- Home
- How it works
We read your switches and leave them alone.
Your building already knows what is plugged into it. The information sits in the switches, in tables they keep in order to do their job. We read those tables, compare what they say against a library and against your own record, and publish how sure we are. There are no other steps.
Nothing is asked of the device itself.
A managed switch keeps these because it needs them to forward traffic. Reading them costs the switch nothing and tells the device nothing.
- 01Link state and negotiated speed
What the port agreed with whatever is on the end of it, and what it has agreed to in the past. A device that negotiates 100 megabit half duplex is a different class of thing from one that negotiates a gigabit.
- 02Power draw and class
How much power the device pulls over the wire and which class it declared. A camera, a phone and an access point sit in different places, and a device whose draw changes has usually changed.
- 03Neighbor advertisements
Many devices announce themselves to the switch: a model, a name, a capability set. That is the device vouching for itself, so it counts as one signal among six.
- 04Hardware address and vendor prefix
The first half of a hardware address is assigned to a manufacturer. It narrows the field. It is also trivial to forge, so it is never used alone.
- 05VLAN membership
Which segment the port has been placed in, and whether that matches where a device of this kind is supposed to live.
- 06Error counters over time
Errors, discards and resets, watched across days. This is the signal that catches a device that has been replaced with one that behaves differently under load.
Six weak signals make one signature.
No single reading identifies anything. A hardware address can be set to whatever you like. A neighbor advertisement is whatever the device chose to say. Power draw alone gives you a range.
Taken together and watched over time they add up to a physical description of how something behaves on a wire. Making one thing behave electrically like another is far harder than changing what it says about itself.
That combined description is what we call Device DNA, and it is compared against two things: a reference library of known equipment, and whatever record of your own you already keep.
This is why it caught a tampered conference camera that had passed every paper, serial and software check. The paperwork was right and the behavior was wrong.
Confirmed, disagreed, or weak.
The reading and the record agree. The device is named, the confidence is high, and it stops needing anybody's attention.
You get both sides, cited. We never quietly pick one. Deciding which is right is a person's job, and the report is written to make that decision short.
Not enough signal to claim anything, usually because the port has been up for minutes and not days. It says weak, and weak never counts as confirmed.
On one demo pass over forty-three devices, twenty-five came back confirmed, five came back likely, and thirteen were too thin to name. All thirteen stayed on the map with the port they sit on, because a device nobody can name is still a device somebody has to go and look at. Each product publishes the number it will not go past.
Read-only is built into the product.
Every build ships with a test that fails if a write path exists anywhere in the product. There is no setting to flip, by accident or on purpose.
Nothing is placed on the equipment being identified. The device is never contacted directly at all.
Packet contents are never examined. We read counters and tables, which is a different thing from reading traffic.
We identify and we evidence. Blocking, quarantining and remediation are somebody else's tools, deliberately.
All eight products give these same four answers, so one security review covers every one of them. The evaluation pack is public for the same reason, and so is our accessibility statement.
See it read one of your switches.
A room, a closet or a folder of drawings. Thirty minutes, and the product runs against it while you watch.
Book a 30-minute working sessionThe catalog, and where each product stops.
All eight products