uControlScan Summary & Results
Scan Summary & Results
The Scan Summary feature provides a per-IP breakdown of every discovery scan, showing which hosts were successfully scanned, which failed, and which were excluded.
Scan Summary Progress Bar
On the Discovery Runs page, each completed scan shows a colour-coded progress bar in the Scan Summary column:
| Colour | Meaning | Description |
|---|---|---|
| OK | OK | Host was successfully scanned and asset data was collected |
| FAILED | Failed | Host was reachable but scanning failed (typically authentication) |
| EXCLUDED | Excluded | Host was skipped due to a global exclusion rule |
Below the bar, counts are shown (e.g., “28 OK · 3 failed · 2 excluded”).
Click the progress bar to open the detailed per-IP modal.
Scan Summary Modal
The modal shows every IP address that was part of the scan, with four columns:
Status Column
| Status | Colour | Meaning |
|---|---|---|
| OK | Green | Scan completed successfully for this host |
| FAILED | Red | Scan attempted but could not complete |
| EXCLUDED | Grey | Host was not scanned (global exclusion) |
IP Address Column
The IPv4 address of the host as discovered during the seed scan phase.
Host / Asset Column
Enriched from the asset database:
- FQDN or hostname (if resolved)
- Asset display name (if different from FQDN)
- Asset type badge (e.g., VIRTUAL_MACHINE, PHYSICAL_HOST, NETWORK_DEVICE)
Detail Column
Provides context on how the host was scanned or why it failed:
| Value | Status | Meaning |
|---|---|---|
| via hint | OK | Scanned using a cached scan hint from a previous successful scan. The hint stores the connector type and credential that worked last time, making subsequent scans faster. |
| via credential | OK | Scanned by matching credentials against open ports. The system tried connector types (SSH, WinRM, SNMP, etc.) based on detected open ports and found a working credential. |
| via seed-only | OK | Host was detected as live during the seed scan but had no recognisable management ports. Kept as an UNKNOWN_ENDPOINT asset with IP and open port data only. |
| Authentication failed | FAILED | Credentials were tried but all failed authentication. This could mean: (a) no valid credential exists for this host, (b) the account is locked/disabled, or (c) the host enforces strict auth limits (e.g., ESXi). The credential rotation system will try different credentials on the next scan. |
| No matching credentials | FAILED | Open ports were detected and connector types were inferred, but no configured credentials matched this host’s IP pattern. Add a credential with a matching IP pattern or use the “ALL” wildcard pattern. |
| Global exclusion rule | EXCLUDED | This IP is in the global exclusion list. It was detected as live during the seed scan but skipped during the credential/connector phase. To re-enable scanning, remove the exclusion from Discovery → Exclusions. |
Adding Exclusions from Scan Errors
When viewing the Scan Errors modal (click “Errors” on any run with errors), each error row has an Exclude button:
- Click Exclude next to any IP address
- A modal appears prompting for an optional description (e.g., “Gateway — not scannable”)
- Click Add Exclusion to add the IP to the global exclusion list
- The button changes to “Excluded” (green) confirming the action
- The IP will be skipped on all future scans
This is useful for hosts that consistently fail (e.g., network gateways, firewalls, or devices without supported management protocols) to reduce noise in scan results.
Scan Phases
A Smart Scan runs in two phases:
Phase 1: Seed Scan
- Probes all IPs in the target CIDR range(s) using ICMP and TCP SYN
- Identifies live hosts and their open ports
- Results:
scan_total(IPs probed),scan_responded(live hosts),scan_dark(no response)
Phase 2: Credential Matching
For each live host:
- Exclusion check — Skip if globally excluded
- Scan hint check — Try the cached connector/credential from last successful scan
- Port inference — Map open ports to connector types (22=SSH, 5985=WinRM, 161=SNMP, 8006=Proxmox, etc.)
- Credential rotation — Try matching credentials, rotating the starting position across scans to avoid lockout
- Circuit breaker — Stop after 2 authentication failures per host to prevent account lockout
Credential Rotation
When multiple credentials match a host and none succeed, the system rotates which credentials are tried first on subsequent scans:
| Scan | Credential Order |
|---|---|
| First scan | 1, 2, 3 (priority order) |
| Second scan | 3, 1, 2 (rotated after failures) |
| Third scan | 2, 3, 1 (continues rotating) |
This ensures all credentials are eventually tried without triggering account lockout policies.
- When a credential succeeds, the rotation resets and a scan hint is cached
- When a credential is updated (edited in the UI), rotation resets for all hosts so the updated credential is tried next
- When a credential test succeeds (from the Credentials page), the scan hint is automatically updated for that host