Discovery - chuckablack/quokka GitHub Wiki

Hosts are discovered automatically by quokka. There are a number of ways that this might be accomplished - e.g. both scapy and nmap have various auto-discovery methods.

However, I chose to implement this discovery process as a simple ping through all IP addresses in the subnet (aka 'ping sweep'). This seemed to be the best for teaching purposes, and it has been around for a long time (the first 'discovery' I implemented was in about 1990!), and is still used in many solutions.

Here are some notes about the host discovery process in quokka:

• Hosts: Remember that 'discovery' is for discovering hosts. At this time, quokka does not discover devices as such.
• Devices: That said, quokka may discover IP addresses that are actually devices. Quokka doesn't care, and treats it like a normal host. Of course quokka could interrogate the 'host' to see e.g. if it supports SNMP, NETCONF, or if it has already been configured in 'devcies.yaml', and ignore it. It just doesn't do that, at this time.
• MAC addresses: Quokka reads its arp table at the beginning of each discovery cycle, and uses that to add the MAC address to devices, where appropriate. It reads this via the 'python_arptable' package.
• Finding the local subnet: When it runs, quokka discovery queries the socket library to determine its own IP address, and then uses the ipaddress package to get the subnet address for the local subnet.
• Finding the hostname: Quokka also uses the sockets library to get the hostname of any IPs that respond to our ping. The sockets function called is 'gethostbyname'.
• Adding vs updating: When it finds a device, quokka queries the database to see if this host has already been discovered. It does this by searching for a host with a matching IP address and hostname. If a match is found, the DB entry is updated (e.g. availability, response time, last heard). If not found, the new host is added to the DB.

Yes I realize that this means that if a host goes away, loses its lease on an IP address, gets a new one, it will be discovered again. Doing more requires interrogating the host, to determine if it is the same one, and that isn't something that quokka is doing at the moment.

• Interval: Host discovery has an 'interval' at which it runs. I use the term 'interval' loosely, because it isn't really that - the 'interval' is really just the time it will wait, until starting the next discovery cycle. I did this for simplicity - since quokka is for teaching - and to not complicate things. There are many ways to improve this, to make a true 'interval', and that may be done in the future (along with multi-threaded discovery, e.g.).