10 types of CMDB discovery techniques you must know

Table of Contents

• 10 discovery techniques that help you populate your CMDB
  • Ping Sweep Method
  • Domain Name Service (DNS) Method
  • Secure Shell (SSH) Method
  • Windows Management Instrumentation (WMI)
  • Simple Network Management Protocol (SNMP)
  • Netflow
  • Network Mapper (NMAP)
  • Packet Capture Method
  • Intelligent Platform Management Interface (IPMI)
  • Configuration Automation Tools
• Create a comprehensive and accurate CMDB with Virima

As an IT asset manager, you must maintain a complete and up-to-date picture of your organization’s assets, their locations, and their usage. You can do this by using a Configuration Management Database (CMDB). These powerful databases help track all components involved in providing IT services and can be incredibly valuable for managing complex infrastructures. 

It acts as a centralized repository of all the information about your IT environment. It contains details of all your organization’s services, applications, and devices. The CMDB helps you to manage changes across the IT landscape efficiently and make intelligent data-driven decisions. 

The discovery or mapping process of a CMDB is essential to ensure complete coverage of network infrastructure components like servers, switches, routers, and more. This is why you need to understand how to discover your assets and determine which methods work best for your IT environment.

This article will discuss ten CMDB discovery techniques you must know about as an IT asset manager. You will learn why each method is important and how to get real value from your CMDB.

10 discovery techniques that help you populate your CMDB

Here are ten discovery techniques you can use to create an accurate and up-to-date CMDB:

Ping Sweep Method

IT professionals commonly use Ping sweep discovery, or ICMP scanning, to populate their CMDB with accurate IT asset data. This technique sends a series of ping messages from a single device to known network segments, waiting for a ping response acknowledgment.

Receiving a response indicates active connection of a specific IP address on the network segment. They can quickly perform this process to discover all connected devices on the network. Thus eliminating the need for special software or authentication credentials.

However, this method has some shortcomings due to its simplicity and speed. For example, not all devices may support or have enabled ping responses, which means they will not appear during sweep discovery. Additionally, the central device might not reach a few segments, leading to their inaccurate detection. 

Also, correlating a specific device with an IP address requires an accurate reverse domain name service (DNS) lookup, which adds complexity to the process and increases its accuracy depending on the quality of DNS records for those addresses. Despite these limitations, Ping Sweep is an effective method for quickly populating CMDBs with reliable IT asset data.

Domain Name Service (DNS) Method

DNS discovery entails consulting a register to find the host name of an asset identified by a ping sweep. The accuracy of this DNS lookup depends greatly on the proper configuration of DNS records stored in the organization’s servers. These records, linking domain names to associated IP addresses, require administrators to update them regularly and accurately. Any discrepancies can lead to errors, such as failing requests or long delays in loading webpages. 

In addition, maintaining accurate DNS records can also help improve network security and usability. By having up-to-date information available about active systems on the network, admins can better protect against malicious actors attempting to exploit known vulnerabilities in outdated systems. 

At the same time, they can provide employees quicker access to needed resources if they know exactly which hosts are available and at what IP addresses they are located. As such, companies must use efficient DNS discovery approaches if they want to ensure accurate data is added to their CMDBs.

Secure Shell (SSH) Method

Secure Shell (SSH) is a powerful discovery technique that allows for secure remote access to Linux and UNIX systems, effectively capturing asset data without relying on network bandwidth. 

If valid credentials are available, users can access the system and use shell commands to capture information about the device configuration, settings, and state of operation. SSH also encrypts all communication, making it a safe and secure way to connect remotely. It benefits organizations seeking to comply with security regulations or protect sensitive data from unauthorized access. 

Plus, many distributions of Linux have SSH enabled by default, meaning that no additional configuration is required for users to take advantage of this discovery technique. Using Secure Shell (SSH) for device discovery in their CMDB can help ensure that users have reliable and up-to-date IT asset data at all times.

Windows Management Instrumentation (WMI)

WMI is a powerful discovery technique to obtain system data from a Microsoft Windows OS host. It is possible to gain remote access by adjusting the Windows Firewall and User Account Control (UAC) settings to enable remote connections. Accessing WMI requires credentials, and the results of queries enable users better to understand the system’s configuration and the associated assets.

The data gathered from WMI can help provide an overview of hardware, software, and environment-related information, such as what applications are installed on each system, how they are configured, if they are up-to-date, or who has logged in recently. 

It helps create a comprehensive view of all assets within an organization, which is beneficial for asset management and auditing purposes. Additionally, WMI provides detailed information about operating system versions, making it easier for IT staff to identify systems that require security patches or updates. 

It also allows user scripts to be formed using Visual Basic Script (VBS), PowerShell, or other scripting languages—giving users further control over their CMDB population process and enabling them to make decisions based on specific variables. WMI also permits remote execution on machines, thus also allowing for automated remediation tasks like patch installation or restarting services, creating an additional layer of automation in the asset management process.

Simple Network Management Protocol (SNMP)

SNMP helps users quickly inventory their IT assets and monitor performance without manual intervention. Using SNMP, users can query their networked devices and get comprehensive information about the resources connected to the system. 

It includes detailed information such as installed software version, serial number, manufacturer details, and more. It also allows users to gather data on the system’s memory, CPU utilization, bandwidth usage, and other mission-critical metrics that help measure performance. 

Additionally, SNMP offers authentication and encryption, which give users better control over their systems. The extensibility of SNMP makes it possible to customize it according to the specific needs of each organization while supporting industry standards compliance. 

It is also cost-effective since most network devices support SNMP out of the box, making implementation relatively straightforward. All these factors make SNMP an important discovery technique for populating CMDBs with accurate IT asset data.

Netflow

Netflow discovery is a powerful technique for users to populate their CMDBs with accurate IT asset data. By capturing packets that come and go through the network, and recording information like Transmission Control Protocol (TCP) ports, it helps identify the applications being used on the network. Using the IP Flow Information Export (IPFIX) standard, users can gain valuable insights about application packets within theirnetwork. It is a fast way to obtain an up-to-date snapshot of what IT assets are present at any given time.

Due to its resource-intensive nature, Netflow may need to be disabled or tuned down. However, it remains one of the most reliable methods for discovering IT assets and monitoring their traffic and performance in real time. It offers a full range of information from layer 2 MAC addresses to layer seven application names and destination ports.

Even more granular information, such as latency times or packet size, can be obtained using special tools such as sFlow or J-Flow. This is why Netflow discovery is invaluable for keeping track of IT assets and optimizing their performance accordingly.

Network Mapper (NMAP)

Network Mapper (NMAP) uses an efficient port scanner to detect which services are running on a given target host, enabling admins to have detailed knowledge of the assets in their environment. 

NMAP scans can also be used to fingerprint applications and operating systems, map out network topology, and discover devices on the network. With its ability to run across multiple protocols, NMAP allows users to determine which ports are open, closed, or filtered by firewalls. Its output can also triangulate service-to-port mappings and scan configuration data for further verification. 

It is crucial to ensure the accuracy of data collected through NMAP scans as they are regularly updated against live networks and performed with the latest version of the software—this will allow users to stay up-to-date with changes made on their networks over time. Additionally, it is recommended that users supplement the results from NMAP scans with other tools, like NetFlow or Packet Sniffers, for added accuracy.

Packet Capture Method

The Packet Capture discovery technique allows users to identify the exact network traffic and applications communicating over a network. Using that data, it maps it back to separate IP addresses and ports. 

It is instrumental in identifying malicious or anomalous activities that might be happening on the network. As this type of capture is resource intensive, it can be enabled selectively based on user needs and preferences. Packet capture works by capturing the packet payloads that are transferred. 

It provides a much more granular level of detail that you can use to determine what applications are running and how they are configured, what types of services they use, and how they communicate with other devices in the environment. 

Plus, packet capture has been used for analyzing specific protocols such as HTTP or FTP, providing even more insight into how a particular application behaves over time. By leveraging this analysis technique, administrators will have detailed visibility into their networks, enabling them to better understand their IT assets in terms of performance and security posture.

Intelligent Platform Management Interface (IPMI)

IPMI is an effective discovery technique that uses a computer’s baseboard management controller to gather configuration item (CI) details. While this method can be challenging for those with less experience configuring it, the time-saving benefits can outweigh any potential security risks if configured correctly. 

In addition to discovering hardware information, IPMI also monitors the health status of systems and components. IT administrators can proactively identify issues before they become a larger problem by providing near real-time data on system performance or abnormal behavior. The interface provides users with detailed event logs that can be used in root cause analysis or as part of incident reports. However, it can introduce vulnerabilities if not implemented correctly.

Overall, IPMI is an effective tool that can help streamline the process of populating a CMDB while providing insights into system health and performance across multiple hosts.

Configuration Automation Tools

These tools install agents on hosts to collect detailed system configuration information, like OS patch version, ensuring that the CMDB is up-to-date and reflects changes in the environment. 

In addition to patch versions, it also detects and stores granular CI details like hardware details, and more. It allows organizations to accurately track their IT assets over time and ensure no changes have gone undocumented in their CMDB. Plus, it actively uses the data stored in its repositories, so users can trust that it is reliable. 

This is an uncommon method as administrators might not install these agents. So, you should always use them to supplement data from other discovery techniques.

Create a comprehensive and accurate CMDB with Virima

CMDBs are a valuable resource for IT managers, and the ten discovery techniques discussed can help them to populate their CMDB with accurate and up-to-date data. 

These techniques include automated network discovery tools, conducting manual surveys, using asset management systems, analyzing service desk tickets, leveraging third-party vendor data, and more. Collecting accurate data for a CMDB is a complex task that requires careful analysis and thoughtful decision-making. 

However, if IT managers employ these discovery techniques strategically, they can create an effective CMDB that contains relevant and helpful information about their IT infrastructure. This will give them the insight to manage their organization’s technology environment better.

Asset discovery tools like Virima use a combination of these discovery techniques to help you gather the most comprehensive and accurate asset data. With features like automated discovery, real-time service maps, integrations with leading vulnerability databases, and ITIL compliance, you can protect your infrastructure while accessing an accurate asset inventory at all times.Book a demo with Virima now, and we will show you our discovery process and CMDB work.