS | 256 | Concurrent ping workers during a sweep. Raise on large subnets; lower on fragile links or CPU-limited Docker hosts. |
| TIMEOUT (ms) | 200 | Per-ping wait time. Increase on high-latency VPN or Wi-Fi paths. |
| RETRIES | 0 | Extra ping attempts before counting a miss. Use on flaky DHCP or congested wireless. |
| STRIKES | 3 | Consecutive missed cycles before a device shows offline. Higher values reduce flap; lower values surface outages faster. |
| INSTANT RECOVERY | On | Mark a device online on the first successful ping after it was offline. Turn off to require multiple good cycles before recovery. |
| DEEP SCANNING | Off | Global enable for Nmap-based Deep Scan. Requires Nmap (and on Windows, Npcap). See [Optional Deep Scan](/docs/installation#optional-deep-scan). |
These settings interact with flap detection and stability scoring: strikes and instant recovery shape how quickly status changes propagate to the grid and alerts.
Deep Scan engine status
Below the performance sliders, the DEEP SCAN ENGINE panel shows readiness for the local Node (or the selected fleet Node on a Hub):
- NMAP ENGINE: green when
nmapis on the PATH and usable. - NPCAP / LIBPCAP: green when packet capture is available (Npcap on Windows, libpcap on Linux/macOS).
If Nmap is missing, discovery still runs; only per-device Deep Scan is disabled. See Troubleshooting: Deep Scan unavailable.
Hub fleet scan governance
On a Central Hub, the SCANNING tab becomes fleet engine governance. The Hub does not scan local subnets; it pushes policy to enrolled Nodes.
| Control | Behavior |
|---|---|
| SELECT TARGET NODE | Edit one Node's stored scan policy, or choose Apply to All Active Fleet Nodes to broadcast. |
| COMMIT ENGINE CHANGES | Writes scanSettingsJson to the Node record. Offline Nodes apply policy on next check-in. |
| Node adapter list | Populated after the Node syncs interfaces (~10s refresh while this tab is open). Bind scopes once NICs appear. |
| DEEP SCAN ENGINE (per Node) | Read-only status from the Node's last sync. Use to verify Nmap/Npcap on remote sites without RDP. |
Broadcast mode overwrites scanning configuration on every enrolled Node. Use per-node targeting when sites have different subnets or adapter layouts.
For alert and SIEM governance from the Hub, see Fleet governance on the federation guide.
Linux multi-NIC routing check
On Linux hosts with multiple adapters, the SCANNING tab may show a Multi-NIC Linux Routing Check banner when reverse-path filtering blocks probes from the expected interface.
Recommended fixes appear in the banner (typically
rp_filter sysctl commands). For Docker hosts, set STACKSATLAS_APPLY_RP_FILTER=1 on privileged containers or run scripts/linux-host-init.sh on bare metal.When to tune what
| Symptom | Try adjusting |
|---|---|
| Devices flap online/offline | Increase STRIKES; consider disabling INSTANT RECOVERY; review [flap detection](/docs/discovery#flap-detection). |
| Slow to notice new devices | Lower POLLING interval (e.g. 30s or 10s). |
| High CPU or Docker host struggling | Lower PARALLEL PINGS; raise POLLING interval. |
| VPN devices always timeout | Raise TIMEOUT (ms) and RETRIES. |
| Wrong device count on Docker | Confirm host networking, not bridge mode. See [Docker troubleshooting](/docs/troubleshooting#ghost-ping--wrong-device-counts-bridge-network). |
| No MAC or vendor (Windows) | Install Npcap. See [Windows troubleshooting](/docs/troubleshooting#2-windows). |
| No MAC on remote VLAN | Expected Layer-3 behavior. Deploy a Node on that VLAN or use Deep Scan. [Layer-3 discovery](/docs/troubleshooting#layer-3-discovery). |
| Deep Scan button disabled | Enable DEEP SCANNING toggle; install Nmap per [installation guide](/docs/installation#optional-deep-scan). |
| Fleet Node not adopting Hub policy | Confirm Node is ONLINE; use COMMIT on Hub; check Node logs if offline >15 min. |
Header adapter vs SCANNING tab
| Surface | Best for |
|---|---|
| Header adapter badge | Quick switch of the active discovery NIC for single-subnet portable use. |
| SCANNING → scopes | Durable policy: multiple CIDRs, per-scope NIC binding, protocol toggles, engine tuning. |
| INTERFACES tab | Traffic roles (Discovery, Hub Sync, etc.) and default VLAN labels per adapter. |
Related guides
- Discovery pipeline: what each stage does
- Network control: adapters, VLAN labels, WoL, RDP/SSH
- Hub & fleet federation: enrollment, governance, scan push
- Troubleshooting: firewall, Docker, Npcap, Layer-3
- Debug mode: verbose sweep logging on the Logs page