Network Discovery sensors all connect to the same hub. Which one you install depends on what you need to see.
Compare the sensors
| Consideration | IT and OT sensor | Traffic sensor |
|---|---|---|
| What it discovers | Assets within the subnets and VLANs where you deploy it | Assets across subnets and VLANs, from the traffic they generate |
| How it collects data | Actively scans the IP ranges you define, and passively detects assets on the segments it can see when network visibility is enabled | Passively reads a copy of your network traffic |
| Credentials | Needed for full asset detail | Not used |
| Scope you define | IP ranges, subnets, or Active Directory OUs | None |
| Traffic mirroring | Not needed | Strongly recommended, using SPAN, RSPAN, ERSPAN, a network TAP, or a packet broker. Without a mirrored feed the sensor sees only broadcast traffic, which covers a limited subset of the local network. |
| Operating systems | Windows, Linux, macOS | Windows, Linux |
When to use the IT and OT sensor
Use it when you want depth. Given credentials, it authenticates to devices and returns the operating system, hardware, installed software, and users. It also maps subnets and switch ports, which is what builds your network topology diagrams.
Deploy one in each segment you want to scan.
When to use the traffic sensor
Use it when you want coverage. It finds anything that communicates, including devices you had no reason to look for, with no credentials and no scope to define. Placing it at a choke point such as a core or distribution switch covers traffic from many segments at once.
It reads a copy of your network traffic, so plan for your network team to configure mirroring before you install. Set up traffic collection covers the mirroring methods and where to place a sensor.
Running both
Many environments run both, because the two answer different questions. The traffic sensor tells you what's on the network. The IT and OT sensor tells you what each asset is, in detail.
A common pattern is to use the traffic sensor to spot IP ranges holding assets nothing has scanned yet, then deploy IT and OT sensors to cover those ranges.
Next steps
For the IT and OT sensor:
- Check the IT and OT sensor requirements.
- Install the sensor and hub on Windows, Linux, or macOS.
For the traffic sensor:
- Check the Traffic sensor requirements.
- Set up traffic collection on your network.
- Install it on Linux or Windows.