Servicenow Discovery

[SatishChitti]

Hello Folks,

Can anyone tell what is the difference between "Active" & "Alive" in the Discovering any Device across the customer environment.
Thanks

[SAI VENKATESH · Accepted solution]

Hi @SatishChitti 

Active means whether the device is responding to the scan in scanning phase.

Alive means an IP responds to a ping (Active) but does not have SSH/WMI/SNMP ports open

Thanks and Regards

Sai Venkatesh

[Mannapuram · Accepted solution]

Exactly. @SAI VENKATESH mentioned it rightly. Active will respond to the Shazzam scanning (like responding to 'Are you there?')

Alive is not responding to basic ports and then Service Mapping will launch Credential-less Host discovery probe (More details here: https://www.servicenow.com/docs/csh?topicname=credential-less-host-discovery.html&version=latest).

[KrushnakumaT · Accepted solution]

Hi @SatishChitti ,

In Discovery, ‘Active’ generally means the CI record in CMDB has the Active flag set to true (it’s considered in use in CMDB). ‘Alive’ means Discovery was able to reach and respond from the device during the last scan — it’s actually up and responding on the network. So, a device can be Active in CMDB but not Alive on the network, and vice versa.
Kindly mark my answer as helpful and accept solution if it helped you in anyway. This will help me be recognized for the efforts and also move this questions from unsolved to solved bucket. 
Thank you!!

[Harish Bainsla · Accepted solution]

Hi @SatishChitti 

"active" typically means a device is responding to specific service-related probes or requests, while "alive" indicates the device is reachable on the network, even if it's not actively responding to service requests.

For more details check below link explain in details

https://www.servicenow.com/docs/bundle/zurich-api-reference/page/app-store/dev_portal/API_reference/...

if my answer helps you  mark helpful and accept solution

[Harish Bainsla · Accepted solution]

Hi @SatishChitti 

"active" typically means a device is responding to specific service-related probes or requests, while "alive" indicates the device is reachable on the network, even if it's not actively responding to service requests.

For more details check below link explain in details

https://www.servicenow.com/docs/bundle/zurich-api-reference/page/app-store/dev_portal/API_reference/...

if my answer helps you  mark helpful and accept solution

[doug_schulze · Accepted solution]

Let me correct many assumptions here..

In a shazzam result:

Active means one of the classification ports we are checking responded in the state of OPEN. WMI/SSH/HTTP or a response on an snmp sysdescr query.

Alive is when one of the classification ports responded in a manner other than open.

Think of shazzam as a person going door to door in a neighborhood full of houses (IP addresses) and we are looking for doors labeled 135 (WMI), 22 (ssh).. ect.. shazzam turns the door knobs and if those doors open we report that its 'Active', I can actively attempt to talk to that protocol in the next phase.  Now imagine going up to a house and you turn the door labeled port 22 and as you turn that knob you hear a voice on the other side that says GO AWAY! or refused.  Well that IP (house) will be marked 'Alive', as in something is there but we cant go any further in the discovery process.

Now if no doors are there or give us no response, well then we exclude that IP from the results list as we may have just found an empty lot and nothing is assumed to be there.

And there is no pinging in discovery, its all port checks...

[SatishChitti]

Hi @doug_schulze ,
Thanks for your awesome explanation.
Now it is crystal clear.
Appreciate it !