- Subscribe to RSS Feed
- Mark as New
- Mark as Read
- Bookmark
- Subscribe
- Printer Friendly Page
- Report Inappropriate Content
Shazzam is a feature we added to Discovery a few months ago. It uses port scanning (amongst other things) to find devices on the network. At Knowledge09 (our recent user conference), several people asked me exactly what port scanning actually was. Well, it's like this...
Wikipedia has a fairly good discussion of port scanning, and it has pointers to more technical articles if you're interested in the gory details.
For TCP ports, Discovery uses the "TCP scan" technique — it simply tries to establish a connection on the port that it's testing. There are three possible outcomes: success, an error, or a timeout. On success, Discovery knows it has a device at that IP address, and that the port it tested is open. On an error, Discovery knows there's a device at that IP address (otherwise there wouldn't be an error!), and that the port it tested is not open. On a timeout, Discovery has a slightly more ambiguous situation — maybe there's no device at that address, or maybe a firewall is simply dropping connection attemtps. Generally Disocvery is testing several ports on each device, so it will only figure there is no device at a particular IP address if all ports report a timeout.
For UDP ports, Discovery actually performs a query and looks for a valid response. For example, for SNMP (port 161), it will send a query to read the value of the sysDescr OID, and it will only report the port as open if that query succeeds.
What makes port scanning especially useful for finding lots of devices on a network is speed. Discovery uses a Java technology called "NIO" that is especially efficient when testing large numbers of IP addresses and ports.
- 864 Views
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.