Scans on a board
An agent draws onto the one board it is attributed to. Everyone with that board open sees the sweep happen.
While a sweep runs, the board shows its progress — addresses probed, hosts alive, time elapsed, an estimate of what remains — and each host appears the moment the agent classifies it, at the position it will keep.
When the sweep ends, its hosts are merged into the board and saved as a new version, attributed to A scan. Everyone with the board open is told it changed and reloads it.
What a scan may change, and what it may not
Section titled “What a scan may change, and what it may not”A sweep keeps the board current without undoing anybody’s work.
| A sweep … | Never … |
|---|---|
| adds hosts it found for the first time | deletes a device |
| moves a device whose address changed (matched by MAC or id) | moves a device on the canvas |
| names a device still labelled with its own address | renames a device somebody named — it records what it saw beside it |
| updates what it measured: MAC, vendor, OS, services, ports, certificate expiry, round trip | touches descriptions, runbooks, owners, fields, notes, zones |
stamps lastSeenAt; counts missedScans on devices it did not see in the range it swept |
marks anything missed after a sweep somebody stopped |
| confirms an imported machine at the same address | creates a second device for it |
A device that has missed several sweeps is worth a look: it may have been retired, or may only be switched off. Deciding is a person’s job; the board never decides for you.
Several writers at once
Section titled “Several writers at once”A person’s save, a scan’s merge and an import can land on the same board at the same moment. Every write goes through one place that applies changes on top of the latest version, so a scan finishing while you edit does not overwrite your save, and your save does not undo the scan. If two people edit the same thing, the second save is told the board changed and gets the chance to reload. See working together.
Each sweep is a scan run with its counters and outcome — see concepts. The hosts a run found are kept for 24 hours; the run’s counters for 90 days. What the merge put on the board stays there, with its history.
Four numbers are kept apart on purpose: alive (addresses that answered), devices (hosts this run reported), what the agent says it found, and frames lost in transit. A run that lost frames or reconnected is reconciled at its end, so the board still gets everything.