Network Discovery sensors all connect to the same hub. Which one you install depends on what you need to see.
Compare the sensors
| Consideration | IT and OT sensor | Traffic sensor |
|---|---|---|
| What it discovers | Assets within the subnets and VLANs where you deploy it | Assets across subnets and VLANs, from the traffic they generate |
| How it collects data | Actively scans the IP ranges you define, and passively detects assets on the segments it can see when network visibility is enabled | Passively reads a copy of your network traffic |
| Credentials | Needed for full asset detail | Not used |
| Scope you define | IP ranges, subnets, or Active Directory OUs | None |
| Traffic mirroring | Not needed | Strongly recommended, using SPAN, RSPAN, ERSPAN, a network TAP, or a packet broker. You can also send NetFlow records from your switches or routers (early access). Without a mirrored feed the sensor sees only broadcast traffic, which covers a limited subset of the local network. |
| Asset connections | Not recorded | Internal connections and connections to external services (closed beta) |
| Operating systems | Windows, Linux, macOS | Windows, Linux |
When to use the IT and OT sensor
Use it when you want depth. Given credentials, it authenticates to devices and returns the operating system, hardware, installed software, and users. It also maps subnets and switch ports, which is what builds your network topology diagrams.
Deploy one in each segment you want to scan.
When to use the traffic sensor
Use the traffic sensor when you want coverage. It finds anything that communicates, including devices you had no reason to look for, with no credentials and no scope to define. Placing it at a choke point such as a core or distribution switch covers traffic from many segments at once.
It reads a copy of your network traffic. Set up traffic collection covers the mirroring methods and where to place a sensor.
What the traffic sensor records
The traffic sensor also records how your assets communicate. After you install it, the sensor inspects network traffic and records:
- Connections between your assets, in both directions: the connections each asset sends and the ones it receives.
- Connections from your assets to external services, such as SaaS applications.
The sensor sends this connection data through the hub to your site. You can review it on the Connections tab of an asset summary. See View internal connections and View external connections.
Asset connections are in closed beta. To request access, sign up for the Lansweeper beta program.
How connection data is protected
- Allowlist only: Lansweeper stores and shows only connections to a curated list of well-known corporate applications, such as common SaaS, cloud, and AI services. Connections to other destinations don't appear in your inventory or the API, so an employee's personal browsing isn't surfaced.
- Minimal retention: Raw traffic data is kept only as long as it's needed to build your inventory, then deleted.
- Separate access control: Viewing connections requires the View asset connections permission, which is separate from the rest of the inventory. Grant it only to the roles that need it.
For the full details, see the Lansweeper Traffic Sensor Trust Center and Privacy by design.
Run multiple sensors
Many environments run multiple sensors because they answer different questions. The traffic sensor tells you what's on the network and how it communicates. The IT and OT sensor tells you what each asset is, in detail.
A common pattern is to use the traffic sensor to spot IP ranges holding assets nothing has scanned yet, then deploy IT and OT sensors to cover those ranges.
Next steps
Whichever sensor you pick, start with the Discovery hub requirements.
For the IT and OT sensor:
- Check the IT and OT sensor requirements.
- Install the sensor and hub on Windows, Linux, or macOS.
For the traffic sensor:
- Check the Traffic sensor requirements.
- Set up traffic collection on your network.
- Install it on Linux or Windows.