> For the complete documentation index, see [llms.txt](https://docs.bountysecurity.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.bountysecurity.ai/burp-bounty-pro/passive-scan.md).

# Passive scanning

Find useful signals in requests and responses you have already captured.

Passive profiles inspect existing traffic. **Passive Request** checks inspect requests; **Passive Response** checks inspect captured responses. They do not inject payloads or fetch missing responses.

## Manual scan

1. Select exchanges in Burp.
2. Choose **Burp Bounty Pro → Local Scanner → Passive Scan**.
3. Select all passive profiles, a request/response category, or a tag.
4. Review the URL selection and passive processing settings.
5. Inspect **Scanners → Passive** and Burp's issues.

For server execution choose the same category under **Burp Bounty Server Scanner**. Pro uploads the exchanges and chosen profiles. Remote findings populate both Burp's issue system and the extension's Passive view; repeated polling should not create duplicate entries.

## Live passive scanning

Enable **Live Passive Scan** in **Settings → General** when you want to analyze observed traffic continuously. Review **Only in-scope items**, excluded extensions, excluded methods, Threads and Passive Concurrency. Turn it off when you no longer want automatic analysis.

These are processing controls, not an active scan RPS limit. Running passive checks on a response that was originally obtained by browsing remains passive analysis of that exchange.

## Common reasons for no findings

| Situation                            | Check                                                         |
| ------------------------------------ | ------------------------------------------------------------- |
| Request-only input                   | Response profiles need a response.                            |
| No applicable profiles               | Enabled state, scanner type and tag.                          |
| Match in the wrong component         | Request name/value selection or response header/body scope.   |
| Profile filter excludes the exchange | Status, content type and URL extension conditions.            |
| Results retrieval failed             | Inspect the error; a read failure is not an empty result set. |

For agent-driven passive analysis, see the [MCP examples](/burp-bounty-server/mcp-workflows.md).