NS-Discovery
Request a pilot

How it works

How it works

A Sensor listens on one network segment. Optionally, a Manager collects the inventory of many Sensors. Both are single programs with their own database, plus a signed recognition package.

From a packet to an answer

  1. ListenThe Sensor receives traffic on a host in the segment or on a mirror (SPAN) port.
  2. DecodeHand-written decoders read discovery protocols and treat every packet as hostile input.
  3. Collect evidenceFacts are kept per device (MAC address) with their source and age.
  4. ClassifyReviewed, deterministic rules turn evidence into a type, vendor and model — or leave it unknown.
  5. AnswerInventory, changes, findings and reports in the web interface, the CLI and exports.

Ways to deploy

In every option the Sensor opens the connection itself and accepts none. Only the Manager listens, on one TCP port. The Manager cannot send commands to Sensors; it can only offer a fixed list of settings that each Sensor checks and may ignore.

available

A single Sensor

Your network Sensorlistens to the segment Browseron the same host

An assessment of one site, a pilot, a consultant's laptop. Reports and exports as files.

available

Sensors and your own Manager

Your network Sensor · office Sensor · plant Sensor · DC Managermutual TLS StaffSSO

Several sites, everything inside your perimeter. Roles, single sign-on (OpenID Connect) and per-site access.

available

Manager in your cloud account

Corporate network Sensor · HQ Sensor · branch Your cloud account Managera small VM

No data center, sites spread out. Sensors connect outbound only; the data stays in your account. Today the sign-in page shares the Sensor port, so restrict it with your cloud firewall or a VPN.

available

Isolated networks

Isolated segment Sensorno connectivity file Security team Managerimports the file

Industrial control, labs and segments without a path out. An export file is carried to the Manager.

Planned: a Manager operated for you by a managed service provider, with each customer in a fully separate tenant (its own database, certificate authority and users).

What it needs

ComponentRuns onNotes
SensorUbuntu 22.04 or 24.04 LTS, amd64 (Debian package); arm64 build on request; macOS for evaluationA host in the segment or a mirror port. Runs as a dedicated user with only the packet-capture capabilities.
ManagerLinux server or VMOne program with a built-in database and its own certificate authority. No external database or message broker.
Mobile appAndroidRead-only view of the Manager, paired with its own certificate.