Network discovery: how CreaRack identifies your devices

What it is

Discovery is the process CreaRack uses to identify a network device from its IP: who made it, what model it is, what type of device it is (switch, router, firewall, access point, UPS, media player), and how confident the identification is. It powers the [[crearack—network—auto-provision-wizard]] and the per-device Refresh and Deep Discover actions.

The scan itself runs on the Local Agent (CreaRackAgent.exe) inside your network — the cloud cannot reach your private IPs. The Agent collects the raw data; the CreaRack server then enriches it, matches vendors and stencils, scores the result, and saves it as a device profile in the database. See [[crearack—terminal—local-agent]].

The discovery phases

Every scan runs the same pipeline. You see it live in the wizard’s phase panel (Ping → ARP → SNMP → HTTP → Enrich):

1. ICMP (Ping) — checks the device is alive and measures round-trip time. A device that does not answer ping is not probed further.
2. ARP — reads the network’s ARP table to get the device’s MAC address, and derives the vendor from the MAC prefix (OUI). This works even on devices with no SNMP.
3. SNMP — the core identification phase. The Agent queries the device for its system description, hostname, model and interfaces. It tries your community string first, then known vendor-specific strings, then public and private as fallbacks — so a wrong community often still finds the device.
4. HTTP — fingerprints the device’s web interface on ports 443 and 80 (server header). Optional; many devices have no web UI.
5. Enrich — the server combines everything: vendor matching, model detection, stencil suggestion for the Rack Editor, and a Confidence score (green ≥70%, orange 40-69%, red <40%). The result is saved as a device profile.

Devices that only answer ping still get a minimal profile (IP + MAC + OUI vendor) with low confidence — useful as an inventory hint, but worth a Refresh with proper credentials later.

Single device vs subnet scan

• Single Device — one IP through the full pipeline. Typically 10-30 seconds.
• Subnet Scan — a CIDR (/20 to /30) or an IP range (max 1024 hosts) is expanded into individual IPs. The Agent pings them in parallel batches, then runs ARP, SNMP and HTTP only on the hosts that answered. Results are enriched and appear progressively. Large ranges (/23 or wider) can take 10-20 minutes.

Both modes are launched from the wizard — see [[crearack—network—auto-provision-wizard]] for the step-by-step.

Credentials: what discovery uses

• What you type in the wizard (community, SNMPv3 keys, SSH user/password) is ephemeral: it is used for that scan only and never stored in your browser.
• Saved Credentials from the [[crearack—settings—credential-store]] can pre-fill the wizard fields, so you don’t re-type them per scan.
• Stored profile credentials: once a device is discovered, its working credentials are saved encrypted with its profile. From then on, the browser never sees them again — in the device card the community shows as a mask (••••••), and any re-scan resolves the credentials on the server side.

Deep discovery (per device)

Standard discovery answers “what is this device”. Deep Discover answers “how is it doing”: it loads the vendor’s MIBs and queries extended SNMP data — CPU load, memory, VLANs, temperature and hardware inventory.

• Run it per device with the Deep Discover button in the results table or in the device card, or enable the Deep Discovery toggle before scanning to run it on every SNMP device automatically.
• It requires the device to support SNMP and to have working SNMP credentials on its profile.
• The job is dispatched to the Local Agent and tracked live; when it finishes, the device card gains Hardware, VLANs, Environment and Resources tabs, and the row shows a MIB badge.
• You can upload custom vendor MIBs first (Vendor MIBs button, or Upload MIB / Manage MIBs in the device card) to enrich the results.

It is noticeably slower than standard discovery (1-2 minutes per device), so use it when you need that detail.

Refreshing an already-discovered device

The Refresh button on a results row re-runs the full pipeline for that device only — no need to re-scan the whole subnet, and no need to re-enter credentials:

1. The browser asks the Local Agent to probe the IP again (ping, ARP, SNMP, HTTP), passing only the profile id.
2. The Agent (v2.3.0+) fetches the stored SNMP community for that profile from the server — the credential never travels through your browser.
3. The server re-enriches the result, reusing the profile’s stored SNMP v2c/v3 and SSH credentials server-side, and updates the row in place.

Use it after changing a device’s config, fixing its SNMP setup, or when a first pass came back ping-only and you have since added credentials to the profile.

Where the results go

Each discovered device becomes a device profile stored per organization. Profiles feed:

• The wizard’s Results & Assign table, where you route devices to racks and monitors.
• The Rack Editor’s pending-device panel ([[crearack—racks—auto-provision]]).
• Saved scans (Load Previous Results), shared with your whole team.

Troubleshooting

Related

• [[crearack—network—auto-provision-wizard]] — the wizard that runs discovery end to end
• [[crearack—settings—credential-store]] — saved credentials for prefill
• [[crearack—terminal—local-agent]] — the Agent that performs the scan
• [[crearack—racks—auto-provision]] — from discovery to the rack
• [[crearack—network—gestion-red]] — network management overview

Véase también

• [[crearack—network—auto-provision-wizard]]
• [[crearack—network—gestion-red]]
• [[crearack—settings—credential-store]]
• [[crearack—terminal—local-agent]]
• [[crearack—racks—auto-provision]]