Managing Scan Targets
How to control which subnets a daemon scans, including adding remote subnets and removing unwanted ones.
What a daemon scans by default
A daemon automatically discovers every subnet its host has a network interface on and adds them to its discovery. These interfaced subnets get fast Layer 2 (ARP) scanning. You can see a daemon's interfaced subnets on its card in Discover > Scan > Daemons.
Viewing and editing scan targets
To see exactly which subnets a daemon will scan:
- Go to Discover > Scan > Scheduled
- Find the discovery for the daemon
- The subnet list shows all targets for that discovery
You can add or remove subnets from this list to control what the daemon scans. Changes take effect on the next scan run.
Adding a remote subnet
A daemon can scan subnets it can route to but doesn't have an interface on. Add them to the discovery's subnet list.
If the subnet doesn't exist in Scanopy yet (because no daemon has reported an interface on it), create it first:
- Go to Assets > Subnets
- Click Create Subnet
- Enter the CIDR (e.g.
10.0.50.0/24) and assign it to the appropriate network - Return to Discover > Scan > Scheduled and add it to the discovery
Remote subnets are scanned via Layer 3 (TCP probing) since the daemon has no local interface for ARP. This means hosts without open ports won't be found, and MAC addresses won't be collected. For full Layer 2 coverage, deploy a daemon on the target segment — see Planning Daemon Deployment.
When to use remote scanning:
- Quick visibility into a remote segment before deploying a dedicated daemon there
- Small subnets with known services where Layer 3 discovery is sufficient
- Temporary scanning of a network you're evaluating
For permanent monitoring of a subnet, deploy a daemon on the segment for full Layer 2 discovery. See Planning Daemon Deployment to decide on your strategy.
Removing subnets
To stop scanning a subnet, remove it from the discovery's subnet list in Discover > Scan > Scheduled. The daemon will skip it on the next run.
This is useful for:
- Oversized subnets (e.g. a /16 when only a /24 has hosts) — remove the large one and add the smaller target
- Docker bridge networks (e.g. 172.17.0.0/16) — these are handled by Docker container discovery, not network scanning
- Decommissioned segments — remove subnets that no longer have relevant hosts