Scan network

Scan network looks for SSH servers on the networks this computer is on, or on addresses you type, and adds the ones you pick as hosts. It’s the quick way to bring in a home lab: nas, pi-hole and proxmox in one go.

Start a scan

• On the Hosts page, press Scan network.
• Or in the Command Center, type scan and choose Scan the network for SSH servers.

The sheet says, before you start: “Vaulterm checks these addresses from this computer only. Nothing about your network is sent to Vaulterm or anyone else.”

Choose what to scan

Networks on this computer lists the networks Vaulterm finds on this computer’s network interfaces, such as 192.168.1.0/24, with how many addresses each has. Networks of 1,024 addresses or fewer start ticked. If this computer isn’t on a network Vaulterm can list, the sheet says so and you type the addresses instead.

Other addresses takes addresses separated by commas, in any of these forms:

You type	Scans
10.0.4.0/24	a whole network (the network and broadcast addresses are skipped)
10.0.5.10-60	10.0.5.10 to 10.0.5.60
10.0.5.10-10.0.6.20	everything between two addresses
10.0.6.7	one address

Ports: 22 is ticked. Add others under More ports, such as 2222, 8022. A scan checks at most 8 ports.

The button says how big the scan is, for example “Scan 254 addresses”.

The limits:

• Scans are IPv4 only.
• At most 4,096 addresses per scan. More than that and Vaulterm says “That’s 8,190 addresses; a scan checks at most 4,096. Pick a smaller range.”
• Over 1,024 addresses, Vaulterm asks first (“Scan 2,046 addresses? This can take a minute.”).
• A mistyped address says what’s wrong: "10.0.0.0/33" isn't an address, range or network.

What the scan does

For each address and port, Vaulterm opens a connection and waits for an SSH greeting: the line every SSH server sends first, such as SSH-2.0-OpenSSH_9.6p1 Ubuntu-3ubuntu13. A server counts as found when it sends one.

• Nothing is written to the server. Vaulterm doesn’t sign in, send a username or try a password.
• It checks 64 addresses at a time. Each gets 800 milliseconds to accept a connection and 2 seconds to send its greeting.
• A /24 network on port 22 usually takes a few seconds.

While it runs, the sheet shows progress (“120 of 254 checked”) and each server as it answers. Stop ends the scan and keeps what was found.

A scan stops after 1,024 servers and says “The scan stopped at 1,024 servers. Scan a smaller range to see the rest.”

Read the results

The scan opens as a dialog with a radar that sweeps while it runs and places each server as a blip, by its address. With reduced motion turned on in your system, the radar stays still.

Each server’s row fills in as Vaulterm learns about it:

Row	Where it comes from
Address	The address and port.
SSH	The greeting, such as “OpenSSH 9.6 · Ubuntu”.
Made by	The maker of its network card, from its MAC address. Virtual machines and randomised “private” addresses are recognised; a private address on a Docker bridge is a Docker container.
Device	A guess at what it is: Raspberry Pi, NAS, network device, Mac, server or PC, or virtual machine.
Name	A suggested name you can change. It comes from the device itself (nas.local), then from your router’s DNS, then from the device type. The row says which.

“Names come from your local network and your own DNS; nothing is sent anywhere else.”

Each row also shows the server’s MAC address, last and across the row, with a copy button. It says “Unknown” when this computer can’t see it, as for a server behind another router.

A server you already have says “Already in Vaulterm as nas” and can’t be ticked.

Networks

Networks on this computer shows each network as a card, named by its Wi-Fi name, or by its kind and router (“Wired · Ubiquiti router”). Vaulterm never asks for location permission to read Wi-Fi names. Rename a card by clicking its name; the name is remembered for that router (up to 64 networks).

Add the servers you want

1. Tick the servers you want, and change their names if you like. Select all servers ticks every one.
2. Choose how they sign in: one of your identities, New identity…, or Ask me each time I connect.
3. Press the add button, for example “Add 3 hosts”.

The new hosts go in a group called Found on the network, tagged found-on-network, in one step. Servers Vaulterm already has (same address and port) are skipped.

The dialog says how many were added, such as “Added 3 hosts.”, and Show them takes you to them.

From there, move them into your own groups and rename them as you like.

Spot a new device

To find something you’ve plugged in, such as a Raspberry Pi, a switch or a camera:

1. Scan the network as usual.
2. Plug the device in and give it a moment to start.
3. Press Scan again.

Anything that wasn’t there the first time shows at the top of its network, shaded and tagged New, and the status counts them (“Found 12 servers · 1 new”). The sheet reminds you: “Plugged something in? Scan again, and it shows up as New.”

• A device counts as the same one when its MAC address matches, or its address when either scan couldn’t see a MAC.
• Each scan is compared with the one before it, as long as both covered the same networks, addresses and ports and the earlier one finished. Closing the sheet forgets it.
• A device only shows up when its SSH server is on. Raspberry Pi Imager can turn SSH on before you first boot the card.

Watch for new devices

With Pro, Vaulterm can check a network for you every few minutes while it’s open, and tell you when a new SSH server appears, so you don’t have to remember to scan.

1. Open Scan network.
2. Under the network’s card, turn on Watch for new devices.
3. Choose how often under Check every: from 1 minute to 1 hour, 5 minutes unless you change it. One choice covers every watched network.

The sheet warns: “Only on networks you trust, like home or work: on public Wi-Fi, repeated scans can look like an attack.” Turn watching on one network at a time, only where you’re allowed to scan.

How it works:

• The first check of a network learns what’s there and says nothing. After that, each new SSH server is reported once.
• Vaulterm checks while it’s open, locked or not, and checks again soon after your computer wakes. Closing Vaulterm stops it.
• A watched network is recognised by its router, so watching only happens on that network. A network with no router to go by, such as a VPN or a Docker network, is recognised by its interface and range.
• A network over 1,024 addresses can’t be watched: its switch says “Too big to watch”.
• Under each watched card, the status says “Watching · last checked 10:42”, or why the last check didn’t work.
• While you scan by hand, the watch waits, and it learns from your scan too, so a device you’ve seen there isn’t reported again.
• Turning a network off keeps what Vaulterm knows about it, so turning it on again doesn’t report everything as new.

When something new appears:

• A notice in Vaulterm says “New on Home”, with the device’s name, address and what it runs. Add as host opens a new host with the name, address and port filled in, for you to choose how to sign in. A device you already have says “Already in Vaulterm as nas”. The × button dismisses the notice.
• If no Vaulterm window is in front, a system notification says so too, such as “New device on Home” or “3 new devices on Home”. Clicking it brings Vaulterm forward with the notice.

The first time you open Scan network after updating, a short window explains watching, with the switches right there. Press Done or Not now; it doesn’t show again. New installs see the same choice in setup.

Like a scan by hand, watching happens on this computer only. What it learns stays in Vaulterm’s data folder on this computer, and nothing is sent anywhere.

Good to know

• Only scan networks you’re allowed to scan. On a work or public network, a scan can look like an attack to whoever runs it.
• Servers that only allow connections from certain addresses, or that sit behind a firewall that drops unknown traffic, don’t show up.
• The scan never sees servers on other networks, such as ones reached through a VPN you aren’t connected to. Type their range under Other addresses if you are.
• Finding a server doesn’t trust it. The first time you connect, Vaulterm asks you to check its host key as usual.