What to check if the Explorer finds ICMP responses, but no services

If you are running a Windows-based Explorer (or the standalone command-line scanner), it's possible for the Explorer to detect ICMP responses, and sometimes UDP, but be unable to scan any TCP-based services.

This can happen if the Explorer is unable to load the npcap driver, or if the npcap driver is too old or otherwise broken. If this is the case, you can upgrade the driver by following the procedure in How to upgrade npcap for the runZero Explorer on Windows.

Another possible cause of the issue is if the npcap driver could not be loaded. This can occur if the Explorer is not running with admin rights, or if other software on the system such as EDR prevents it from loading.

In particular, there is an incompatibility between runZero scanning and the Trellix endpoint tools. Trellix will not log that it is blocking the traffic, but setting Trellix HIDS to "monitor" instead of "block" can get around the problem.