Netify Netify logo Contact Us
Products Resources Documentation Blog Sign In

Netify Device Discovery Plugin

The Netify Device Discovery Engine provides continuous, near real-time visibility into active devices across a local network. It enables precise asset tracking for both persistent infrastructure, such as desktops, printers, and routers, and transient devices, including smartphones, tablets, and IoT devices.

Operating as a lightweight edge plugin, the engine collects rich device fingerprinting signals directly from the host environment. The collected telemetry can be securely streamed to Netify Cloud, providing a turnkey device discovery solution without requiring integrators to develop their own fingerprinting infrastructure.

For greater control and integration flexibility, the same raw fingerprinting telemetry can also be streamed directly into your own analytics pipelines or third-party device identification platforms such as Lansweeper or Fingerbank.

MAC Attributes Telemetry
MAC attributes collected for the device discovery engine.
Device Discovery Telemetry
Analyzed devices that have been processed by device discovery.
Device Monitoring Blueprint
Provides an example on how to implement a customer-facing solution.

License

The Netify Device Discovery plugin is a proprietary plugin requiring a license. Please contact us for details.

Installation

Netify plugins are distributed through the same packaging workflow as the Netify Agent, allowing for a consistent installation experience using standard package manager syntax. While pre-compiled binaries are readily available for x86_64 architectures via our public mirrors, support for ARM, MIPS, and other specialized architectures is available upon request. Please contact us for details.

Step 1 - Select your installation target:

Step 2 - Add Netify's package signing key and repository:

Terminal - Netify
× 
sudo apt-get update
sudo apt-get -y install curl gnupg2
sudo curl https://download.netify.ai/5/debian/netify-archive-keyring.gpg -o /usr/share/keyrings/netify-archive-keyring.gpg
echo 'deb [signed-by=/usr/share/keyrings/netify-archive-keyring.gpg] http://download.netify.ai/5/debian/13/ /' | sudo tee /etc/apt/sources.list.d/netify.list

Step 3 - Install Netify Device Discovery:

Terminal - Netify
× 
sudo apt update
sudo apt install netify-proc-dev-discovery

Step 2 - Add Netify's package signing key and repository:

Terminal - Netify
× 
sudo apt-get update
sudo apt-get -y install curl gnupg2
sudo curl https://download.netify.ai/5/debian/netify-archive-keyring.gpg -o /usr/share/keyrings/netify-archive-keyring.gpg
echo 'deb [signed-by=/usr/share/keyrings/netify-archive-keyring.gpg] http://download.netify.ai/5/debian/12/ /' | sudo tee /etc/apt/sources.list.d/netify.list

Step 3 - Install Netify Device Discovery:

Terminal - Netify
× 
sudo apt update
sudo apt install netify-proc-dev-discovery

Step 2 - Add Netify's package signing key and repository:

Terminal - Netify
× 
sudo apt-get update
sudo apt-get -y install curl gnupg2
sudo curl https://download.netify.ai/5/ubuntu/netify-archive-keyring.gpg -o /usr/share/keyrings/netify-archive-keyring.gpg
echo 'deb [signed-by=/usr/share/keyrings/netify-archive-keyring.gpg] http://download.netify.ai/5/ubuntu/resolute/ /' | sudo tee /etc/apt/sources.list.d/netify.list

Step 3 - Install Netify Device Discovery:

Terminal - Netify
× 
sudo apt update
sudo apt install netify-proc-dev-discovery

Step 2 - Add Netify's package signing key and repository:

Terminal - Netify
× 
sudo apt-get update
sudo apt-get -y install curl gnupg2
sudo curl https://download.netify.ai/5/ubuntu/netify-archive-keyring.gpg -o /usr/share/keyrings/netify-archive-keyring.gpg
echo 'deb [signed-by=/usr/share/keyrings/netify-archive-keyring.gpg] http://download.netify.ai/5/ubuntu/noble/ /' | sudo tee /etc/apt/sources.list.d/netify.list

Step 3 - Install Netify Device Discovery:

Terminal - Netify
× 
sudo apt update
sudo apt install netify-proc-dev-discovery

Step 2 - Add Netify's package signing key and repository:

Terminal - Netify
× 
sudo apt-get update
sudo apt-get -y install curl gnupg2
sudo curl https://download.netify.ai/5/ubuntu/netify-archive-keyring.gpg -o /usr/share/keyrings/netify-archive-keyring.gpg
echo 'deb [signed-by=/usr/share/keyrings/netify-archive-keyring.gpg] http://download.netify.ai/5/ubuntu/jammy/ /' | sudo tee /etc/apt/sources.list.d/netify.list

Step 3 - Install Netify Device Discovery:

Terminal - Netify
× 
sudo apt update
sudo apt install netify-proc-dev-discovery

Step 2 - Add Netify's package signing key and repository:

Terminal - Netify
× 
sudo apt-get update
sudo apt-get -y install curl gnupg2
curl -fsSL https://download.netify.ai/5/ubuntu/apt-gpg-key-netify.asc | sudo apt-key add -
echo 'deb http://download.netify.ai/5/ubuntu/focal/ /' | sudo tee /etc/apt/sources.list.d/netify.list

Step 3 - Install Netify Device Discovery:

Terminal - Netify
× 
sudo apt update
sudo apt install netify-proc-dev-discovery

Step 2 - Add Netify's package signing key and repository:

Terminal - Netify
× 
wget https://download.netify.ai/5/openwrt/netify-6a0f68af.rsa.pub -O /etc/apk/keys/netify-6a0f68af.rsa.pub
echo 'https://download.netify.ai/5/openwrt/25.12/x86/packages.adb' >> /etc/apk/repositories.d/customfeeds.list

Step 3 - Install Netify Device Discovery:

Terminal - Netify
× 
apk update
apk add netify-proc-dev-discovery

Step 2 - Add Netify's package signing key and repository:

Terminal - Netify
× 
wget https://download.netify.ai/5/openwrt/key-build.pub -O /etc/opkg/keys/b18c240cb821dad2
echo 'src/gz netify https://download.netify.ai/5/openwrt/24.10/x86' >> /etc/opkg/customfeeds.conf

Step 3 - Install Netify Device Discovery:

Terminal - Netify
× 
opkg update
opkg install netify-proc-dev-discovery

Step 2 - Add Netify's package signing key and repository:

Terminal - Netify
× 
wget https://download.netify.ai/5/openwrt/key-build.pub -O /etc/opkg/keys/b18c240cb821dad2
echo 'src/gz netify https://download.netify.ai/5/openwrt/23.05/x86' >> /etc/opkg/customfeeds.conf

Step 3 - Install Netify Device Discovery:

Terminal - Netify
× 
opkg update
opkg install netify-proc-dev-discovery

Step 2 - Add Netify's package signing key and repository:

Terminal - Netify
× 
wget https://download.netify.ai/5/openwrt/key-build.pub -O /etc/opkg/keys/b18c240cb821dad2
echo 'src/gz netify https://download.netify.ai/5/openwrt/22.03/x86' >> /etc/opkg/customfeeds.conf

Step 3 - Install Netify Device Discovery:

Terminal - Netify
× 
opkg update
opkg install netify-proc-dev-discovery

Step 2 - Add Netify's package signing key and repository:

Terminal - Netify
× 
wget https://download.netify.ai/5/openwrt/key-build.pub -O /etc/opkg/keys/b18c240cb821dad2
echo 'src/gz netify https://download.netify.ai/5/openwrt/21.02/x86' >> /etc/opkg/customfeeds.conf

Step 3 - Install Netify Device Discovery:

Terminal - Netify
× 
opkg update
opkg install netify-proc-dev-discovery

Step 2 - Add Netify's package signing key and repository:

Terminal - Netify
× 
wget http://download.netify.ai/5/openwrt/key-build.pub -O /etc/opkg/keys/b18c240cb821dad2
echo 'src/gz netify http://download.netify.ai/5/openwrt/19.07/x86' >> /etc/opkg/customfeeds.conf

Step 3 - Install Netify Device Discovery:

Terminal - Netify
× 
opkg update
opkg install netify-proc-dev-discovery

Step 2 - Add Netify's package signing key and repository:

Terminal - Netify
× 
sudo rpm --import https://download.netify.ai/5/opensuse/15.6/stable/RPM-GPG-KEY-netify
sudo curl https://download.netify.ai/5/opensuse/netify.repo -o /etc/zypp/repos.d/repo-netify.repo

Step 3 - Install Netify Device Discovery:

Terminal - Netify
× 
sudo zypper update
sudo zypper install netify-proc-dev-discovery

Step 2 - Add Netify's package signing key and repository:

Terminal - Netify
× 
sudo rpm --import https://download.netify.ai/5/opensuse/15.5/stable/RPM-GPG-KEY-netify
sudo curl https://download.netify.ai/5/opensuse/netify.repo -o /etc/zypp/repos.d/repo-netify.repo

Step 3 - Install Netify Device Discovery:

Terminal - Netify
× 
sudo zypper update
sudo zypper install netify-proc-dev-discovery

Step 2 - Add Netify's package signing key and repository:

Terminal - Netify
× 
sudo rpm --import https://download.netify.ai/5/almalinux/9/stable/RPM-GPG-KEY-netify
sudo curl https://download.netify.ai/5/almalinux/9/netify.repo -o /etc/yum.repos.d/netify.repo

Step 3 - Install Netify Device Discovery:

Terminal - Netify
× 
sudo yum update
sudo yum install netify-proc-dev-discovery

Step 2 - Add Netify's package signing key and repository:

Terminal - Netify
× 
sudo rpm --import https://download.netify.ai/5/almalinux/8/stable/RPM-GPG-KEY-netify
sudo curl https://download.netify.ai/5/almalinux/8/netify.repo -o /etc/yum.repos.d/netify.repo

Step 3 - Install Netify Device Discovery:

Terminal - Netify
× 
sudo yum update
sudo yum install netify-proc-dev-discovery

Step 2 - Add Netify's package signing key and repository:

Terminal - Netify
× 
sudo rpm --import http://download.netify.ai/5/rockylinux/9/stable/RPM-GPG-KEY-netify
sudo curl https://download.netify.ai/5/rockylinux/9/netify.repo -o /etc/yum.repos.d/netify.repo

Step 3 - Install Netify Device Discovery:

Terminal - Netify
× 
sudo yum update
sudo yum install netify-proc-dev-discovery

Step 2 - Add Netify's package signing key and repository:

Terminal - Netify
× 
sudo rpm --import http://download.netify.ai/5/rockylinux/8/stable/RPM-GPG-KEY-netify
sudo curl https://download.netify.ai/5/rockylinux/8/netify.repo -o /etc/yum.repos.d/netify.repo

Step 3 - Install Netify Device Discovery:

Terminal - Netify
× 
sudo yum update
sudo yum install netify-proc-dev-discovery

Step 2 - Add Netify's package signing key and repository:

Terminal - Netify
× 
mkdir -p /usr/local/etc/pkg/fingerprints/Netify/trusted
curl https://download.netify.ai/5/opnsense/fingerprint -o /usr/local/etc/pkg/fingerprints/Netify/trusted/fingerprint
cat << EOF >  /usr/local/etc/pkg/repos/Netify.conf
Netify: {
  fingerprints: "/usr/local/etc/pkg/fingerprints/Netify",
  url: "https://download.netify.ai/5/opnsense/25.7",
  signature_type: "fingerprints",
  mirror_type: "http",
  priority: 11,
  enabled: yes
}
EOF

Step 3 - Install Netify Device Discovery:

Terminal - Netify
× 
pkg update
pkg install netify-proc-dev-discovery

Step 2 - Add Netify's package signing key and repository:

Terminal - Netify
× 
mkdir -p /usr/local/etc/pkg/fingerprints/Netify/trusted
curl https://download.netify.ai/5/opnsense/fingerprint -o /usr/local/etc/pkg/fingerprints/Netify/trusted/fingerprint
cat << EOF >  /usr/local/etc/pkg/repos/Netify.conf
Netify: {
  fingerprints: "/usr/local/etc/pkg/fingerprints/Netify",
  url: "https://download.netify.ai/5/opnsense/24.7",
  signature_type: "fingerprints",
  mirror_type: "http",
  priority: 11,
  enabled: yes
}
EOF

Step 3 - Install Netify Device Discovery:

Terminal - Netify
× 
pkg update
pkg install netify-proc-dev-discovery

Step 2 - Add Netify's package signing key and repository:

Terminal - Netify
× 
mkdir -p /usr/local/etc/pkg/fingerprints/Netify/trusted
curl https://download.netify.ai/5/freebsd/fingerprint -o /usr/local/etc/pkg/fingerprints/Netify/trusted/fingerprint
cat << EOF >  /usr/local/etc/pkg/repos/Netify.conf
Netify: {
  fingerprints: "/usr/local/etc/pkg/fingerprints/Netify",
  url: "https://download.netify.ai/5/freebsd/15.0",
  signature_type: "fingerprints",
  mirror_type: "http",
  priority: 11,
  enabled: yes
}
EOF

Step 3 - Install Netify Device Discovery:

Terminal - Netify
× 
pkg update
pkg install netify-proc-dev-discovery

Step 2 - Add Netify's package signing key and repository:

Terminal - Netify
× 
mkdir -p /usr/local/etc/pkg/fingerprints/Netify/trusted
curl https://download.netify.ai/5/freebsd/fingerprint -o /usr/local/etc/pkg/fingerprints/Netify/trusted/fingerprint
cat << EOF >  /usr/local/etc/pkg/repos/Netify.conf
Netify: {
  fingerprints: "/usr/local/etc/pkg/fingerprints/Netify",
  url: "https://download.netify.ai/5/freebsd/14.0",
  signature_type: "fingerprints",
  mirror_type: "http",
  priority: 11,
  enabled: yes
}
EOF

Step 3 - Install Netify Device Discovery:

Terminal - Netify
× 
pkg update
pkg install netify-proc-dev-discovery

Step 2 - Add Netify's package signing key and repository:

Terminal - Netify
× 
mkdir -p /usr/local/etc/pkg/fingerprints/Netify/trusted
curl https://download.netify.ai/5/freebsd/fingerprint -o /usr/local/etc/pkg/fingerprints/Netify/trusted/fingerprint
cat << EOF >  /usr/local/etc/pkg/repos/Netify.conf
Netify: {
  fingerprints: "/usr/local/etc/pkg/fingerprints/Netify",
  url: "https://download.netify.ai/5/freebsd/14.0",
  signature_type: "fingerprints",
  mirror_type: "http",
  priority: 11,
  enabled: yes
}
EOF

Step 3 - Install Netify Device Discovery:

Terminal - Netify
× 
pkg update
pkg install netify-proc-dev-discovery

Setup

To use the Netify Device Discovery plugin, ensure your license.json includes the netify-proc-dev-discovery entitlement.

All plugins are disabled by default, and the Netify Device Discovery plugin is no different. Use netifyd's --enable-plugin and --disable-plugin flags to enable or disable the plugin.

Terminal - Netify
× 
netifyd --enable-plugin proc-dev-discovery  # Enables loader
netifyd --disable-plugin proc-dev-discovery # Disables loader

For orchestration tools or manual setup, you can also directly update configuration file in the plugins.d subdirectory and set enable to yes.

See the advanced configuration section for details on instantiating multiple instances of the plugin.

Terminal - Netify
× 
$ cat 10-netify-proc-dev-discovery.conf
[proc-dev-discovery]
enable = yes
plugin_library = /usr/lib64/libnetify-proc-dev-discovery.so.0.0.0
conf_filename = ${path_state_persistent}/netify-proc-dev-discovery.json

AI Integration

For AI integration and machine learning models, the Netify Device Discovery Configuration JSON schema is available for reference.

Modes

Netify's Device Discovery Engine offers two flexible deployment modes designed to match your security policies, hardware constraints, and data pipeline requirements. Whether deploying across air-gapped industrial sites or streaming data into an established cloud platform, select the mode that best aligns with your infrastructure.

Netify Cloud Engine

The Netify Cloud mode provides a zero-code, SaaS-driven model engineered for rapid deployment and maximum recognition accuracy.

Architectural Fit
Cloud-managed CPEs, enterprise Wi-Fi solutions, and SaaS network management dashboards.
Capabilities
Offloads heavy payload inspection to Netify Cloud, matching telemetry against global device signatures.
Key Advantage
Maximum device identification rates with zero local signature file overhead.

Telemetry Streaming

Telemetry Streaming is designed for engineering teams with established data lakes or third-party fingerprinting subscriptions, e.g., Lansweeper and Fingerbank.

Architectural Fit
Direct ingestion into internal analytics platforms or SIEM systems.
Capabilities
Feeds raw, unparsed device telemetry directly to custom pipelines via open APIs.
Key Advantage
Eliminates vendor lock-in by giving you full control over raw telemetry.

Main Configuration

The plugin is configured via the JSON file referenced by its loader (typically /etc/netifyd/netify-proc-dev-discovery.json ).

format

string

The default serialization format for the data payload.

Options:
json msgpack

compressor

string

The default compression algorithm applied to the payload.

Options:
none gz

confidence_policy

object

Confidence threshold policy object.

confidence_policy.max

integer

Confidence threshold (0-100) required before discovery stops for a device.

Default:
80

confidence_policy.update_ttl

integer

Seconds an entry is re-analyzed even if above confidence level. 0 to never re-analyze.

Default:
0

macs_policy

integer

Maximum number of MAC addresses to track in memory. 0 for unlimited.

Default:
0

mac_age_policy

integer

Maximum idle time (seconds) before a MAC address entry is purged from memory.

Default:
172800

http

object

HTTP collection policy object.

http.user_agents_policy

object

Policy for managing HTTP user agent strings on any given MAC address.

http.user_agents_policy.max

integer

Maximum number of entries to retain.

Default:
10

http.user_agents_policy.update_min

integer

Minimum seconds between updates to an existing entry.

Default:
0

http.user_agents_policy.update_ttl

integer

Seconds an entry is retained since its last update before expiring.

Default:
0

mdns

object

mDNS collection policy object.

mdns.answers_policy

object

Policy for managing mDNS answer (PTR service instance name) strings on any given MAC address.

mdns.answers_policy.max

integer

Maximum number of entries to retain.

Default:
10

mdns.answers_policy.update_min

integer

Minimum seconds between updates to an existing entry.

Default:
0

mdns.answers_policy.update_ttl

integer

Seconds an entry is retained since its last update before expiring.

Default:
0

ssdp

object

SSDP collection policy object.

ssdp.user_agents_policy

object

Policy for managing SSDP user agent strings on any given MAC address.

ssdp.user_agents_policy.max

integer

Maximum number of entries to retain.

Default:
10

ssdp.user_agents_policy.update_min

integer

Minimum seconds between updates to an existing entry.

Default:
0

ssdp.user_agents_policy.update_ttl

integer

Seconds an entry is retained since its last update before expiring.

Default:
0

client_ja4_policy

object

Policy for managing JA4 client hashes on any given MAC address.

client_ja4_policy.max

integer

Maximum number of entries to retain.

Default:
10

client_ja4_policy.update_min

integer

Minimum seconds between updates to an existing entry.

Default:
0

client_ja4_policy.update_ttl

integer

Seconds an entry is retained since its last update before expiring.

Default:
0

path_device_cache

string

Filesystem path for persistent device cache.

process_all_macs

boolean

If true, also creates a minimal device entry (MAC and one IP address only, no fingerprint data) for the counterparty MAC on each flow, not just the fully profiled origin MAC.

Default:
false

device_mac_ignore

array

List of MAC addresses to exclude from discovery.

device_mac_ignore_group

string

Filesystem path to a group file containing MAC addresses to exclude from discovery.

netify_api

object

Netify API object definition.

netify_api.enable

boolean

Enables or disables this Netify Cloud discovery engine.

Default:
false

sinks

object

Sink configuration.

Reference:
See Sink Configuration section below

Example: netify-proc-dev-discovery.json

{
  "compressor": "gz",
  "format": "json",
  "confidence_policy": {
    "max": 80,
    "update_ttl": 86400
  },
  "macs_policy": 1500,
  "mac_age_policy": 4147200,
  "path_device_cache": "${path_state_persistent}/device-discovery-cache.json",
  "device_mac_ignore": [
    "00:00:00:00:00:00",
    "ff:ff:ff:ff:ff:ff"
  ],
  "http": {
    "user_agents_policy": {
      "max": 10
    }
  },
  "mdns": {
    "answers_policy": {
      "max": 10
    }
  },
  "ssdp": {
    "user_agents_policy": {
      "max": 10
    }
  },
  "client_ja4_policy": {
    "max": 10,
    "update_min": 1,
    "update_ttl": 3600
  },
  "netify_api": {
    "enable": true
  },
  "sinks": {
    "sink-log": {
      "mac_attributes": {
        "type": "mac_attributes",
        "enable": true,
        "flush": true,
        "format": "json",
        "compressor": "none"
      },
      "device_discovery": {
        "type": "device_discovery",
        "enable": true,
        "flush": true,
        "format": "json",
        "compressor": "none"
      }
    }
  }
}

Sink Configuration

We need to send our telemetry to a configured output using a Sink Plugin: log, socket, message queue, etc. This sink configuration is highly flexible, but it can also be easy to misconfigure if the relationships between components are not clear. Let's get started.

Sink Tag - First Level Key

The Device Discovery Processor's sinks object determines which sinks (outputs) receive the telemetry data and how the data should be sent to each one. A single processor can send data to multiple sinks, but in this example it is configured to send to only one.

The sink tag is the first-level key under the sinks property. This key must match the section name defined by the corresponding plugin loader. In our example, the sink tag is sink-log , which must exactly match the loader section name sink-log as shown below:

Sinks Configuration - Overview

"sinks": {
    "sink-log": {
        "devices": {
            "enable": true,
            ... other properties ...
        }
    }
}
Terminal - Netify
× 
$ cat /etc/netifyd/plugins.d/10-netify-sink-log.conf
[sink-log]
enable = yes
plugin_library = /usr/lib64/libnetify-sink-log.so.0.0.0
conf_filename = ${path_state_persistent}/netify-sink-log.json

Here we can see that the section name [sink-log] matches the sink tag used in the Device Discovery configuration. The presence of this configuration file indicates that the plugin has been installed, and the enable = yes setting confirms that it is currently enabled. The loader configuration also specifies the sink's runtime configuration file through the conf_filename property.

This mapping is critical: if the names do not match, the processor will not be able to deliver data to the sink.

The Channel - Second Level Key

The second-level key in JSON configuration is the channel. Sink output channels provide a way to separate different types of telemetry into different output targets. For example, you can send:

  • aggregator data to /tmp/netify-aggregate-x
  • interface statistics to /tmp/netify-interface-stats-x
  • intelligence detections to /tmp/netify-intelligence-x

This channel must be configured in the target sink configuration as shown.

Refer to the relevant Sink Plugin configuration for channel configuration details.

Sink Log Config: /etc/netifyd/netify-sink-log.json

{
    "overwrite": false,
    "log_path": "/tmp",
    "channels": {
        "devices": {
            "overwrite": true,
            "log_path": "/tmp",
            "log_name": "netify-devices-"
        }
    }
}

Channel Properties

enable

boolean

Enables or disables this specific sink channel.

Default:
true

type

string

The telemetry type this channel receives. Defaults to the channel's own key name if omitted, so it only needs to be set explicitly when the channel key isn't itself "mac_attributes" or "device_discovery".

Options:
mac_attributes device_discovery

format

string

The serialization format for the data payload.

Options:
json msgpack

compressor

string

The compression algorithm applied to the payload.

Options:
none gz

flush

boolean

The flush policy.

Default:
false

Example Sinks Configuration

{
    ...
    "sinks": {
        "sink-log": {
            "devices": {
                "enable": true,
                "flush": true,
                "format": "json",
                "compressor": "none"
            }
        }
    }
}

Policies

Counterparty MAC Collection

For every flow, Device Discovery fully profiles one side - the origin MAC - attributing all available fingerprint data to it: DHCP vendor/hostname, HTTP user agent, JA4 client hash, mDNS, and SSDP. The MAC on the other side of that flow (the counterparty) is not tracked or reported by default.

Enabling process_all_macs (default false) extends discovery to also record counterparty MACs - devices that only ever appear on the receiving end of a flow and never initiate one, and so would otherwise never surface in Device Discovery at all. This comes at the cost of much thinner data: a counterparty entry only ever contains the MAC address and a single IP, with none of the fingerprint data collected for a fully profiled device, since fingerprints are only ever attributed to the origin side of a flow.

A counterparty entry is also a one-time submission rather than an ongoing profile: once it has been reported, it is not created again, even if the device is later seen on the counterparty side of further flows. If it later appears as an origin MAC in its own right, it will instead be picked up and fully profiled through the normal discovery process described above.

Devices excluded via device_mac_ignore or device_mac_ignore_group are never created as counterparty entries, regardless of this setting.

Fingerprint and Agent Policies

Four properties control how many distinguishing fingerprints the Device Discovery plugin retains per device:

  • max_ja4_clients
  • max_mdns_services
  • max_http_user_agents
  • max_ssdp_user_agents

Each is configured as an object with the following attributes:

max
The maximum number of entries to retain per device. When a new, previously unseen value is discovered after the limit has been reached, the oldest entry is evicted to make room for it. A higher value reduces event volume for fingerprints that recur often, such as JA4 client hashes, at the cost of retaining more state per device.
update_min
Squelches repeat events for an existing entry. Renewed activity observed before this many seconds have elapsed since its last update will not trigger a new event.
update_ttl
Forces a refresh of an existing entry after this many seconds, regardless of whether new activity has been observed since the last one.