--- sourceDocument: Yokohama IT Operations Management sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/yokohama/it-operations-management Release : - yokohama ft:locale : - en-US ft:publication_title : - Yokohama IT Operations Management ft:clusterId : - itom bundleId : - itom workflow : - Technology --- # Traffic-based discovery in Service Mapping # Traffic-based discovery in Service Mapping {#ariaid-title1} * Release version: Yokohama * * Updated July 30, 2025 * * ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 5 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of Traffic-based discovery in Service Mapping Traffic-based discovery in Service Mapping enhances the identification and mapping of configuration items (CIs) by analyzing network traffic to detect connections that pattern-based mapping alone might miss. It complements pattern-based discovery by using traffic data from various sources to automatically discover and add connections between CIs in your environment. Show full answer Show less This method can operate with or without Predictive Intelligence. When Predictive Intelligence is enabled, connection suggestions are generated automatically based on traffic data and application fingerprints. Without it, connections are added based on CMDB traffic data, though manual cleanup might be necessary to maintain organized service maps. Traffic-based discovery is typically used at early stages of application service discovery and can be disabled after fine-tuning to keep service maps clean. Connections created solely by traffic-based discovery are not removed unless duplicated by pattern-based discovery, in which case duplicates are eliminated. ## Traffic-Related Data and Sources Service Mapping relies on traffic-related data stored in CMDB tables, which are populated using commands and network flow logs such as netstat, lsof, Netflow, and VPC logs. Key tables include: * **saflowconnection:** Used to discover dependencies and add connections during top-down discovery. * **saflowservice:** Identifies services listening on ports (not used by default in base systems). * **saflowservercomm:** Detects service-to-service communication (not used by default). * **cmdbtcp:** Captures TCP connection data from commands like netstat and lsof, used in default configurations. Netflow and VPC log-based discovery requires additional setup but provides enhanced traffic data for discovery. Service Mapping also integrates TCP connection data from Application Dependency Mapping (ADM) during horizontal discovery. ## Enabling Traffic-Based Discovery Traffic-based discovery is configurable at multiple levels, with the product-level setting being a prerequisite for enabling it at more specific scopes: * **Product Level:** Controlled by the property `sa.trafficbaseddiscovery.active`. Enabling it here allows broad use of traffic-based discovery across your environment. The connection suggestions feature, controlled by `saml.connectionsuggestions.active`, also operates at this level. * **Service Instance Level:** Enables traffic-based discovery for all CIs within a specific service instance, unless overridden by CI-type or specific CI rules. * **CI Type Level:** Allows inclusion or exclusion of entire CI types from traffic-based discovery, taking precedence over service instance settings. * **Specific CI Level:** Enables fine-grained inclusion or exclusion of individual CIs, overriding both service instance and CI type rules. ## Practical Considerations for ServiceNow Customers * Traffic-based discovery helps identify service dependencies and connections that pattern-based methods might miss, improving service maps' completeness. * Enabling traffic-based discovery at the product level is required before applying it to specific service instances or CI types. * Use connection suggestions to assist in managing connections automatically, but be prepared to manually clean up irrelevant connections if Predictive Intelligence is not enabled. * Turn off traffic-based discovery after discovery and fine-tuning phases to maintain clean and organized service maps. * Understand the data sources feeding traffic-based discovery, especially if you plan to configure advanced data collection using Netflow or VPC logs. * Manage CI connection rules carefully at the CI type and specific CI levels to tailor discovery behavior to your environment's needs. Service Mapping can discover and map configuration items (CIs) following their traffic-based connections. This method is referred to as traffic-based mapping and complements pattern-based mapping. ## What is traffic-based mapping {#traffic-based-discovery__section_hsx_4j3_gnb} Traffic-based mapping can be seen as an enhancement to pattern-based mapping. While pattern-based mapping relies on predefined rules and patterns to identify connections, traffic-based mapping analyzes network traffic to automatically discover connections between CIs in your environment. This approach allows Service Mapping to find those CIs not discovered using patterns alone. Depending on your configuration, the behavior of traffic-based discovery can vary. If Predictive Intelligence is enabled, Service Mapping automatically adds connections to service instances based on connection rules. These suggestions are generated using traffic-related data from the Configuration Management Database (CMDB) and the analysis of application fingerprints, CIs, and processes by Predictive Intelligence. If discovery based on Predictive Intelligence isn't enabled, Service Mapping automatically adds traffic-based connections using data from the CMDB to the service instances. However, to keep your service instances well-organized, you might need to manually remove connections to irrelevant CIs. Typically, if the connection suggestions feature is turned off, you use traffic-based discovery at the initial stages of discovering application services. To maintain a clean, organized service map, you can opt to turn off traffic-based discovery after you have completed the discovery and fine-tuning of your application services. For more information, see [Fine-tune application services to implement owner requests](https://servicenow-prod.fluidtopics.net/iBl4ZwvZMr6J_fUdsUa1Nw "As an administrator, you tweak and fine-tune maps based on comments from the application service owner."). Connections created only through traffic-based discovery aren't removed. However, if pattern-based discovery runs after traffic-based discovery has run, it might create duplicate connections between CIs. To avoid duplicates, the system removes any connections that were created by traffic-based discovery if they're also created by pattern-based discovery. ## Traffic-related data from the CMDB {#traffic-based-discovery__section_a1q_wk3_gnb} The system uses commands and network flow logs to collect traffic-related data and saves it in the CMDB tables. Service Mapping retrieves this data from the tables to detect CI inbound and outbound connections. {#traffic-based-discovery__table_kh1_kft_xy__entry__3} | Table | Source | Used by Service Mapping to | |-|-|-| | Flow Connector \[sa_flow_connection\] | Netflow and VPC logs | Discover dependencies, add connections during top-down discovery. | | Flow Services IP/Port and Statistics \[sa_flow_service\] | Netflow and VPC logs | Discover all services listening on ports. In a base system, Service Mapping does not use data from this table. | | Flow Server Communication \[sa_flow_server_comm\] | Netflow and VPC logs | Discover services communicating to other services. In a base system, Service Mapping does not use data from this table. | | TCP Connection \[cmdb_tcp\] | netstat and lsof commands | Discover connections during top-down discovery. | [Table 1. Tables containing data collected using traffic-based methods] {#traffic-based-discovery__table_kh1_kft_xy} In base systems, which are the default or standard configurations, traffic-based discovery relies solely on TCP-related data collected using the netstat, ss, and lsof commands. Discovery based on Netflow and VPC logs requires additional configuration. To enhance traffic-based discovery, you can configure Service Mapping to collect data from Netflow and VPC logs. Service Mapping also accesses the TCP connection data collected by improved Application Dependency Mapping (ADM), which Discovery performs as part of horizontal discovery. See [Application Dependency Mapping (ADM) for Discovery](https://servicenow-prod.fluidtopics.net/ICpTBIvn~GSaUeZeAppbdA#r_ApplicationDependencyMapping "Application Dependency Mapping (ADM) discovers CIs by detecting TCP connections between devices.") to learn more about this process. ## Enabling traffic-based discovery in the system {#traffic-based-discovery__section_cwq_5cs_hnb} Traffic-based discovery using commands is available in Service Mapping for use at any level. You can enable it at different levels ranging from the most global to the most specific. For more information, see [Enable traffic-based discovery for an application service](https://servicenow-prod.fluidtopics.net/7aKT0~d8tUdI~Sa3cmy9zw "Make Service Mapping use traffic-based connections to discover CIs making up an application service."). Product level : By default, traffic-based discovery in Service Mapping is turned off. The Traffic based discovery (sa.traffic_based_discovery.active) property controls traffic-based discovery at this level. Enabling traffic-based discovery at the product level facilitates the discovery of all CIs in your environment. However, more specific rules at the service instance, CI type, or specific CI levels can override these settings. Important: You can't enable traffic-based discovery at other levels unless it's enabled at the product level. The connection suggestions feature works at the product level. The sa_ml.connection_suggestions.active property controls this feature. If you enabled traffic-based discovery before the Quebec release and used it to discover at least one application service, the connection suggestions feature is turned off by default. Service instance level : You can enable traffic-based discovery for an individual service instance. In this case, Service Mapping uses traffic-based discovery for all CIs that make up this service instance. However, if traffic-based discovery is turned off for some CI types or specific CIs, those CIs aren't discovered using this method, even if the service instance is set to use traffic-based discovery. For example, you enable traffic-based discovery for a specific service instance that includes a Tomcat server, a MySQL database, and a web application. Service Mapping uses traffic-based discovery to discover the Tomcat server, the MySQL database, and the web application. CI type level : You can create a discovery rule to include or exclude a CI type from traffic-based discovery. This rule takes precedence over the setting that you choose for an individual service instance. For example, you enable traffic-based discovery for a specific service instance that includes a Tomcat server, a MySQL database, and a web application. You create a CI type rule that excludes all Tomcat servers from traffic-based discovery. Service Mapping uses traffic-based discovery to discover the MySQL database and the web application since there are no rules to exclude them. Specific CI level : You can create a discovery rule to include or exclude a specific CI type from traffic-based discovery. This rule takes precedence over the setting that you choose for an individual service instance or any rules for CI types. For example, you enable traffic-based discovery for a specific service instance that includes a Tomcat server, a MySQL database, and a web application. You create a CI type rule that excludes all Tomcat servers from traffic-based discovery. However, you also create a discovery rule enabling traffic-based discovery for a specific Tomcat server. Service Mapping uses traffic-based discovery to discover the MySQL database, the web application, and that specific Tomcat despite the CI type rule excluding all Tomcat servers. : See [Enable traffic-based discovery for CI types or specific CIs](https://servicenow-prod.fluidtopics.net/HJLs3M9S~tpP0M7IrmG5Jw "Service Mapping can discover and map CIs by detecting the inbound and outbound traffic that the CIs generate. Create a traffic-based discovery rule to determine which configuration items are available for traffic-based mapping.") to learn more about creating rules for CI types or specific CIs. **Related concepts** * [Pattern-based discovery in Service Mapping](https://servicenow-prod.fluidtopics.net/AjS6GFhdFDhZBZSR07NwRw "Pattern-based discovery is the main method of Service Mapping collecting data about devices and applications used in application services. After Service Mapping collects data, it then creates a map of application services and stores the collected data in the CMDB.") * [Data collection and discovery using Netflow](https://servicenow-prod.fluidtopics.net/YBbys5myQUEDZ6mfzThrYQ "Service Mapping can perform discovery based on data collected using the Netflow protocol. Netflow is a protocol that Service Mapping can use to collect data about CIs and their connections along with Netstat and lsof commands.") * [Data collection and discovery using VPC Flow Logs](https://servicenow-prod.fluidtopics.net/DK_4puB5aelFPZFGyXMZEw "Service Mapping can perform discovery based on data collected using VPC Flow Logs. Amazon VPC hosts Amazon Elastic Compute Cloud (EC2) instances that provide Amazon Web Services. VPC Flow Logs collect data on IP traffic going to and from network interfaces in the VPC.") **Related tasks** * [Manage CI connections for multiple services using suggestions](https://servicenow-prod.fluidtopics.net/1f4UHiSugziDnRxwAfdeeg "If the discovery based on Predictive Intelligence is enabled, the newly mapped application services include only CIs and CI connections added by discovery patterns. Use connection suggestions to decide which configuration items (CIs) to include or exclude globally. Service Mapping then updates all relevant discovered application services to reflect your decisions.") * [Manage CI connections for a single service using suggestions](https://servicenow-prod.fluidtopics.net/u~Zf40ssZOZ1CiZacOJOVQ "If discovery based on Predictive Intelligence is enabled, newly mapped application services include only configuration items (CIs) and CI connections added using discovery patterns. Use the suggestions for CI connections, generated by Service Mapping, to complete the application service.") * [Remove CIs not belonging to application services](https://servicenow-prod.fluidtopics.net/Y7IsTScDWqGDTcS17QGbIA "Remove CIs erroneously mapped as part of an application service by Service Mapping. Unnecessary CIs included in the map can generate irrelevant alerts in Event Management. For example, when creating an application service for a web portal, Service Mapping might automatically discover a connection to unaffiliated external services, such as PayPal.")