Skip to main content
Sherlock Suite

Product documentation

Which product are you working with?

Choose a product to see its guides and setup instructions.

All documentation

Network troubleshooting

Start with scanner contact, scan history, and the configured target ranges.

The executable closes or nothing seems to happen

First launch initializes the configuration. Run the executable again after setup to start its polling loop. Launch it from a terminal to see status and errors. Creating a scanner in the workspace does not start a local process. For continuous execution, use the unattended setup described in Scanner setup.

The scanner is disconnected

  • Confirm the process is running under the user who initialized it.
  • Check the selected configuration path, internet access, HTTPS connectivity, and system clock.
  • Check whether its token was replaced. Reinitialize with the new token if needed.
  • Stop duplicate processes using the same scanner configuration.

Do not share the token or paste configuration files into support messages. Provide the scanner version, platform, last-contact time, and a redacted error instead.

The scanner is connected, but there are no scans

Connectivity and discovery are separate. Enable recurring discovery, confirm a valid private range and schedule, then request a scan. Allow an active scan to finish and inspect Scan history for errors. Make sure the local process stays running.

Devices are missing from the inventory

Confirm the IP falls inside an enabled range. Check routing, VLAN isolation, firewall rules, and whether the target responds to the supported ICMP or TCP checks from the scanner computer. A device that blocks all checks may not be discoverable. No scan result guarantees that every device was found.

Vendor or OS information is Unknown

MAC addresses usually require local neighbor visibility. Routed devices may have no visible MAC, and private MACs do not have a reliable registered vendor. OS identification also needs supporting evidence. Check scanner version and optional SNMP availability; do not treat a guess as confirmed identity.

One device appears twice after an IP change

Identity uses an observed MAC within a scanner when available. Without MAC visibility, IP identity may create a new record. Different scanners can also report the same device separately. Compare scanner, MAC, and history before treating records as duplicates.

The map has no physical connections

The logical map works from discovery ranges and network definitions. Physical connection observations need supported equipment and successful optional SNMPv3 collection. Check the map's evidence and collection status. Logical subnet membership does not establish a physical cable.

The gateway or VLAN looks wrong

Check the network definition and gateway override. Local detection covers only the scanner's own network and expires after 24 hours. Define remote VLAN gateways explicitly. VLAN labels do not create scan scope or network connectivity.

SNMP information is unavailable

Confirm the device supports SNMPv3, its read-only user and authentication/privacy settings match the saved profile, and the scanner can reach its SNMP endpoint. Ensure the device is within configured scope. Inspect scan errors and snapshot times; an old snapshot is not a new successful read.

Still need help?

Contact the Sherlock team with the affected view, platform, scanner version, time of the issue, and a redacted error. Never include tokens, passwords, or SNMP secrets.