Solution · Asset discovery
Network asset discovery and an inventory that stays current
Find the devices on your network from the traffic they already send, identify what each one is, and keep an asset inventory that updates itself. Passive first, with optional, polite active discovery that you can switch off.
Passive discovery
Most devices announce themselves. DENIS listens to ARP, DHCP, mDNS, SSDP, LLDP and CDP and PROFINET DCP, and to the traffic that reaches it, and adds every device it sees. From any machine on a network segment this is enough to discover the devices on that segment, because these announcements are broadcast.
Optional active discovery
On ordinary IT networks DENIS also sends an ARP sweep, a ping and a light scan of 73 common ports, so quiet devices are found and their services named. Each part can be switched off for all networks or for one, the whole of it with passive-only mode, and devices identified as industrial are never pinged or scanned. A documentation page lists exactly what DENIS sends, so an intrusion detection system can be told about it.
Identification, with the evidence shown
- Manufacturer from the IEEE OUI registry built into DENIS.
- Device type and operating system from weighted evidence: DHCP fingerprints, mDNS and SSDP announcements, LLDP and CDP, TCP/IP stack characteristics, open ports and names.
- Product and version from service banners where a service reveals them.
- Each device lists the rules behind its classification, and a manual correction always takes precedence.
An inventory people can work with
- Owners, departments, locations, serial numbers, asset tags, warranties, criticality, tags and custom fields, with a full change history.
- A review queue for new devices, and lifecycle states such as lost, stolen or retired, with a finding when such a device is seen online again.
- CSV import and export, and read-only cross-reference with Entra ID, Intune, Active Directory, Jamf, Azure, AWS and Google Cloud, which never overrides what DENIS observed.
VLANs, switch ports and history
VLAN tags are read and shown per device, and the same hardware address on several VLANs is one flagged device. Since 4.3 capture sources can be grouped into separate networks, so the same VLAN number on two plants is not taken for one, and a hardware address can be marked as shared. Any managed switch with standard SNMP can be read: DENIS reads its ports, neighbours and forwarding tables to show which port each device is plugged into and how the switches are cabled, on the new network map. Every device has a timeline of its addresses, ports, alerts and changes.
Gaps, made visible
New in 4.3: a Not managed view lists the devices that none of your management, directory, scanning or endpoint tools reports (tested against fixtures, not yet against a real tenant), and a page called What DENIS cannot see shows blind spots: dropped or duplicated packets, VLANs that should be mirrored but are silent, and traffic seen in one direction only.
Limitations
- DENIS finds what it can observe. A device on another subnet or VLAN is seen only through a mirror port, a collector on that segment or a switch that DENIS reads over SNMP.
- A device that sends nothing while DENIS listens, and does not answer the optional active discovery, is not found.
- Device-type guesses are evidence-based but can be wrong or spoofed; the evidence is shown so a person can judge.
- DENIS is not a full CMDB: it does not track software licences, contracts or assets with no network presence.
- Switch reading uses the standard SNMP tables; only the switches on the supported infrastructure page were tested on real equipment, and port actions on other switches are Experimental and simulator-tested.