Scanning Network Behavior
Discover performs a small set of network actions during scanning. This article describes that behavior so security and network teams can distinguish normal scanning activity from suspicious traffic.
ICMP Host Discovery (Ping)
The appliance may send ICMP echo requests to candidate IP addresses as part of host discovery. A ping response isn’t required for scanning to continue with subsequent checks — this is expected behavior.
Targeted Port Checks and Service Discovery
The appliance performs limited, targeted port checks — using tools such as nc (netcat) and nmap — to determine which services are reachable on a host and collect basic service and OS signals. This targets a small, fixed set of discovery-relevant ports rather than broad, high-volume scanning.
Common ports checked:
- 135, 137, 138, 139, 445, 3389 — Windows discovery
- 443, 9443 — application discovery
- 22 — Unix/Linux discovery
Reduce False Positives
For IDS/IPS or EDR network controls that alert on scanning, allowlist the appliance’s IP address for the discovery ports above.
Cloud Instance Metadata Access
On cloud instances, the appliance may query the instance metadata endpoint at http://169.254.169.254 — the standard link-local address cloud providers use for their Instance Metadata Service (IMDS). This request may be attempted on both cloud and on-premise targets, but only cloud instances return metadata (typically a plaintext JSON identity document). The address is link-local and reachable only from within the instance itself.