Diving Into Port Probes...

[SlightlyLoony]

Port probes… Doesn't this sound like something unpleasant, possibly involving rectal thermometers? Don't worry, they're not as bad as all that. In fact, they're pretty darned useful — and quite fundamental to Discovery.

The basic idea behind a port probe is to take some simple steps to see what kind of a device might be lurking at a particular IP address. This is the second step in discovery for any particular IP address, right after ping detects that an IP address is in use. The port probe gets its name from the fact that it checks ports (specifically, TCP and UDP ports) to see if the device at a particular IP address is listening on them. From the results, Discovery makes an educated guess about what kind of device is at that IP address.

You can see what port probes are defined by navigating to Discovery Definition → Port Probes. There you'll see something like the screenshot at right. Each row in this list defines a particular port probe. Each port probe checks the well-known port for the service that triggers it to see if the device at an IP address is listening to it. For example, the ssh port probe checks TCP port 22, and the SNMP port probe checks UDP port 161. The results of a port probe are simple: just active or inactive for each port.

But what good is this information? So what if a device is listening on the ssh port?

Well, it turns out that you can make some very good guesses about what general kind of device is at an IP address by looking at just these ports. For instance, if a device is listening to the ssh port, there's a good chance that it's a Linux or Unix system. It could be something else, but in that case Discovery will figure it out later. Similarly if a device is listening to the WMI port, most likely it's a Windows box of some kind. Once again, it could be something else, and if it is, Discovery will figure it out later.

The same logic applies to all the ports being probed — success on any of them gives Discovery a notion of what to go explore next — and that's exactly what Discovery does!