Skip to content
DeviceQuest DeviceQuest DeviceQuest Docs User Documentation

Documentation

Scan types

Learn what each scan type collects, which credential it needs and which ports it uses.

Overview

Every scan target has a scan type that decides how DeviceQuest talks to it. This page explains each scan type: what it collects, the credential it needs, and the network ports that must be open between the scanner (the control plane or a bridge host agent) and the target. Use it to choose the right scan type for a target and to prepare firewall rules.

Summary

Scan typeTypical targetsCredential typePorts
SweepIP rangesNone (SSH, WMI or SNMP for follow-up)TCP 22, 80, 443, 3389, 8080 by default
SSHLinux, Unix, BSD, Proxmox hostsSSHTCP 22
WMIWindows, Hyper-V hostsWMITCP 5985 (HTTP) or 5986 (HTTPS)
SNMPSwitches, routers, firewalls, printers, appliancesSNMPUDP 161
VMwarevCenter Server, ESXiVMwareTCP 443
Hypervisor (Proxmox)Proxmox VE nodes and clustersProxmoxTCP 8006
CloudAWS, Azure and GCP accountsAWS, Azure or GCPHTTPS 443 to the provider APIs

Sweep

A sweep discovers which hosts are alive in an IP range and what services they expose.

  • Collects: each responding IP address and its open TCP ports. Every live host becomes or updates an asset.
  • Credential: none for discovery. To go further, give the schedule an SSH, WMI or SNMP credential, or assign default credentials to the assets.
  • Ports: TCP connect probes to 22,80,443,3389,8080 by default, 100 probes in parallel, with a 2-second timeout per probe. Change these with the ports, concurrency and probe_timeout_ms keys of a scan profile.

Authenticated follow-up. After the sweep, DeviceQuest starts a full scan of each discovered host that has a usable credential. The host’s own default credential takes precedence; otherwise the schedule’s credential is used. The follow-up uses the scan type that matches the credential type (SSH, WMI, SNMP, VMware or Proxmox). Follow-up scans appear under the sweep on the Results tab.

SSH

An SSH scan logs in to a Linux, Unix or BSD host and reads its inventory.

  • Collects: host name, operating system name and version, kernel version, CPUs, memory, disks, network interfaces, installed packages and running services. When the host is a Proxmox VE node, the scan also collects its virtual machines and containers.
  • Credential: SSH (username with a password or a private key).
  • Ports: TCP 22, or the port on the credential or the profile.
  • Host keys: on the first connection, DeviceQuest records the host’s SSH key. Later scans verify that the key is unchanged and stop if it differs, which protects your credentials against man-in-the-middle attacks.

WMI

A WMI scan reads a Windows host’s inventory over Windows Remote Management (WinRM).

  • Collects: computer system, BIOS and enclosure details (manufacturer, model, serial number), processors, physical memory, logical disks, network adapters, operating system, installed software and hotfixes, services, local user accounts and printers.
  • Hyper-V: when the host runs the Hyper-V role, the scan also lists its virtual machines. Each guest becomes a virtual machine asset linked to its host, and running guests with a known IP address get their own follow-up scan: WMI for Windows guests and SSH for all others.
  • Credential: WMI (a Windows account with remote WMI and WinRM access).
  • Ports: TCP 5985 (WinRM over HTTP) or 5986 (WinRM over HTTPS).
  • Where it runs: the control plane connects to WinRM directly. For Windows hosts in remote networks, select a Windows bridge host agent on the schedule.

SNMP

An SNMP scan polls network devices and other SNMP-enabled equipment.

  • Collects: system description, object ID, name, location and contact; vendor and model detection; interfaces; and, from the Host Resources MIB, CPU count and model, memory, storage and installed software.
  • Credential: SNMP, with a v2c community string or SNMP v3 user credentials (authentication and privacy).
  • Ports: UDP 161. Change retries and timeouts with the retries and request_timeout_seconds keys of a scan profile.

VMware

A VMware scan reads the inventory of a vCenter Server or a standalone ESXi host through the vSphere API.

  • Collects: datacenters, clusters, ESXi hosts, datastores and virtual machines, with their relationships (which VM runs on which host, which datastores it uses). Running VMs with a known IP address get a follow-up scan: WMI for Windows guests and SSH for all others.
  • Credential: VMware (a vCenter or ESXi account; read-only is enough).
  • Ports: TCP 443.

Hypervisor (Proxmox)

A hypervisor scan reads a Proxmox VE node or cluster.

  • Collects: cluster nodes, virtual machines (QEMU) and containers (LXC), with their resources and state. Running guests with a known IP address get a follow-up scan: WMI for Windows guests and SSH for all others.
  • Credential: Proxmox (an API token, or a username and password). The scanner uses the Proxmox REST API.
  • Ports: TCP 8006.

Cloud

Cloud discovery uses cloud connectors instead of scan targets. A connector uses an AWS, Azure or GCP credential from the Credentials tab and synchronizes resources on its own schedule.

  • AWS: EC2 instances, S3 buckets, RDS databases and IAM users, roles and groups.
  • Azure: virtual machines and other resources in the subscriptions the service principal can read.
  • GCP: Compute Engine instances and other resources in the projects the service account can read.

Set up connectors on the Cloud Resources page.