Rescans
A new scan replaces the data of the hosts in the VLAN. The map shows the last scan only.
Each scan replaces the data of the hosts in the VLAN. The server does not add the connections of a new scan to the old ones, so the map shows the network as the last scan saw it.
What the server does with each address
| Result of an address | What the server does |
|---|---|
Collected (ok or partial) | Replaces the data of the host. Keeps the display names, the internet facing settings and the manual tag. |
SSH failure (auth_failed, hostkey_changed, error) | Keeps the last data of the host and marks it stale. |
No answer on the SSH port (no_ssh) | The host leaves the VLAN. A host that is in no VLAN is deleted. |
Why a failure keeps the data
A wrong key or a timeout tells nothing about the services of the host. If the server deleted the host, one bad credential could empty the map of a complete VLAN. The host stays, marked stale, until a scan collects it again.
Why no answer deletes the host
No answer on the SSH port means that the host is off or gone. Its old connections would show calls that do not occur any more. The server removes it, and its display names and manual tag go with it.
Why an incomplete scan changes nothing
The collector sends a report only after it scans the complete VLAN. Press Ctrl-C in the middle, or let the collector fail, and nothing goes to the server. No host is deleted.
Short connections
The collector reads the sockets a few times during the scan. A connection that opens and closes between two samples can be missing. Because a rescan replaces the data, a connection that did not occur during the last scan is not on the map. Scan at regular intervals, and increase the number of samples for VLANs with short connections. See Schedule scans.