Network Discovery and Scanner Agents

How devices are found

Network maps and IPAM are filled in from several sources at once:

Source	What it finds
Plenix agents	Each computer's own addresses, subnets, gateway and status
Scanner agents	Everything else on their network, including devices that can't run an agent
SNMP	Model and description of switches, routers, printers and other network gear
LLDP	Which switch or router is cabled to which
Switch MAC tables	Which device is plugged into which switch port
Printers	Printers you manage in Plenix
IPAM	Subnets and VLANs you've documented

Devices seen by more than one source are merged into one, matched by MAC address and IP address.

Scanner agents

A scanner agent is a normal Plenix agent that also scans its network. Any Windows, macOS or Linux agent can be one. To turn one on, open the device in RMM, go to its Network Devices tab and turn on Gateway Mode. Pick a machine that's always on, such as a server. Rescan Network on the same tab scans from it straight away.

When a scanner runs, it:

1. Sweeps its own subnet using ARP. Every device that answers is found, even firewalled machines that ignore ping and have no open ports.
2. Checks common ports on each device to work out what it is. These include web admin, SSH, Windows file sharing and remote desktop, printing, cameras, VoIP and hypervisors.
3. Asks SNMP-capable devices for their model, their neighbours and their switch port tables.
4. Looks up names from DNS and NetBIOS.
5. Also sweeps other small subnets you've documented in IPAM for the same customer. Routed subnets are checked with a lighter ping-and-port pass, because ARP doesn't cross routers.

Each scanner covers up to 8 subnets. Very large ranges are limited to 1,024 addresses (a /22) so a scan finishes in a couple of minutes.

The Open topology link on the Network Devices tab opens that device on its network map.

Working out what a device is

Plenix gives every device a role: router, switch, access point, firewall, server, hypervisor, NAS, workstation, laptop, printer, camera, phone, UPS, IoT device and so on. It uses:

• the manufacturer, worked out from the MAC address;
• the open ports;
• SNMP descriptions;
• the operating system, for devices with the agent;
• the hostname.

If Plenix gets a role wrong, change it in the device panel on the map. Your choice is kept and never overwritten. If AI is set up, it can identify devices the rules can't. See AI network review.

When discovery runs

Go to Network Maps → Discovery. You can:

• click Scan all networks at the top of the hub to scan everywhere now;
• click Scan now next to a scanner to scan from just that one;
• click Scan site on a site's map.

The settings (administrators only):

Setting	Default	What it does
Scheduled scans	On	Scanner agents sweep their networks on a schedule
Scan every	6 hours	How often automatic discovery runs
Keep IPAM up to date	On	Adds what's found to IPAM twice an hour
Create subnets automatically	On	Adds subnets that aren't in IPAM yet, marked Discovered
Mark stale after	30 days	When unseen devices are marked stale and their discovered addresses are freed
AI review	On	Lets AI identify unknown devices after each scheduled scan (needs the AI module and AI set up on the server)

The Discovery tab also lists every scanner agent with whether it's connected and when it last reported.

Good to know

• Scans only look at private network ranges. They never scan the internet.
• A scanner only sees networks it can reach. For a site with several VLANs, either put a scanner on each VLAN, or document the VLANs in IPAM so scanners sweep them as routed subnets.
• SNMP uses the scanner agent's SNMP community (public unless you've set another). Switches with SNMP turned off still appear, but without their cabling.

Related

• Read the network map
• How to manage IP addresses (IPAM)