How Shazzam Probe and Sensor work technically?

rajvirahul
Kilo Contributor

‎10-28-2018 05:19 PM

Hello Friends,

 

I am new to the discovery and want to learn the actual mechanism of the discovery. I would like to understand , technically what happens at the each phase of the discovery. (Code level)

1. Once i schedule the discovery, how  and what triggers the Shazzam probe?

2. Configuration of Shazzam probe is empty and does not list any ports to scan as such, then how Shazzam probe does it?

3.What is the main functionality of Shazzam Sensor? 

 

Thanks,

Rahul Yamgar

0 Helpfuls
  • 1,420 Views
1 REPLY 1

DaveHertel
Kilo Sage
Kilo Sage

‎10-29-2018 06:49 PM

Rahul --

1.  The triggering of Shazzam probe is built into the core Discovery product, automatically launched when an IP address is setup (schedule or quick discovery).   The probe is querying known ports, defined as IP services.  OOB, its scanning well known ports like 135 for WMI, 22 for SSH, etc.  These are customizable, but out of the box by default it hits the well known ports for protocols at each IP address..

2.  shazzam port probe is using the well known ports, unless you have explicitly customized it (which is possible).  By default port scan will look for any response when mid server interrogates targets at well known port #'s...  

3.  The sensor is processing the response from the probe.  Its primary job is to parse the response that came back in the ECC queue and create/update CI's in the CMDB.   i.e. the 'sensor' code (typically javascript) is looking at the returning payload that was returned from the probe and updating the specific target CI in the CMDB.  That CI which represents the target machine IP that was scanned by the probe.

 

Does this help?