The scanner shows up in Windows but vanishes on Fedora
You plug your scanner into a USB port, open Simple Scan, and the window stays empty. The device manager lists the hardware, but the scanning software acts like it does not exist. You try a different cable, reboot, and check the router. Nothing changes. This is a common friction point on Fedora. The hardware is fine. The kernel sees it. The gap is in the userspace stack that translates USB signals into image data. A misconfigured daemon, a missing backend package, or a strict security policy will silently drop the connection. Run the diagnostic steps below before you start swapping cables or reinstalling the desktop environment.
What is actually happening under the hood
Fedora does not ship a monolithic scanning driver. It uses SANE, which stands for Scanner Access Now Easy. SANE splits the work into two distinct layers. The kernel handles the raw USB or network communication through standard device drivers. The userspace daemon, saned, loads a backend module that speaks your specific scanner protocol. If the daemon is off, if your user account lacks permission to talk to the USB bus, or if the correct backend package is missing, the application layer receives zero data. Think of it like a translator at an airport. The plane lands safely. The customs officer is present. But without the right language guide, nobody knows how to unpack the cargo.
Fedora also enforces strict access controls. The scanner group grants read-write access to /dev/bus/usb. SELinux watches the daemon and blocks it from touching device nodes that do not match the expected policy. Network scanners add another layer. The firewall drops traffic on port 6566 by default. You have to open the port and tell the daemon to listen. Config files in /etc/sane.d/ are user-modified. Files in /usr/lib64/sane/ ship with the package. Edit /etc/. Never edit /usr/lib64/. Manual file edits drift across updates, while package-managed files stay consistent.
Check the daemon state before you touch configuration files. Half the time the service is simply masked or failed after a kernel update.
Get the hardware recognized
Start with the service and permissions. The saned unit must be active before any GUI or CLI tool can query the hardware. Enabling it with --now starts it immediately and ensures it survives a reboot.
sudo systemctl enable --now saned
# WHY: Starts the SANE daemon immediately and registers it for boot.
sudo usermod -aG scanner $USER
# WHY: Adds your account to the group that owns the USB device nodes.
# WHY: Group membership is evaluated at login. A logout and login cycle applies it.
Log out of your desktop session and log back in. Group changes do not apply to running processes. Once you are back at the desktop, check whether the kernel actually sees the device.
lsusb | grep -i scanner
# WHY: Lists USB devices and filters for scanner keywords.
# WHY: Confirms the kernel enumerated the hardware before userspace tries to claim it.
dmesg | tail -n 20
# WHY: Shows recent kernel ring buffer messages.
# WHY: Look for USB connection events or driver binding failures.
If lsusb shows the device but dmesg reports a power fault or a bus error, move the cable to a motherboard port. USB hubs and front-panel connectors frequently drop voltage under load. Scanners draw more current during the calibration phase than during idle. A direct port eliminates the power variable.
Next, install the correct backend. SANE relies on separate packages for different manufacturers. The base sane-backends package covers generic TWAIN and some older models. Modern hardware needs the vendor-specific extension.
sudo dnf install sane-backends
# WHY: Installs the core SANE framework and common backends.
sudo dnf install sane-backends-hpaio
# WHY: Adds HP-specific protocol support and firmware loaders.
# WHY: Replace hpaio with canonic, epkowa, or pixma depending on your brand.
Run dnf search sane-backends if you are unsure which package matches your model. The package descriptions list supported hardware families. Install only the one you need. Extra backends increase the attack surface and slow down device enumeration.
Verify the service is running before you move to network configuration. A stopped daemon will mask every other symptom.
Configure the backend and network access
Local USB scanners work once the backend is installed. Network scanners require explicit firewall rules and a shared configuration file. SANE uses port 6566 for both TCP and UDP traffic. The firewall daemon blocks inbound connections by default. You must add the port to the permanent configuration and reload the runtime rules.
sudo firewall-cmd --permanent --add-port=6566/tcp
# WHY: Adds the TCP port to the persistent firewall configuration.
sudo firewall-cmd --permanent --add-port=6566/udp
# WHY: Adds the UDP port for broadcast discovery protocols.
sudo firewall-cmd --reload
# WHY: Applies the permanent rules to the active firewall session.
After reloading the firewall, tell the SANE daemon to accept remote requests. Edit the network configuration file in /etc/sane.d/.
# /etc/sane.d/net.conf
# Uncomment or add the IP range of your local network.
# WHY: saned refuses remote connections unless the client IP matches this list.
192.168.1.0/24
# WHY: CIDR notation covers the entire subnet without exposing the service to the internet.
Restart the daemon after editing the file. The daemon reads configuration files only at startup.
sudo systemctl restart saned
# WHY: Forces saned to reload the updated net.conf file.
# WHY: Prevents stale configuration from blocking remote clients.
If you are sharing a local USB scanner over the network, the host machine must run saned and the client machine must point to it. Add the host IP to the client's /etc/sane.d/net.conf and run scanimage -L on the client. The client does not need the vendor backend installed. It only needs the core SANE framework and network access.
Reload the firewall after every rule change. Runtime and persistent configurations diverge quickly if you skip this step.
Verify detection and isolate the failure
Test the connection before opening a graphical application. The scanimage CLI tool bypasses desktop environment wrappers and talks directly to the SANE daemon.
scanimage -L
# WHY: Queries saned for a list of detected devices.
# WHY: Returns the device URI if the backend successfully negotiated with the hardware.
If the command prints a line starting with device, the backend is working. Run a test scan to a temporary file.
scanimage > /tmp/test-scan.pnm
# WHY: Performs a default resolution scan and writes raw PNM output.
# WHY: Confirms the full data path from USB bus to disk.
If scanimage -L returns nothing, check the daemon logs. Fedora routes service logs through the journal. The -xe flags add explanatory context and jump to the end of the output. Most sysadmins type journalctl -xeu <unit> muscle-memory style because it shows recent log lines and state in one view.
journalctl -xeu saned
# WHY: Filters journal entries for the saned unit.
# WHY: The x flag adds priority explanations. The e flag shows recent entries.
Look for lines mentioning libusb errors, missing firmware, or backend initialization failures. The exact wording tells you whether the problem is a missing package, a permission denial, or a hardware handshake timeout. If the boot menu is gone, GRUB rescue is your friend, not your enemy. If the scanner is invisible, the journal is your friend, not your enemy.
Run journalctl -xe first. Read the actual error before guessing.
Common pitfalls and what the error looks like
SELinux denials appear as one-line summaries in the audit stream. Do not disable SELinux to fix a scanner. The policy blocks the daemon because it is trying to access a device node with an unexpected label. Check the setroubleshoot messages first.
journalctl -t setroubleshoot | grep -i scanner
# WHY: Filters SELinux alert messages for scanner-related denials.
# WHY: The output includes a URL to a detailed explanation and a fix command.
If the audit log shows a denial on /dev/bus/usb/devices/..., restore the default context. Package updates or manual moves can corrupt file labels.
sudo restorecon -Rv /dev/bus/usb
# WHY: Recursively restores default SELinux contexts on the USB device tree.
# WHY: The v flag prints every file that gets relabeled.
Some users encounter this exact error when running scanimage:
sane_init: no SANE DLL found
This means the sane-backends package is not installed or the library path is broken. Reinstall the core package and verify the shared library exists in /usr/lib64/sane/.
Another frequent failure looks like this:
device `hpaio:/net/OfficeJet_Pro_9010?ip=192.168.1.45' is not suitable for this purpose
The backend found the network device but cannot initialize the scanning module. The printer firmware might be outdated, or the SANE backend version lacks support for that specific model generation. Check the SANE supported devices list on the official wiki.
A third common trap involves the dll.conf file. This file lists which backend libraries SANE loads at startup. If you install a new backend but forget to add it to /etc/sane.d/dll.conf, the daemon ignores it. The package manager usually handles this automatically. Manual edits break during dnf upgrade --refresh. Trust the package manager. Manual file edits drift, snapshots stay.
Choose the right backend and workflow
Use the CLI scanimage tool when you need to isolate whether the problem is in the daemon, the backend, or the desktop application. Use journalctl -xeu saned when the device disappears after a reboot or a package update. Use firewall-cmd --reload after every network rule change. Use restorecon when SELinux blocks access to a device node that previously worked. Use a direct motherboard USB port when the scanner fails to initialize or drops during calibration. Use the vendor-specific sane-backends-* package when the base package only lists the device as unknown. Use the net.conf configuration when you are sharing a local scanner across a subnet. Use the official SANE supported devices list when the backend reports a protocol mismatch.
Snapshot the system before the upgrade. Future-you will thank you.