Quick Discovery versus Scheduled Discovery

[tina1607]

Hi All.

I am facing a strang issue while trying to execute discovery via a discovery schedule.

I have configured a discovery schedule with 2 IP subnets i.e. 10.161.60.0/24,10.161.68.0/23. There is a valid workstation at 10.161.68.84 which is not even identified as Alive during the scheduled discovery run. However, when the same target IP address is scanned via Quick Discovery option, then it is creating/updating the CI at that endpoint.

MID server used is same in both the scenarios. Please let me know if there is any difference in the process of discovery for Quick Discovery versus Scheduled Discovery option.

Thanks in advance !!

[Michael Fry1]

There shouldn't be any difference in terms of discovering data. Scheduled allows for you to enter the ranges, credentials and schedule for discovery. Quick allows for an IP address or multiple IP addressed to be entered and then run.

I'm not a network person but are you sure that workstation IP fails in your IP subnets defined?

[crc2580]

Hi Tina,

    Some questions to help troubleshoot:

-what type of device is on that IP?

-what port is it being successfully scanned on?

-do you have any ip exclusion rules setup?

-do you have a behavior assigned to your schedule?

[tina1607]

The issue has been resolved. In certain cases, ServiceNow discovery ranges is not properly picking subnets from the format 10.161.68.0/23. I have put this range into the format as 10.161.68.0/24 and 10.161.69.0/24. This helped in polling all the target IP addresses during Shazam phase for discovery.

[Mittal_M]

Hi Tina,

Do you mean to say that 10.161.68.0/23 is not working but when you divided the subnet with /24 then its working fine ?

But generally this should not be the case as "10.161.68.0/24 and 10.161.69.0/24" are covered in /23 range, is it happening with another subnet masks as well like /22, /20 etc.

as per the documents they didn't mentioned anything about putting subnet mask as only "/24". please see below from the documents.

IP network

An IP network includes the range of available IP addresses in that network, including the network address (the lowest address in the range) and the broadcast address (the highest address in the range). An example of a class C network range is 192.168.0.0 to 192.168.0.255. In the Range Set form, this network can be entered with either of the following notations:

• 192.168.0.0/24
• 192.168.0.1/255.255.255.0

This notation indicates that Discovery is scanning an IP network, and Discovery does not scan the highest and lowest numbers in the range. This prevents significant errors from being introduced into the Discovery data by the broadcast address, which returns all the devices in the network, and the network address, which can add an arbitrary number of redundant devices. This built-in control makes IP networks the best method of defining which IP address ranges to query.