what is probe and sensor in Discovery?

[BoHyun Jung]

I have some questions in Discovery.

1. What is probe and sensor in Discovery?

2. What is the difference between Shzzam probe and port probe?

[Danish Bhairag2]

Hi @BoHyun Jung ,

1. **Probe and Sensor:**

   - **Probe:** A probe is a Discovery mechanism used to explore a device or a device's attributes. Probes are responsible for collecting information from a target device. For example, a WMI (Windows Management Instrumentation) probe can be used to collect information from Windows devices.

   - **Sensor:** A sensor is a unit of work within a probe. It represents a specific type of information to be collected from a device. For example, within a WMI probe, you might have sensors for collecting information about installed software, hardware details, or network configuration.

2. **Shazzam Probe vs. Port Probe:**

   - **Shazzam Probe:** Shazzam is a discovery probe that focuses on identifying software and services running on a device. It is designed to recognize patterns in system responses to identify applications, databases, and other software components.

   - **Port Probe:** A port probe is a type of discovery probe that checks for open ports on a device. It helps determine which services are running on specific ports. This information is crucial for understanding the services available on a device.

In summary, Shazzam probes are more focused on software and service identification, while port probes specifically check for open ports and associated services. Both types of probes contribute to building a comprehensive picture of the devices in your environment during the discovery process.

Thanks,

Danish

[Harish Bainsla]

Hi please check below links

https://docs.servicenow.com/bundle/tokyo-it-operations-management/page/product/discovery/concept/c_D...

The Shazzam probe uses the port probe to look for protocol activity on open ports on devices it comes across. When an open port is found, the Shazzam sensor checks the port probe to identify the classification probe to launch on that port, which might be SSH, WMI, SNMP, or something else. By default, the WMI probe is launched if the port does not respond to the WMI, then the SSH probe is launched to gather information about the device. Finally, when the port does not respond to the WMI or the SSH, the SNMO probe will allow identification if the device is running multiple protocols.

Now let's see how to configure the port probe scan:

1. Search for Port Probes in the application navigator, which will bring up ports that are already .

https://youtu.be/j0lPKE7IOzo?si=Q8DyM_esnZBROrQs

[Amit Gujarathi · Accepted solution]

HI @BoHyun Jung ,
I trust you are doing great.

1. • Probe: In ServiceNow Discovery, a probe is a piece of code that collects data about a device or an application on a network. When Discovery is initiated, probes are sent out to the target devices. They gather specific information such as configuration details, installed software, network connections, etc.

   • Sensor: A sensor in ServiceNow Discovery processes the data collected by probes. After a probe gathers information, it sends this data back to the ServiceNow instance, where sensors parse and process the data. Sensors then create or update records in the ServiceNow CMDB (Configuration Management Database) based on this information.

2. Difference between Shazzam Probe and Port Probe:

   • Shazzam Probe: The Shazzam probe is primarily used for network discovery. It identifies IP-enabled configuration items (CIs) on the network. Shazzam is efficient in quickly scanning a large number of IPs and determining which ones are active. It helps in identifying the type of device associated with each IP address but does not delve deeply into the device details.

   • Port Probe: The Port probe, on the other hand, is more focused on identifying open ports on a network device. It is used after the Shazzam probe identifies active IPs. The Port probe scans these IPs to find open ports and determine the type of services running on those ports. This helps in a more detailed discovery of network services and applications.

[Dipen Wadhwana]

Hi @BoHyun Jung 

1. Probes and Sensors in Discovery:

   • Discovery probes and sensors play a crucial role in data collection and updating the CMDB (Configuration Management Database). They perform key tasks related to data gathering during the discovery process.
   • Probes and sensors are controlled by the ECC queue. A job monitors this queue, looking for output and the ready state.
   • While probes collect data on the host, sensors process the gathered data and update the CMDB.
   • With each release, patterns are replacing many traditional probes and sensors. Consider creating new patterns or editing existing ones12.

2. Shazzam Probe vs. Port Probe:

   • Shazzam is the first phase of discovery. It performs port scanning, regardless of whether you use patterns for horizontal discovery.
   • The Shazzam probe scans ports to determine what protocols are available on a target system. The results from Shazzam determine which classifiers to trigger.
   • Port scanning is essential for understanding the network landscape and identifying open ports.
   • Port probes are available in the base system and use an IP Service record to specify which port to use for a specific protocol.

Remember, Discovery is like a curious explorer, scanning the digital landscape to uncover hidden treasures of information! 

Please mark this response as helpful if your question has been answered correctly.