Port probes

  • Release version: Yokohama
  • Updated January 30, 2025
  • 2 minutes to read
    • Summarize
    Summarized using AI
    This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.

    Summary of Port probes

    Port probes are integral to the Discovery process in ServiceNow, used by the Shazzam probe to detect protocol activity on open ports of devices within your network. When an open port is detected, the Shazzam sensor refers to the port probe record to decide which classification probe to launch, enabling accurate device classification based on active protocols such as WMI, SSH, SNMP, and HTTP.

    Show full answer Show less

    Key Features

    • Protocol Priority: Discovery launches classification probes in a priority order—WMI first, then SSH, followed by SNMP, and finally HTTP. If a higher-priority probe (e.g., WMI) succeeds, lower-priority probes are skipped for that device.
    • Port Probe Form: Accessible via Discovery Definition > Port Probes, this form allows configuration of port probes, including naming, description, scanner technique, and enabling or disabling probes for Configuration Items (CIs) or IP addresses.
    • Multiple Classification Probes: You can link multiple classification probes to a single port probe, allowing fallback options if one classification fails, which enhances Discovery performance.
    • Trigger and Conditional Probes: Supports defining services that trigger port usage and conditional probes that run only if certain non-conditional probes detect open ports, optimizing resource use.
    • Supplementary Classifications: Allows launching additional classifications after the highest priority identification to refine device details.
    • Shazzam Probe Role: The Shazzam probe performs the initial port scanning on specified IP ranges, forming the foundation of the Discovery process.
    • Payload Optimization: For large IP ranges, the Shazzam payload can be configured for JSON encoding to reduce scanning data size and improve efficiency.

    Practical Application for ServiceNow Customers

    Understanding port probes enables you to customize and optimize the Discovery process to accurately identify devices and their protocols on your network. By configuring port probes and their priority, you can control the order of protocol checks, reducing unnecessary scans and improving discovery performance. Linking multiple classification probes ensures robust device classification even if some protocols fail to respond.

    Using the Port Probe form, you can tailor discovery settings to your environment, including enabling probes specific to your needs, defining custom triggers for non-standard ports, and managing conditional probes to conserve resources.

    Finally, configuring the Shazzam probe effectively, especially regarding IP ranges and payload encoding, helps you scale Discovery across large networks while maintaining performance.

    Port probes are used in Discovery by the Shazzam probe to detect protocol activity on open ports on devices it encounters.

    When a port probe encounters a protocol in use, the Shazzam sensor checks the port probe record to determine which classification probe to launch. The common protocols WMI, SSH, SNMP, and HTTP in the base system have priority numbers that control the order in which they are launched.

    The priority is as follows:

    • 1 - WMI
    • 2 - SSH
    • 3 - SNMP
    • 4 - HTTP

    In the base system, the WMI probe is always launched first, and if it is successful on a device, no other port probes are launched for that device. If the WMI probe is not successful, then the SSH probe is launched to gather information on the device. If it is not successful, the SNMP probe is launched. This method allows Discovery to classify a device correctly if the device is running more than one protocol (for example, SSH, SNMP, and HTTP).

    Discovery Port Probe form

    To access the Port Probe form, navigate to Discovery Definition > Port Probes.

    To add multiple classification probes to a port probe, create a link between the port probe and the actual classification probe itself. See the bottom of the form to add additional Trigger probes. That way, if one classification fails, it does not affect the others, thus Discovery performance may be enhanced.
    Discovery port probe form
    The Port Probe form provides the following fields:
    Table 1. Port probes
    Field Input Value
    Name Simple name for the port probe that reflects its function (for example, SNMP).
    Description Definition of the acronym for the protocol. (For example, SSH is Secure Shell login).
    Scanner Shazzam techniques for exploring a port. Some of these are protocol-specific, and others are generic. For example, a WMI port probe uses a Scanner value of Generic TCP, and the SNMP port probe uses a value of SNMP.
    Active Indicates whether this port probe is enabled or disabled.
    CIs Indicates whether this port probe is enabled or disabled for discovering Configuration Items.
    IPs Indicates whether this port probe is enabled or disabled for discovering IP addresses.
    Triggered by services Indicates which services define the port usage. Use this setting to define non-standard port usage and pair the port number with the protocol.
    Use classification Names the appropriate classification table, based on the protocol being explored.
    Classification priority

    Establishes the priority in which this port probe runs. If the first port probe fails, then the next probe runs on the device, and so forth, until the correct data is returned. This allows for the proper classification of a device that has two running protocols, such as SSH and SNMP. The default priorities for the Discovery protocols are:

    • 1 - WMI
    • 2 - SSH
    • 3 - SNMP
    • 4 - HTTP
    Supplementary Launches supplementary classifications after a higher-priority identification succeeds, in order of priority.
    Conditional

    Runs this port probe if any one of the non-conditional probes returns an open port. The conditional port probes in the base system attempt to resolve the names of Windows devices and DNS names. These ports probes take additional resources and are not used unless activity is detected on open ports.
    Script Script to run.