Several networks

One agent per segment

An agent sees its own segment best. ARP, hardware addresses, manufacturers, mDNS and SSDP all stop at the first router, so a host on another subnet is found by ping only, with no MAC and usually fewer names.

The rule of thumb: one agent in each network you want fully mapped, each with its own API key, each attributed to the board for that network — or several agents drawing onto one board for one site.

Sweeping a routed range from afar

An agent can sweep a range it is not on, provided its machine has a route into it. Set the range on the dashboard or in scan.cidr / scan.mask. Expect:

• hosts found by ping only — anything that drops ICMP is invisible;
• no hardware address or manufacturer, except from NetBIOS, which still reports a MAC across a router;
• the router filed as assumed (the first usable address of the range), since the machine’s default route is not in it.

Turn on discovery.hops to record how many routers lie between the agent and each host.

A segment the machine has no address on

A machine with a leg on a VLAN but no address there — a trunk port with an unconfigured sub-interface — can still sweep it at layer 2. Name the interface:

infrality-agent run --interface eth0.20

or set scan.interface. ARP requests are then sent with an unspecified sender address, which is what a host with no lease is entitled to do.

Machines with several networks

An agent reports every IPv4 network its machine has an address on, including VPN and container bridges, and the dashboard offers them in the range field. Choosing one is a decision; the agent never picks for you beyond its default, which is the network of the interface carrying the default route.

Multicast discovery (mDNS, SSDP) is always sent from the interface that owns the range being swept, not along the default route — a VPN that grabs the default route would otherwise swallow it.

Sites and clients

• Several sites, one company: one organization, one agent per site, a board (or a folder of boards) per site.
• A managed service provider: one organization per client, so each client’s agents, keys, boards and people are separate; the workspace view looks across all of them. See concepts.

Size of a range

The ARP sweep is capped at 8192 addresses: ARP is a broadcast that reaches every machine on the segment, and a /12 of it would be a flood. Split large ranges between agents, or sweep them by ping only.