- Home
- How it works
We read your switches and leave them alone.
Your building already knows what is plugged into it. The information sits in the switches, in tables they keep in order to do their job. We read those tables, compare what they say against a library and against your own record, and publish how sure we are. That is the whole method.
Nothing is asked of the device itself.
A managed switch keeps these because it needs them to forward traffic. Reading them costs the switch nothing and tells the device nothing.
- 01Link state and negotiated speed
What the port agreed with whatever is on the end of it, and what it has agreed to in the past. A device that negotiates 100 megabit half duplex is a different class of thing from one that negotiates a gigabit.
- 02Power draw and class
How much power the device pulls over the wire and which class it declared. A camera, a phone and an access point sit in different places, and a device whose draw changes has usually changed.
- 03Neighbor advertisements
Many devices announce themselves to the switch: a model, a name, a capability set. It is a claim, not a fact, so it is treated as one signal among six.
- 04Hardware address and vendor prefix
The first half of a hardware address is assigned to a manufacturer. It narrows the field and it is trivially forgeable, which is exactly why it is never used alone.
- 05VLAN membership
Which segment the port has been placed in, and whether that matches where a device of this kind is supposed to live.
- 06Error counters over time
Errors, discards and resets, watched across days. This is the signal that catches a device that has been replaced with one that behaves differently under load.
Six weak signals make one signature.
No single reading identifies anything. A hardware address can be set to whatever you like. A neighbor advertisement is whatever the device chose to say. Power draw alone is a range, not a name.
Taken together and watched over time they behave differently: they are a physical description of how something actually acts on a wire, and it is far harder to make one thing behave electrically like another than it is to change what it says about itself.
That combined description is what we call Device DNA. It is compared against a reference library of known equipment, and against whatever record you already keep.
This is why it caught a tampered conference camera that had passed every paper, serial and software check. The paperwork was correct. The behavior was not.
Confirmed, disagreed, or weak.
The reading and the record agree. The device is named, the confidence is high, and it stops needing anybody's attention.
You get both sides, cited. We never quietly pick one. Deciding which is right is a person's job, and the report is written to make that decision short.
Not enough signal to claim anything, usually because the port has been up for minutes and not days. It says weak, and weak never counts as confirmed.
On one demo pass over forty-three devices, twenty-nine came back confirmed and fourteen came back too thin to name. All fourteen stayed on the map with the port they sit on, because a device nobody can name is still a device somebody has to go and look at. Each product publishes the number it will not go past.
Read-only is a property of the build, not a setting.
Every build ships with a test that fails if a write path exists anywhere in the product. It is not a configuration option, so it cannot be turned on by accident.
Nothing is placed on the equipment being identified. The device is never contacted directly at all.
Packet contents are never examined. We read counters and tables, which is a different thing from reading traffic.
We identify and we evidence. Blocking, quarantining and remediation are somebody else's tools, deliberately.
Because all eight products share this, a security team approves the approach once instead of eight separate times. Our accessibility statement and the evaluation pack are both public for the same reason.
Read-only. Evidence or silence. Gaps lower the score.
Nothing we ship writes to a device. Your network team approves that once, for all eight.
Every value says where it came from, and the screen says how sure it is.
A gap lowers the score and names what would lift it. An unknown is never rounded up.
Thirty minutes. You leave with the answer either way.
Book a 30-minute working sessionThe catalog, and where each product stops.
All eight products