Discovery
Discovery is a network feature that identifies devices using protocol-specific broadcast messages to elicit identity responses, optimizing visibility and load management across subnetworks.
Discovery is a method of identification of actors in the network through the usage of lightweight protocol-specific broadcast messages. These messages cause the actors to reply with identity information. The process is repeated with interleaving, predefined intervals. On each repetition, the sensor will identify the suitable network interfaces and send broadcast messages through them to reach the subnetworks the sensor is connected to.
On Arc, the repetitions occur every 5 minutes. On Guardian, the interval between 2 subsequent intervals is 5 minutes, then it progressively increases to a maximum of 60 minutes. Discovery listens for replies on two ports:
- user datagram protocol (UDP)/48888 for most protocols
- UDP/1911 for the Fox protocol