---
sourceDocument: Zurich IT Operations Management
sourceDocumentLink: https://www.servicenow.com/docs/r/zurich/it-operations-management
Release :
- zurich
ft:locale :
- en-US
ft:publication_title :
- Zurich IT Operations Management
ft:clusterId :
- itom
bundleId :
- itom
workflow :
- Technology
---
# Credential-less discovery with Nmap
# Credential-less discovery with Nmap {#ariaid-title1}
Release version: Zurich
Updated May 31, 2026
 5 minutes to read
Summarize
 Summarized using AI
This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.
## Summary of Credential-less discovery with Nmap
Credential-less discovery with Nmap enables ServiceNow Discovery and Service Mapping to gather basic configuration item (CI) information when authentication fails.
By running selected Nmap commands through MID Server instances installed on Windows hosts, it collects essential details about hosts and applications without requiring credentials.
This feature is especially useful on known subnets where credential-based access is unavailable or misconfigured, providing a fallback method for CI identification and creation.
Show full answer Show less
Credential-less discovery is not intended for long-term use or for scanning cloud environments without explicit permission, as unauthorized scanning may violate cloud provider policies and terms of service.
## Key Features
* **Installation and Activation:** Nmap must be installed manually on MID Servers running Windows hosts, especially in self-hosted environments with restricted downloads. The Discovery - IP Based plugin activates Nmap functionality automatically when Discovery or Service Mapping is enabled.
* **Data Collected by Nmap:** Includes reverse DNS resolution, MAC address detection (on the same subnet), operating system and version detection, and identification of installed applications on target hosts.
* **System and MID Server Properties:** Configurable system properties control Nmap activation and port scanning ranges, while MID Server properties track installed Nmap and Npcap versions and safe Nmap scripts for application detection.
* **MID Server Capability:** Nmap installation adds a special capability to MID Servers, which is required for credential-less discovery. Service Mapping selects MID Servers based on IP address, so Nmap should be installed on all MID Servers handling relevant IP ranges to avoid errors.
* **Patterns and Scripts:** Two main credential-less discovery patterns are used: one for network devices and one for application discovery. These utilize predefined scripts to determine CI class and map application data. Most scripts should not be modified except for one that maps application data.
* **Npcap Library:** Installed alongside Nmap on Windows MID Servers to enable efficient packet capture and OS detection. Npcap is not removed automatically when Nmap is uninstalled and must be manually uninstalled if no longer needed.
## Practical Considerations for ServiceNow Customers
* Use credential-less discovery only as a fallback on subnets where credentials are unavailable; it is not a replacement for full credentialed discovery.
* Ensure Nmap is installed on all MID Servers responsible for IP ranges where credential-less discovery is desired to prevent errors during Service Mapping.
* Be aware of cloud provider restrictions on scanning; obtain necessary permissions before running Nmap against cloud resources.
* Monitor created CIs marked with the "CredentiallessDiscovery" source to track which items have been discovered without credentials. These CIs may be updated or reconciled when credential-based discovery runs successfully later.
* Coordinate with MID Server administrators to manage installation, configuration, and version updates of Nmap and Npcap on MID Servers running Windows hosts.
When authentication failure prevents configuration item (CI) identification, Discovery or Service Mapping can run selected Nmap commands through a MID Server. This collects basic CI information without credentials.{#nmap-credential-less-discovery__ph_nmap-short-desc}
A MID Server administrator can [install Nmap](https://www.servicenow.com/docs/access?context=install-nmap-on-mid-server&version=zurich&pubname=zurich-servicenow-platform&ft:locale=en-US) on individual MID Server instances running on a Windows host. Those MID Server instances can then discover some basic information about CIs in your network when normal authentication fails.
Important:
Self-hosted users whose network security doesn't permit downloads from install.service-now.com must install and configure Nmap manually on their system. Refer to [Install Nmap on a self-hosted system](https://www.servicenow.com/docs/access?context=install-nmap-on-mid-server&version=zurich&pubname=zurich-servicenow-platform&ft:locale=en-US) for instructions.
Credential-less discovery can create or modify host and application CIs when credentials are missing or misconfigured. If a credential-based discovery is performed successfully after Nmap creates a CI, the system reconciles the
information gathered from each type of discovery.
## What Nmap can discover {#nmap-credential-less-discovery__section_xcf_ygr_t1b}
The Nmap commands executed during credential-less discovery can:
* Perform reverse DNS name resolution to identify the host from the IPv4 address.
* Return the MAC address of the host if that host is on the same subnet as the host executing the Nmap command.
* Detect applications installed on a target host.
* Detect the operating system of a target host and the OS version.
{#nmap-credential-less-discovery__ul_emq_2pd_t1b}
Note:
Credential-less discovery classifies routers and switches as hardware. It does not create or update CIs specifically for them. Use it only on known subnets where credentials aren't viable, and don't use it long term.
## Nmap credential-less discovery scans in cloud computing platforms {#nmap-credential-less-discovery__section_vqn_zbs_hhb}
Running Nmap scans to or from resources within cloud computing services such as Amazon Web Services (AWS), Microsoft Azure, IBM Cloud, or Google Cloud Platform (GCP) is often against the terms of service. For example, the AWS environment is tightly regulated and requires the permission of AWS through the [AWS Vulnerability/Penetration Testing Request](https://aws.amazon.com/security/penetration-testing/) form. Unauthorized tests against AWS services or AWS-owned resources are prohibited. For this reason, credential-less discovery within a cloud computing service environment is not appropriate, and if a violation of their
policy occurs, could result in expulsion from the service. Contact your platform service provider for information on limitations or permission requirements for running Nmap.
## Components installed with Nmap {#nmap-credential-less-discovery__section_c12_rgr_t1b}
The Discovery - IP Based plugin (com.snc.discovery.ip_based) that provides the Nmap functionality is activated automatically when either Discovery or Service Mapping is active. These Nmap components are provided by the Discovery - IP Based plugin: {#nmap-credential-less-discovery__table_m1z_f2w_sbb__entry__2}
| Component | Description |
|-|-|
| System properties | * mid.discovery.credentialless.enable: Enables or disables Nmap for all MID Server instances on which Nmap is installed that are connected to the instance. This property is installed with the Discovery plugin and is enabled by default. It is configurable by a system administrator. * mid.discovery.credentialless.alt_port_options: Starting from Discovery and Service Mapping Patterns version 1.31.0, controls the port range that Nmap scans during credential-less discovery. Set to F to use Nmap fast mode (top 100 ports), or T to scan the top 1,000 ports (Nmap default). By default, ports are collected from the IP Services \[cmdb_ip_service\] table based on records where the Credentialless Discovery \[cl_discovery\] field is set to true. |
| MID Server properties | These properties, from the MID Server Property \[ecc_agent_property\] table, aren't intended to be configured: * mid.nmap.version: Version of Nmap that is installed on MID Server instances in your environment. This field is visible on the MID Server \[ecc_agent\] form after Nmap is installed. * nmap.safe.scripts: Defines the list of Nmap scripts that are classified as safe for use during execution of Nmap's Application Version Detection phase (-sV command option). * nmap.npcap.version: The version of Npcap that is installed with Nmap. The Nmap installer can only perform upgrades of existing Npcap installations it encounters. {#nmap-credential-less-discovery__ul_xw1_42w_sbb} |
| Fields | * Credentialless Discovery Port \[cl_port\]: Optional field on the Application \[cmdb_ci_appl\] table that displays the number of a port scanned by credential-less discovery. This port number is used to determine whether an application returned by Nmap has a matching CI in the CMDB or if a new CI must be created. * Discovery source \[discovery_source\]: Optional field in the Configuration Item \[cmdb_ci\] table to which the CredentiallessDiscovery choice is added. This option shows that credential-less discovery was used to create a CI. {#nmap-credential-less-discovery__ul_kjn_lrg_5bb} |
| Nmap MID Server capability | The Nmap [MID Server capabilities](https://www.servicenow.com/docs/access?context=t_ConfigureCapabilities&version=zurich&pubname=zurich-servicenow-platform§ion=r_MIDServerCapabilities&ft:locale=en-US) is added to the MID Server when Nmap is installed and removed automatically when Nmap is uninstalled. Only MID Server instances with this capability can perform credential-less discovery. A system administrator can't add or remove this capability manually. Self-hosted users who have the maint role can modify or delete the Nmap capability, but shouldn't do so. Service Mapping doesn't check for the presence of the Nmap capability and selects the MID Server based on the IP address only. To prevent Service Mapping from selecting a MID Server without the Nmap capability, install Nmap on all MID Servers assigned to the IP address ranges for which you want credential-less discovery to be available. If Service Mapping selects a MID Server for credential-less discovery that doesn't have Nmap capabilities, this error message appears in the map, at the site of the CI being discovered: `Nmap is not installed on MID Server. Verify all MIDs configured to handle selected IP Address have Nmap Capability. Nmap root directory path does not exist: ` Note: The ALL MID Server capability does not include the Nmap capability. |
| Npcap | [Npcap](https://nmap.org/npcap/) is Nmap's packet capture library for Windows. Npcap enables Nmap to perform port scans quickly and to identify the family of the operating system running on the target. Only one copy of Npcap is installed per MID Server host. Because Npcap can be used by other applications, uninstalling Nmap does not automatically uninstall Npcap. You must uninstall Npcap manually, after determining that no other dependencies exist. |
| Patterns | * Credentialless Discovery Network Device: Scans a host IP address using an Nmap command to identify the host. This pattern launches the Credentialless Discovery Network Device - PreLaunch script to retrieve the list of ports to explore from the IP Service \[cmdb_ip_service\] table. Don't modify this script. * Credentialless Discovery Application: Scans a port at an IP address using an Nmap command to identify the application service actively listening on that port. Service Mapping launches this pattern when all credential-based port classification steps fail. Discovery creates a CI in the Application \[cmdb_ci_appl\] table if the port is open and it can identify the service by name and product. If the service does not respond to any scan attempts, Nmap consults its nmap-services registry. Nmap then guesses which service is most likely running on that port. If Nmap guesses the application on a scanned port, the Credentialless Discovery Application pattern does not create or update an application CI. {#nmap-credential-less-discovery__ul_r4j_rbs_mbb} |
| MID Server script includes | * SetCredentialLessDeviceClassName: Determines which host CI to create or update after the successful execution of the Nmap command. don't modify this script. * CredentialLessApplicationClassNameMapper: Maps the service product, service name, and extra service information supplied by Nmap for the scanned port to a supported application table in the instance. System administrators can modify this script. * SetCredentialLessApplicationClassName: Verifies that the CredentialLessApplicationClassNameMapper script is invoked only once. don't modify this script. {#nmap-credential-less-discovery__ul_i4w_vr4_lbb} |
| System script include | The CredentiallessDiscoveryAjax script include runs on the instance and handles the installation and uninstallation of Nmap on Windows MID Server instances, executed from UI actions on the form. don't modify this script. |
[ ]
{#nmap-credential-less-discovery__table_m1z_f2w_sbb}
* **[Credential-less host Discovery](https://www.servicenow.com/docs/kdFPG_2S7b9IcGAL6HQX5Q)**
Credential-less host discovery occurs when a scanned host is found to be alive, but not active, or when all configured credential-based classification probes have failed.
* **[Credential-less Application Discovery](https://www.servicenow.com/docs/pgzQGXlFaUB1WaUBSdmLSQ)**
Credential-less Application Discovery attempts to identify an application service actively listening on a specific port at a given IP address.
* **[Nmap commands and data collected with credential-less Discovery](https://www.servicenow.com/docs/FCkLqhC14pU4K5Sz4pGSHw)**
Nmap executes in phases when collecting data and runs a controlled set of safe commands with two patterns for exploring applications and devices.