You wish to understand how the online status (green dot) is determined.
There are two methods used to determine online status:
- Heartbeat, which is nothing more than an ICMP packet sent from the console computer to the target.
- Inventory Scan. If you scan a computer that currently shows as offline (the absence of a green dot) but the attempted scan works, meaning the target was actually online, then the online status will change to a green dot.
- If your computers do not have ICMP Echo Request enabled (firewall or certain types of AV suite software) then they can appear offline but have their status change to online when they receive a successful scan.
- The Offline Status (Options > Preferences > Scanning) is important. If you have your Policy set to Ping before scanning then each scan attempt will first try to ping the target computer. If the target does not respond then the scan won't be attempted. If this is left unchecked then it will attempt to scan regardless of online status.
If you scan a computer and it shows online and then shortly after goes back to offline, the Heartbeat probably didn't receive the ping response in time. By default the Heartbeat will wait over 2 seconds for a response before moving on to the next computer. Slow response time can be linked to slow DNS resolution or network problems related to high latency.