Every device on your network. Zero probes.
NS-Discovery builds a live asset inventory by listening to the traffic your devices already broadcast. No scanning, no agents, no vendor cloud. And every classification shows the evidence behind it.
- Safe for printers, PLCs & medical devices
- One Linux host, ~1 hour setup
- Data never leaves your network
| Device | IP | Site | Status |
|---|---|---|---|
| 10.0.4.21 | Boston | identified | |
| 10.0.4.57 | Boston | Windows 7 | |
| 10.0.9.140 | Warehouse | new | |
| 10.0.0.2 | HQ | identified | |
| 10.0.9.33 | Warehouse | unknown |
Why “HP LaserJet M404”?
2 independent signals · last seen 2 min ago
mDNS_ipp._tcp “HP LaserJet M404dn”DHCPvendor class “Hewlett-Packard JetDirect”MACa0:d3:c1 → HP Inc. (context only)
Decodes 13 discovery protocols
- ARP
- DHCP
- mDNS
- LLMNR
- NetBIOS
- SMB Browser
- SSDP
- LLDP
- CDP
- MNDP
- PROFINET
- EtherNet/IP
- BACnet
Who it’s for
Built for networks you can’t afford to scan.
Active scanners can crash fragile equipment and agents can’t be installed on a printer. Passive discovery works on everything that talks.
Healthcare & clinics
See infusion pumps, imaging and unmanaged IoT on the network without touching them. Keep an asset list your auditor can trace.
Manufacturing & OT
Inventory PLCs, HMIs and legacy controllers on isolated segments. Export files for air-gapped networks.
Offices & schools
Laptops, phones, printers, projectors and the device nobody admits to plugging in. A continuous inventory instead of a yearly spreadsheet.
MSPs
Drop a Sensor at each client, see every site in one Manager, hand over clean reports at onboarding and QBRs.
How it works
From a mirror port to an audit-ready inventory.
Two small programs that you run yourself. Each is a single binary with a built-in database. Nothing else to install.
Switch or SPAN port
Devices already announce themselves with DHCP, mDNS, LLDP and more. A mirror port gives full visibility; a plain port works too.
traffic
Listens and classifies
Decodes discovery protocols, keeps evidence per device and applies reviewed rules. Packets never leave the host.
Debian / Ubuntu · amd64, arm64mTLS 1.3
All sites in one place
Inventory, change feed, findings and reports for every site. SSO, roles, per-site access.
On-prem or your cloud VMExplainable by design
Every answer shows its work.
Other tools give you a guess and a confidence score. NS-Discovery shows the packet-level facts behind each label, so you can trust it, or prove it wrong.
- Evidence, not magicEach fact is stored with its source protocol and age.
- Fixed, reviewed rulesNo black-box ML. If the evidence isn’t there, the field says “unknown”.
- Auditor-friendlyThe same evidence goes into exported reports.
FRONTDESK-07
10.0.4.57 · 3c:52:82:1a:77:0e| Source | Observed | Age |
|---|---|---|
DHCP | Vendor class “MSFT 5.0”, parameter list of the Windows 7 generation | 4 min |
SMB | Browser announcement: Windows 6.1 workstation, workgroup CLINIC | 12 min |
MAC | 3c:52:82 registered to Dell Inc. (context) | — |
SSDP | Server: “Microsoft-Windows-NT/6.1 UPnP/1.0” | 1 h |
windows_browser_announcement · first seen Oct 14 · 3 IP changes in 30 daysWhat you get
Know what changed, not just what’s there.
Change feed
New, gone and changed devices, pushed to a webhook or your SIEM the moment they happen.
Outdated systems
Spot devices announcing an operating system past its end of support, like Windows 7 or Server 2012 R2.
IP history
Who had 10.0.4.57 last Tuesday at 3 pm? Answer incident questions by time and site.
Audit reports
Evidence mapped to NIST SP 800-171 3.4.1 and HIPAA asset inventory. Evidence, not a certification.
SSO & roles
OpenID Connect, four roles including read-only auditor, per-site access enforced on the server.
Fits your stack
Syslog / CEF, CSV export, CLI and API. Read-only Android app for on-call checks.
Compared
Why passive?
| Active scanner | Endpoint agent | NS-Discovery | |
|---|---|---|---|
| Traffic it generates | Probes every host | Agent check-ins | None on monitored segmentOptional ARP discovery, off by default |
| Sees IoT, printers, OT | Partly | No | Yes, if it talks |
| Safe for fragile equipment | Risky | N/A | Yes |
| Continuous change detection | Between scans | Yes | Yes, continuously |
| Install on every device | No | Yes | No, one host per segment |
Security
The least risky thing on your network.
A tool that maps your network shouldn’t become a way into it. Here’s exactly what it does, and what isn’t done yet.
Not done yet, and we’ll say so
- No SOC 2 report yet. Planned before any hosted offering.
- No third-party penetration test yet. Planned.
- We don’t host customer data, so there’s nothing of yours on our side.
Replay of recorded office and home traffic through the full Sensor pipeline on an Apple M3. A Linux x86 run is next.
Free pilot
One segment. One week. No contract.
We’re in early access and not selling yet. Pilots help us improve recognition. You keep the inventory and the report.
- Intro call 30 minTell us about your network. We tell you if it’s a fit.
- Install the Sensor ~1 hourA Debian package on any Linux host or VM in the segment.
- Let it listen ~7 daysIt transmits nothing onto the segment it watches.
- Review together 1 hourWalk through what it found, including what it couldn’t identify.
- Keep or removeKeep the report. apt remove removes everything.
Request a pilot
Write to us with a few lines. We reply within two business days.
- Your organizationAnd whether you are a managed service provider.
- SizeRoughly how many devices and sites.
- Network typeOffice, clinic, plant, school or a mix.
Only for networks you are authorized to monitor.
FAQ
Questions IT teams ask first
Does it really send nothing?
On the segment it monitors, the Sensor only listens. It does not scan, ping or probe. Two exceptions, both under your control: an optional local ARP discovery mode that is off until an operator enables it, and the Sensor’s outbound mTLS connection to your own Manager if you deploy one.
What hardware do I need?
Any Linux host or VM with 2 CPU cores and 2 GB of RAM on the segment you want to see. Debian and Ubuntu packages for amd64 and arm64. A SPAN/mirror port gives the best coverage, a regular access port also works.
Where does my data go?
Nowhere outside your infrastructure. The Sensor and Manager run on your hardware or in your own cloud account. We see only what you choose to show us on a call.
How is this different from Nmap, Lansweeper or an NAC?
Scanners send traffic to every host and only see what answers. Agents need installing on each device. NS-Discovery identifies devices from what they already broadcast, so it’s safe on fragile and unmanaged equipment and keeps watching continuously.
What will it cost after early access?
Pricing is not set yet, and we are not selling during early access. Pilots are free, and pilot participants hear about pricing first.
See your network as it really is.
Try it on one segment for a week. No purchase, no contract.