That is unsurprising. It doesn't check in real time, it checks periodically and caches the results. But my ssh is obviously running continuously so it really should have caught it.

It did catch port 22 on another IP address that I have.