Network Scanning & Reachability does two jobs that most vulnerability programs quietly get wrong. It finds the hosts sitting on your networks that nobody registered, and it proves, host by host and with evidence, whether your vulnerability scanner actually reached each target it was told to scan.
The problem
A scan report is a list of what the scanner could see. It is not a list of what you asked it to look at. When a host was powered off, when a firewall dropped the probe, when a routing change put a subnet out of reach, or when the scanner simply timed out, the report does not carry a warning. It carries fewer rows.
Nothing in a standard report distinguishes “this machine was scanned and is clean” from “this machine was never touched.” Teams read a green dashboard, file it, and find out months later that the one box nobody could reach was the one that mattered.
The inventory side is just as fragile. Your asset list is built from the machines that have an agent, plus whatever someone typed into a spreadsheet. The IP camera on the CCTV VLAN, the NAS in the branch office, the old domain controller that was never decommissioned: none of them appear. The usual workaround is an engineer running nmap by hand every few months, pasting the output into a file, and eyeballing the difference. That is slow, it is not repeatable, and the result never reaches the people making risk decisions.
How it works
- You define the networks once
You save the VLANs and subnets you own as a list in settings. If that list is empty, SITEY derives /24 networks from the IP addresses of your installed agents as a fallback, so discovery still works on day one. Only private ranges (RFC 1918) are accepted for those derived networks, so loopback, link-local, multicast and public addresses are rejected and a typo cannot point a sweep at the internet.
- Nmap sweeps and profiles each subnet
Each subnet gets a host-discovery pass, and subnets are swept in parallel. Every host that answers is then profiled for open TCP ports and service names. You pick the depth per run: Fast (a curated common-port set), Balanced (adds service and version detection), Deep (a wider port range including management and IoT ports, with full version detection), or Deep + UDP (adds a UDP top-ports pass). An operating-system fingerprint is attempted separately as a best-effort step. The whole sweep runs as a background job with an id you can poll, so closing the browser does not kill it. A scheduled sweep also runs in the background, hourly by default, and can be switched off.
- Hosts are classified, and managed is separated from unmanaged
Each discovered host is classified from its OS signature and open ports into windows, linux, switch, camera or other. The port list deliberately covers camera and NVR services (RTSP, Hikvision, Dahua, XMEye and similar) that generic scans skip entirely. IP addresses that belong to a machine where you already run an agent are taken out of the discovered list and used instead to enrich that agent’s record with its ports, hostname and OS. Likely Active Directory infrastructure is flagged separately: a host answering on Kerberos, Global Catalog, or LDAP together with SMB is listed as a domain-controller candidate, with the reasons shown and a domain name inferred from reverse DNS.
- A pre-flight check runs before the scan
When a scan is launched through the OpenVAS flow, every target is probed independently of the scanner first: ICMP ping, TCP connect attempts against the ports that matter for that particular scanner, and a traceroute where that tool is present on the server. Traceroute is run only for hosts that already look troubled, so you collect evidence without generating noise. Two policies are available: mark the problem hosts and scan anyway (the default), or exclude them from the scan and record why. The same check is available as an endpoint you can fire at any list of IPs before you commit to a maintenance window.
- The finished report is reconciled against the target list
After the scan, the report is parsed per target IP: did this host appear in the report at all, did it get a scan start and end, and how many reportable findings did it produce (log and informational entries excluded). A target that never appears becomes not scanned and is raised as critical. A target that was scanned and produced nothing becomes scanned clean and is marked informational. That one distinction is what stops a coverage gap from being read as a healthy host.
- Root cause, fix steps, and a verify button
Each problem host is given a state, a severity, and a root-cause code: host down, firewall or ICMP filtering, scanner ports closed, routing or VLAN issue, or absent from the report. Each diagnosis comes with a short summary and numbered remediation steps. The underlying evidence is stored and shown: the ping result, the per-port TCP results, and the traceroute hops. Every check is appended to a timestamped history. When the network team changes a rule, you press Verify Resolution, the probes run again, and if the host is now clear the problem closes itself with a resolution timestamp.
What you can do
Sweep one subnet or all of them, on demand or on a schedule, and keep working while the job runs in the background.
Choose scan depth per run (Fast, Balanced, Deep, or Deep + UDP) instead of paying the cost of a deep scan every time.
See each discovered host with its hostname, open TCP ports and detected services, OS guess, device type, and the VLAN it was matched to.
Keep unmanaged hosts and agent-managed hosts apart automatically, and have discovery feed port/OS data back into the agent records.
Identify probable domain controllers and AD services from their port signature, with the reasoning shown rather than hidden.
Surface IP cameras, NVRs and network devices that agent-based inventories structurally cannot see.
Pre-flight any list of IP addresses before a scan window and find out which ones will not answer.
Read, for any host, a plain-language root cause and a numbered list of what to change, not a raw packet dump.
Inspect the raw evidence behind that diagnosis: ping result, per-port TCP state, traceroute hops, and the full check history.
See exactly which targets a completed scan failed to cover, grouped into not scanned, unreachable, partial, excluded and scanned clean.
Re-verify a host after a firewall or routing fix and have the issue close with a timestamp you can point at later.
Hand an access problem to the built-in AI assistant with the evidence attached, and get manual steps when the host has no agent on it.
Export the asset and discovered-host board, including device type and open ports, as a spreadsheet file.
Who it is for
Get an answer to the question that usually takes an afternoon: was this host actually scanned, or did we just not see it?
Get a root cause and specific steps instead of a ticket that says “scanner cannot reach 10.20.3.44.”
Get scan coverage as a measurable number rather than an assumption.
Get visibility into the part of the estate that has no agent and therefore never appeared in any report.
Get a per-scan coverage breakdown and, for each problem host, a timestamped check history showing when the access gap was opened and when it was closed, kept in the product instead of in somebody’s memory.
Why it matters
Unscanned hosts are not neutral.
They are the ones your report is quietest about. A vulnerability program that cannot tell coverage from cleanliness reports a risk number that is wrong in the one direction you cannot afford. Making that gap visible converts an invisible assumption into a short, closable worklist, and the verify loop means each item is closed with proof rather than with someone’s recollection that they fixed the firewall.
The discovery half changes what the rest of the platform is working from. Every host found here becomes a candidate for scanning, scoring and remediation in the phases that follow, so your remediation clock starts on your real estate, not on the part of it that happened to have an agent. And the time saved is concrete: subnet sweeps, device classification and reachability triage that were manual, irregular and undocumented now run on a schedule and leave a record behind.
Works with
- Asset Inventory: discovered hosts become durable inventory records with their ports, OS and last-seen date.
- Scan Management: pre-flight results and post-scan coverage warnings appear directly on the scan.
- Attack Surface Management: the discovered-host board is where sweeps are launched and the results reviewed.
- Agent Management: access-problem badges sit on the agent list and agent detail pages, next to the machines they concern.
Frequently asked questions
Do I need to install anything on the hosts being discovered?
No. Discovery and the reachability probes all run from the SITEY server using nmap, ICMP, plain TCP connections, and traceroute where the system tool is available. Agents are optional; where a host already has one, discovery enriches that agent’s record instead of listing the machine as unknown. Nmap does need to be present on the SITEY server for network discovery, and a built-in diagnostics API endpoint reports whether it was found and which path it resolved to. The reachability probes do not depend on nmap.
Which scanners can its coverage checking reconcile?
The reconciliation layer is adapter-based, and the adapter shipping today reads OpenVAS/GVM report XML, which is also the scan flow the automatic pre-flight is wired into. The independent probes themselves are scanner-neutral and carry critical-port profiles for OpenVAS, Nessus and Nmap, selected by the scanner you name when you call the pre-flight endpoint directly. Report-level reconciliation for an additional scanner means adding an adapter for that scanner’s report format.
Can a failed or empty sweep wipe out my inventory?
No, and this is deliberate. A sweep that fails or returns nothing writes nothing at all. Results are merged into existing records by IP address, hosts that were not seen in a given run are kept with their previous last-seen date so you can judge staleness yourself, and an empty field in a new result never overwrites a value you already had.
How much noise does this put on the network?
You control it. UDP scanning is off by default and only available in Deep mode. Timing, retry counts, packet rate limits, per-host timeouts and how many subnets and hosts are probed at once are all configurable for your environment, and traceroute only fires for hosts that already look unreachable rather than for every target.
SITEY installs in your own infrastructure, so your network map, your host inventory and your scan evidence stay on your servers. Only license activation talks to us.
See pricing to get the installer and run your first sweep.