Internal scans: troubleshooting
Scout probe statuses, unreachable networks, too few devices, empty Active Directory results and offline probes. What to check, and in which order.
- Updated October 12, 2026
- Verified on RECON v3.3.0
- 2 min read
- Watch 1:58
When a Scout probe does not behave as expected, always work in the same order: first look at what RECON tells you, then check the machine the probe runs on. This lesson covers the most common cases and how to fix them.
Summary
Every probe sends a heartbeat to RECON every 30 seconds. The status shown in Internal Probes tells you straight away whether you are dealing with a connection, network or configuration problem.
Chapters
Key points
- Probe statuses. If the last heartbeat arrived less than 90 seconds ago, the probe is Online. After 90 seconds to 5 minutes of silence it becomes Offline (recent), and after 5 minutes Offline. You can only start a scan while the probe is Online or Scanning.
- Unreachable network. A network marked Unreachable is one the probe cannot reach (a different subnet, or a firewall in the way). The most reliable fix is to install a probe on that segment.
- Fewer devices than expected. Usually the probe is scanning through a router, or an IDS, IPS or NAC is rate-limiting or blocking it. Add the probe host to those systems' exceptions. RECON flags this with the network statuses Throttled, Blocked, Partial or Coverage not established.
- No Active Directory results. Check that the domain controller is reachable from the probe on port 389 or 636, and that the collection credentials are valid. RECON shows the reason in the scan's Active Directory tab.
- Offline probe. On the probe host run
sudo systemctl status scout: the service must be active. Then test outbound HTTPS to RECON withcurl. If the connection fails, a firewall is blocking it: allow RECON's host name rather than a fixed IP. This is also the usual reason an installer cannot download the probe. - The installer refuses to start. Check the requirements: Linux, systemd and root privileges (via
sudo), on an x86_64 or ARM64 machine. - Uninstalling. An online probe uninstalls itself when you delete it in RECON. If it is offline, RECON shows you a command to run on the host to remove the agent.
Transcript
The full transcript of the video, in Italian, is in the player's Transcript tab.