I am interested in learning more about how the Discovery Engine conducts the scan and retrieval of information from network assets. Specifically, I would like to better understand if the process is a serial or parallel one. In other words, does the Discovery Engine scan one asset (IP address) at a time before it moves on to the next available asset (IP address), or does it do a ping sweep to identify all live assets and then establish connections to all of them at the same time to harvest their information? My reason for asking is a concern over the volume of network traffic that may be generated by the discovery and retrieval process. My network team does not want this to run at all if it hammers the network all at once (a parallel process). I am hoping it is a serial process which should greatly reduce the network load created by this activity. I appreciate any insight you may have on this process.
We do not have any “official” stats, but to give the customer an idea of relative bandwidth utilization, in scanning a /20 we see average bandwidth of ~225 Kb/s, burst up to 1Mb/s. Pretty minimal.
Let me know if that helps,