Active Discovery
Finding devices by sending probes and analyzing responses—comprehensive but potentially disruptive to sensitive or legacy devices. ORDR supplements active discovery with passive analysis for clinical and OT environments.
What is Active Discovery?
Finding devices by sending probes and analyzing responses—comprehensive but potentially disruptive to sensitive or legacy devices. ORDR supplements active discovery with passive analysis for clinical and OT environments.
Active discovery identifies network devices by sending probes — ICMP pings, TCP SYN packets, SNMP queries, ARP requests — and analyzing the responses. It produces comprehensive inventories quickly and can gather detailed information (OS fingerprints, open ports, running services) that passive observation alone may miss.
The limitation is the active part. Sending unexpected packets to devices that weren't designed to receive them can cause crashes, hangs, or unexpected behavior. This is a manageable risk for enterprise IT endpoints, but a significant concern in OT environments (where a PLC crash can halt production) and healthcare (where disrupting a medical device network can have clinical consequences). Active discovery must be used selectively and carefully in mixed environments.
The best approach combines passive discovery (always-on, safe for all device types) with targeted active queries applied only to devices that can safely handle them. Managed IT endpoints, servers, and network infrastructure can receive active probes. OT devices, medical devices, and other sensitive assets should be discovered passively and classified through traffic analysis rather than active interrogation.
Key Facts
- Active scanning can crash or destabilize over 40% of common OT device types
- Nmap and similar scanners are explicitly contraindicated for ICS/SCADA discovery in CISA guidance
- Passive-first discovery finds 95%+ of devices without active probing in most enterprise environments
- Hybrid passive + selective active discovery achieves the highest accuracy and coverage combination
How ORDR Addresses Active Discovery
ORDR uses passive discovery as its primary method and supplements it with selective active queries applied only to safe, managed endpoints. OT and IoMT devices are never actively probed. This hybrid approach maximizes discovery completeness while protecting sensitive environments from the risks of active scanning.
See ORDR in actionFrequently Asked Questions
See Active Discovery in practice.
ORDR gives security teams complete visibility into every connected asset—and the intelligence to act on what matters most.