---
sourceDocument: Zurich IT Operations Management
sourceDocumentLink: https://www.servicenow.com/docs/r/zurich/it-operations-management

 Release :

    - zurich

ft:locale :

    - en-US

ft:publication_title :

    - Zurich IT Operations Management

ft:clusterId :

    - itom

bundleId :

    - itom

workflow :

    - Technology


---

# Fine-tune patterns using traffic-based discovery

# Fine-tune patterns using traffic-based discovery {#ariaid-title1}

* Release version: Zurich
* 
* Updated July 31, 2025
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 3 minutes to read

As an alternative to customizing the pattern from the Pattern Designer side, improve
existing patterns so that Service Mapping can use them to find configuration item (CI) connections previously found using
traffic-based discovery.

## Before you begin

Role required: pd_admin

Basic knowledge of programming is desirable.

## About this task

Service Mapping can discover and map configuration items (CIs) following their traffic-based connections. This method is referred to as traffic-based mapping and complements pattern-based mapping.

Using traffic-based discovery, Service Mapping may discover an
important CI connection. In this case, you can make sure that this connection is
always found for all CIs belonging to the same CI type. You do that by modifying the
pattern used to discover CIs of that CI type. A pattern is a sequence of commands designed to detect attributes of a CI and its outbound connections.

You can search CI configuration files to locate data discovered using
traffic-based discovery, for example IP address and port. If there are configuration
files containing this data, you create a pattern step to parse this file. Next time
Service Mapping discovers this CI using the modified pattern, it
extracts the information about this connection directly from the configuration file.

## Procedure

1. Navigate to Service MappingServicesApplication Services.
2. Select View Map next to the relevant service instance.
3. Right-click the relevant CI.
4. Select Show traffic based connections.  
   The Traffic Based Connections List displays the following information:{#connection-section-traffic-based__ShowTrafficBasedConnectionsTableProper__entry__2}

   | Field | Description |
   |-|-|
   | IP | The IP address of the application connected to the selected CI. |
   | Port | The port on the selected CI that is used to communicate to the other application. |
   | Process | The ID of the process in the selected CI. |
   | Already on map | * Yes --- if this connection shows on the map. * No --- if this connection is not part of the service instance and not on the map. {#connection-section-traffic-based__ul_nts_2kx_ww} |
   | System decision | The setting defines if Service Mapping keeps the discovered traffic-based connection or removes it. The value comes from the algorithm that Service Mapping uses. |
   | User decision | (Optional) The setting overrides the System decision setting, which defines if Service Mapping keeps the discovered traffic-based connection or removes it. For example, if the System decision setting for a connection is Keep, and you want to remove this connection, select <kbd class="ph userinput">Remove</kbd>. |
   [Table 1. Traffic Based Connections List (when discovery based on Predictive Intelligence is disabled)]

   {#connection-section-traffic-based__ShowTrafficBasedConnectionsTableProper}  
   Note:  
   There may be a case when you can see traffic-based connections on the map, but the Traffic Based Connections list does not display them. It happens for the connections that have been removed from the TCP Connection \[cmdb_tcp\] table less than three days.
5. Double-click the connection you want to use to create a pattern step.
6. If there are multiple patterns used to discover this CI, select the pattern for which you want to create the step, and click OK.  
   Pattern Designer creates a temporary connection section for this pattern with
   a new step.

   <br />

   The Debug Connection Section window is displayed with some fields
   automatically populated.
7. Click Connect.  
   The Debug mode is activated.
   The Search Assistant window opens.
8. Search CI configuration files for data received using traffic-based discovery:
   1. Under Free Text, review data automatically filled in from the Traffic Based Connections List.  

      <br />

      The File Patterns field displays file types in which Pattern Designer
      performs the search.
   2. Click the Search Files tab and review files.  
      If necessary, you can remove irrelevant files from the search by clicking the Minus icon.
   3. Click Search.  
      After search completes, the Search Result tab
      opens with the list of files in which any of the search criteria was
      found.
   {#connection-section-traffic-based__substeps_nm1_l4x_py}
9. Create a pattern step for parsing the configuration file containing information about the connection:
   1. On the Search Result tab, click one of the files and review connection data found in this file.
   2. Wait for the file content to load and select the relevant entry under the file name:  

      <br />

   3. To use this data to create the pattern step, click Create parse file step.  
      Pattern Designer shows the new step with the Parse File operation. It
      automatically assigns this step the name in the following format:
      Parsing \<file name\>.

      Pattern Designer automatically sets the file name, file path, and
      parsing strategy for the step. It also creates variables that
      contain data you searched for. If there is a variable, which
      contains the file path, Pattern Designer enters this variable for
      the path.

      <br />

   4. **Optional:** If necessary, you can modify parsing strategy.
   5. Rename the section to provide a meaningful name, for example Discover HA Proxy client connection.  
      Or

      Copy and past the step into the relevant connection section.
   {#connection-section-traffic-based__substeps_yvv_54x_py}
10. Complete modifying the pattern as described in [Finalize a pattern](https://www.servicenow.com/docs/QtHNullpN6FL1L5RyKqrcg "After you finish defining your pattern, make it ready for use by Service Mapping and Discovery.").
**Previous topic:** [Enhance patterns without modifying identification sections](https://www.servicenow.com/docs/cBqr1ifnYAqBfLJEA3KS8A "Enable patterns to search for additional attributes and modify pattern discovery logic defined in identification sections by using extension sections. Each extension section contains a preconfigured set of discovery steps referred to as a shared library.")  
**Next topic:** [Finalize a pattern](https://www.servicenow.com/docs/QtHNullpN6FL1L5RyKqrcg "After you finish defining your pattern, make it ready for use by Service Mapping and Discovery.")  
**Related concepts**   

* [Traffic-based discovery in Service Mapping](https://www.servicenow.com/docs/RADA7XOqy9NK0EBnVONYew "Service Mapping can discover and map configuration items (CIs) following their traffic-based connections. This method is referred to as traffic-based mapping and complements pattern-based mapping.")
* [Discovery patterns used by ITOM Visibility](https://www.servicenow.com/docs/G6Qi9CpVd~QDcPGBjdqbbA "Service Mapping and Discovery use patterns in their discovery process that cover most industry standard network devices and applications. You can customize these patterns and create new ones.")  
**Related tasks**   

* [Enable traffic-based discovery for CI types or specific CIs](https://www.servicenow.com/docs/LszAoKtdXy3pemvy1NweWQ "Service Mapping can discover and map CIs by detecting the inbound and outbound traffic that the CIs generate. Create a traffic-based discovery rule to determine which configuration items are available for traffic-based mapping.")

*[\>]: and then