Netify Netify logo Contact Us
Products Resources Documentation Blog Sign In

Device Discovery Telemetry

The Device Discovery Plugin provides telemetry record reports the Agent's per-device identification results for hosts observed on the local network. Emitted as a snapshot keyed by MAC address, each entry combines an IEEE OUI vendor lookup with the DPI engine's device-discovery identification — label, device type, and operating system — plus change-tracking status flags for new and updated devices.

Use Device Discovery telemetry to build a live device inventory, enrich network dashboards with vendor and OS context, and detect newly connected or changed devices in real time. Our Device Monitoring Blueprint provides an example on how to implement a customer-facing solution.

Data Policy

A device is included in a Device Discovery batch once per Agent update interval (default: 15 seconds) whenever new information has been observed. This includes a new IP address, a new or changed DHCP field, or a new entry in its HTTP, JA4, mDNS, or SSDP data. A device's first observed network activity also counts as an update. As a result, a newly discovered device appears in the next batch even if no protocol-specific metadata has been collected yet.

Configure the device_discovery Sink configuration to stream the Device Discovery results.

Example: Send Device Discovery Telemetry

"sinks": {
  "sink-mqtt": {
    "device_discovery": {
      "type": "device_discovery",
      "enable": true,
      "flush": true,
      "format": "json",
      "compressor": "none"
    }
  }
}

Optimizations

The Device Discovery telemetry sets the is_agent_mac flag to true for MAC addresses that belong to the system running the Netify Agent. For these entries, Device Discovery returns a generic device label (discovery.label ): Agent Device.

We recommend overriding this label with your own branding. You can also add network interface details that your platform manages, so end users can tell at a glance which entry is your gateway or appliance and which network it serves. For example:

  • Brand — LAN
  • Brand — Guest Network

Example: Agent MAC Entry

{
  "is_agent_mac": true,
  "discovery": {
    "label": "Agent Device",
    ...
  },
  ...
}

Requirements

Source
Device Discovery Plugin
Plugin Release
1.2.12

Device Discovery Attributes

discovery

object
The Device Discovery identification result. Present only once a determination has been made for the device.

discovery.entity

object
A known Netify entity (application) match. May or may not be present on discovery.
Reference: Application (Entity) Lists

discovery.entity.id

integer
The ID number associated with the entity.

discovery.entity.tag

string
The tag associated with the entity, e.g. "netify.whatsapp".

discovery.label

string
Human-readable device label, e.g. "Galaxy Tab A".

discovery.os

object
The discovered device's operating system.

discovery.os.id

integer
The operating system ID.

discovery.os.tag

string
The operating system tag.

discovery.os.version

string
The operating system version. Omitted when unknown.

discovery.score

integer
Identification confidence score.

discovery.type

object
The discovered device's type.

discovery.type.id

integer
The device type ID.

discovery.type.tag

string
The device type tag.

event

string
Discovery lifecycle event.
Values:
new update no_change

is_agent_mac

boolean
True when this MAC address belongs to the interface the Agent itself is running on.

is_hardware_mac

boolean
True if the MAC is a burned-in hardware MAC, not a virtual or randomized address.

is_multicast

boolean
True if the MAC is a multicast address.

oui

object
IEEE OUI vendor lookup for the MAC's prefix. Omitted entirely when the MAC is randomized.
Reference: MAC OUIs

oui.entity

object
A known Netify entity (application) match. May or may not be present on discovery.
Reference: Application (Entity) Lists

oui.entity.id

integer
The ID number associated with the entity.

oui.entity.tag

string
The tag associated with the entity, e.g. "netify.whatsapp".

oui.prefix

string
The MAC's OUI prefix, e.g. "74:e2:0c".

oui.type

string
IEEE registry block type, e.g. "MA-L".
Values:
CID IAB MA-L MA-M MA-S

oui.vendor

string
Vendor name from the OUI registry.

Device Discovery JSON Example

{
  "devices": {
    "c2:54:46:ae:90:ab": {
      "discovery": {
        "entity": {
          "id": 178,
          "tag": "netify.amazon"
        },
        "label": "Amazon Fire TV",
        "os": {
          "id": 600,
          "tag": "android",
          "version": "v13-Pro"
        },
        "score": 35,
        "type": {
          "id": 1300,
          "tag": "tv"
        }
      },
      "event": "new",
      "is_agent_mac": false,
      "is_hardware_mac": false,
      "is_multicast": false,
      "oui": {
        "entity": {
          "id": 178,
          "tag": "netify.amazon"
        },
        "prefix": "74:e2:0c",
        "type": "MA-L",
        "vendor": "Amazon Technologies"
      }
    }
  },
  "type": "device_discovery"
}