Portail ZAPP's Network inventory discovers the devices on your networks (switches, routers, printers, servers, workstationsā¦), lets you decide which ones to track, then inventories them in detail and records them in the CMDB. The work happens in three steps: a discovery scan finds the hosts, you validate them, then an inventory queries them with the credentials you have assigned to their type.
The screens are reserved for the Administrators group. Open them from the Network inventory menu entry; the tabs at the top of each page lead to Scopes, Declared networks, Scans, Discovered hosts, Credentials, Assignments and Approvals (with the number of pending requests). The Network scans menu entry opens the scans directly.
Scans go through an Outpost agent installed on the network to explore: without the Outpost agents module, no scan is possible. Credentials, assignments and approvals are described in the page "Managing network inventory access and approvals".
Scan scopes
A scope says what to scan, from which Outpost and when. The Network scan scopes page lists them (name, Outpost agent, targets, schedule, Enabled). Click + New scope and fill in:
- Name;
- Outpost agent: the agent that will run the scan. It must be installed on the same network segment as the devices, to read their local ARP table. Only active agents are offered;
- Targets: one entry per line ā IP address, CIDR (for example
192.0.2.0/24), range (192.0.2.10-192.0.2.50) or host name. IPv4 only, at most 65,536 addresses per entry and 200 entries, at most 65,536 addresses for the whole scope once exclusions are removed, and always inside a declared network; - Exclusions: same formats; these addresses are never probed;
- Port profile (Minimal, Standard, Extended), Parallelism (32 by default), Max rate (packets/s) (500 by default, at most 5,000) and Timeout per probe (ms) (1,000 by default, between 100 and 10,000);
- Identify devices (mDNS, SSDP, banners, SNMP): ticked by default, this is what lets the type of a device be guessed;
- Allowed scan windows: the days and hours during which a scan may run. The Every night (22:00-06:00) and Weekend buttons add a ready-made window. Times are server times, and a range that ends before it starts crosses midnight. No window: scans allowed at any time;
- Schedule (cron, optional): to start the scan automatically;
- Automatically start an inventory after each successful scheduled scan: a manually started scan never triggers an automatic inventory.
As long as no network is declared, no target is accepted: declare your networks first.
What goes through approval. Creating a scope, and any change to its agent, targets or exclusions, is submitted for approval: "Request submitted for approval: nothing is applied until it is validated." The other settings (name, ports, rate, windows, scheduleā¦) apply immediately. Enabling, disabling or deleting a scope also applies immediately.
Starting a discovery scan
The Discovery scans page shows each scope with its Outpost, its Capabilities and its Last scan:
- Full: the Outpost can run discovery;
- Degraded discovery: the Outpost cannot use ICMP, so some hosts may escape the scan;
- NetDiscovery not supported: this Outpost cannot run discovery;
- Unknown: the Outpost has not announced itself yet.
The Start a scan button (enabled scopes only) sends the request to the Outpost. A scan sends no credential: it only finds hosts. It is refused outside the allowed windows, when a scan is already running on the scope, or when a target is no longer covered by a declared network. Scheduled scans are started by a scheduler task, which by default checks every minute for scopes whose cron is due.
The Scan journal keeps every scan (date, type Discovery or Inventory, scope, targets as they were at launch, author or Scheduled, status, number of hosts). A scan stuck Running can be stopped with Cancel scan, which frees the scope. When the Data grids module is installed, the journal is a grid on which you can Purge selection (running scans cannot be purged).
Validating discovered hosts
The Discovered hosts page lists the hosts found, filterable by status, by scope and by search (IP, name, MAC, vendorā¦). For each one: the address, the scope, the identity (name, MAC and vendor), the open ports, the first and last time it was seen, the inventory and the status.
A discovered host never receives a credential until it is validated with a device type (Switch, Router, Firewall, Printer, NAS, UPS, IoT, Server, Windows host, Other): this type decides which credentials it can receive.
- Validate: choose the type (pre-filled when the device was identified), then click. The host becomes Validated;
- Reject: the host becomes Rejected and will not be inventoried, even if a later scan sees it again;
- Put back on hold: returns a validated or rejected host to Pending.
Automatic validation of identified hosts: the Enable / Disable button at the top of the page. It only applies to hosts whose type could be deduced from their fingerprint; an unidentified host always needs manual validation. A host validated this way shows Validated automatically.
Inventorying validated hosts
On the scans page, Start inventory queries the validated hosts of the scope that have a credential assigned to their device type. For each host, the credential is chosen among those assigned to this scope and this type, in this order: SNMP v3, then SNMP v1/v2c, then SSH, then WinRM (only if the Outpost announces it). HTTPS API credentials are not used for the inventory yet.
Like a scan, an inventory is refused outside the scope's scan windows. If nothing is eligible, a message says why: no validated host, no credential for their device type, unusable protocol, secret not found, or SSH host keys all changed.
Each inventoried host is written to the CMDB: a machine whose operating system is known becomes a machine, the rest a network device with its interfaces. The Inventory column of the hosts page shows the date of the last inventory, any error (authentication refused, timeout, host unreachableā¦) and the In the CMDB link to the record.
Force CMDB creation: for a validated host that has no record yet (inventory never succeeded), this button creates a minimal record from the discovery data alone (address, MAC, name, vendor) and the type chosen at validation, without querying the device.
SSH host key changed
When a device inventoried over SSH presents a host key different from the pinned one, the connection is refused before any authentication and the hosts page shows "SSH host key changed: no credential is sent to this host.", with the pinned key and the observed key. Check that the device has not been spoofed (reinstallation, replacementā¦), then click Accept new key: the observed key immediately becomes the pinned key (if no key had been recorded, it is pinned at the next inventory). Another key change before the next inventory is therefore refused in turn.