How Discovery device classification works

Device classification occurs only when a Discovery Schedule is configured to discover configuration items (CI). This scan type enables Discovery identifiers and is the only scan that can be used to update the CMDB.

When Discovery has determined the device's class, it launches an identity probe (a multiprobe) that is configured to run one or more commands with a single authentication. The identity probe in the base Discovery system can be configured to ask the device for information such as its serial numbers (there can be more than one), name, and network identification. The results of this scan are processed by an identity sensor, which then passes the results to the identifier. The identifier then attempts to find a matching device in the CMDB. If the identifier finds a matching CI, it either updates that CI or does nothing. If the identifier cannot find a matching CI, it either creates a new CI or does nothing. If Discovery is configured to continue, the identifier launches the exploration probes configured in the Classification record to gather additional information about the device. Exploration probes can be multiprobes or simple probes.

This diagram shows the processing flow for classifying and probing devices with identifiers configured.
Figure 1. Identification process
Identification process

IP scan mode

The IP Scan mode enables credential-less Discovery, which attempts to identify devices and software based on just the open ports and banners it finds. If the classification criteria are met for a device in the IP Scan mode, Discovery automatically updates the CI in the CMDB. After a device is properly classified, Discovery launches the exploration probes configured for that class of device and begins gathering detailed information about the CI.

Example

In the default Discovery system, the Linux classifier triggers eleven exploration probes that return information such as disk size, memory, and the number of current connections. The data from these probes returns at different times and is stored in the ECC Queue until processing is complete.

This diagram shows the processing flow for classifying and probing devices with an IP scan (no identifiers):
Figure 2. IP acan classification
IP acan classification