Service Detection

How Scanopy identifies services and what to do when detection fails.

Scanopy automatically identifies 200+ services during network discovery. This page explains how detection works and what to do when a service isn't detected.

For the complete list of detectable services and their match patterns, see scanopy.net/services.

Why Wasn't My Service Detected?

First check whether the service is in the detection list at scanopy.net/services. If it isn't, request it. If it is, one of these usually explains it:

Cause	What to do
Non-standard port — patterns are written for the default port, so Grafana on 8080 is never probed for Grafana's endpoint	Move it to the default port, or add the service by hand
Service requires authentication — a 401/403 before the response body is readable defeats endpoint matching	Nothing, for most services. Some (Plex) have patterns that work around it
Container doesn't publish a port — containers on internal bridge networks aren't reachable by scanning	Enable container discovery, which reads the API directly
Firewall blocking the daemon	Allow the daemon to reach the service's port
Raw socket port (9100-9107) — skipped by default, because these ports treat any TCP data as print input and probing them ghost-prints on JetDirect printers	Enable Probe Raw Socket Ports in scan settings. Affects Prometheus Node Exporter on 9100

How Detection Works

Detection happens in phases:

Port scan — Find open TCP and UDP ports
Endpoint probing — Send HTTP requests to known paths
Pattern matching — Compare results against service definitions

Each service has a detection pattern that specifies what to look for. Patterns can include:

Check	What It Does
Port	Is a specific port open?
Endpoint	Does the HTTP response body contain a string?
Header	Does an HTTP header contain a value?
MAC Vendor	Does the device's MAC address belong to a vendor?
Gateway	Is this IP in the daemon's routing table?
Managed Device	Does a network controller report this device as a given type?

Patterns can be combined with AllOf (all must match) or AnyOf (any can match).

Managed Device is the one check that doesn't come from probing the device. When a daemon reads a network controller's inventory, the controller states what each adopted device is, and that statement is matched like any other evidence — which is how UniFi Switch and UniFi Gateway are identified.

Example: Pi-hole

Pi-hole's pattern requires:

DNS port open (53/tcp OR 53/udp) AND
HTTP response from /admin contains "pi-hole"

Both conditions must be true for Pi-hole to be detected.

Example: Plex

Plex's pattern accepts either:

HTTP response from port 32400 /web/index.html contains "Plex" OR
HTTP response has X-Plex-Protocol header

Either condition is sufficient.

Confidence Levels

Each detected service has a confidence level indicating match strength.

Level	Meaning
Certain	System services only (Scanopy Daemon, Docker Daemon)
High	Strong match — endpoint content or header matched
Medium	Moderate match — MAC vendor or unique port
Low	Weak match — common port, could be multiple services
N/A	Generic service — definitional match (port 53 = DNS)

Generic Services

Some services are generic — they're defined by their port alone:

Port 53 → DNS Server
Port 5432 → PostgreSQL
Port 22 → SSH

These show "N/A" confidence because there's no uncertainty. Port 53 is DNS by definition. If you're running a specific DNS server (Pi-hole, AdGuard), it will be detected separately with its own pattern.

Improving Detection

Use default ports — Detection patterns are written for standard ports. Check scanopy.net/services for which port each service expects.

Use Docker scanning for containers — Docker container discovery inspects the Docker API directly, so it works for containers on internal networks without port exposure. It's more reliable than network scanning for containerized services.

Requesting New Service Detection

If a service isn't detected:

Check existing definitions at scanopy.net/services
Report a detection issue if Scanopy should have detected it but didn't: Service detection issue
Request a new service if it's not in the list: Missing service request

When requesting, include:

Service name and what it does
Default port(s)
Any unique HTTP endpoints or headers
How you currently identify it

On this page