# Discovery and topology

Sweep CIDR ranges for SNMP devices, confirm or reject the candidates discovery finds, and read the topology map Tracix draws from LLDP neighbors.

Discovery finds the SNMP devices in the address ranges you choose, and the topology map shows how they connect. This page explains how sweeps work, how to review what they find, and how to read the map.

## How discovery works

Discovery is part of the **SNMP** integration on a collector policy (see [Devices and SNMP profiles](https://tracix.io/docs/network/devices) to set it up). The collector that polls SNMP for the policy:

1. Sweeps every range under **CIDRs** when the integration starts, then again on the **Rescan interval** (15 minutes by default).
2. Probes each address on the integration's **Port** (UDP 161 by default) with the credentials of the integration's **SNMP version**: its v2c community, or its SNMPv3 user.
3. Identifies each device that answers by its `sysObjectID`, `sysName` and `sysDescr`, and reads its physical inventory from ENTITY-MIB where the device supports it: models, serial numbers, and hardware, firmware and software revisions.
4. Reports the device to your workspace, where Tracix matches it to a device profile.

Devices you have already confirmed keep being polled; later sweeps don't report them as new.

> **SNMPv3 lockout protection**
>
> When a device answers but refuses the SNMPv3 credentials, the collector backs off that address, starting at 1 minute and doubling up to 30 minutes, so repeated attempts don't lock out the account. A correct answer clears the backoff. An address that doesn't answer at all isn't backed off.

## Review discovery candidates

New devices wait in **Network › Discovery Candidates** until someone confirms them, unless **Auto-accept discovered devices** is on in the integration.

Each row shows the device's name and address, its vendor and model, its OS and version, its `sysObjectID`, and how Tracix matched a profile:

| Profile badge  | Meaning                                                                       |
| -------------- | ----------------------------------------------------------------------------- |
| **exact**      | A profile lists the device's `sysObjectID`.                                   |
| **wildcard**   | A profile's `sysObjectID` prefix matched.                                     |
| **sysdescr**   | A profile's pattern matched the device's `sysDescr`.                          |
| **no profile** | Nothing matched. The device still gets standard interface and system metrics. |

For an unmatched make and model, the badge shows what Tracix is doing about it. With Brain profile generation on, it reads **Generating profile…** until the profile is ready, and the profile then applies to every matching device. **Generation failed** means Tracix stopped trying; it doesn't retry on its own. With generation off, the badge reads **Surveying device…** during the one sample walk and **Library profile** after it. See [Devices no profile matches](https://tracix.io/docs/network/devices#devices-no-profile-matches).

**1. Confirm the devices you want**

Select **confirm** on a row, or select several rows and choose **confirm selected**. Confirmed devices join the fleet and appear under **Network › Devices & Inventory**.

**2. Reject the rest**

Select **reject** on a row, then **reject** again to confirm, or use **reject selected**. Rejecting deletes the candidate. If the device still answers in a later sweep, it comes back as a new candidate, so narrow the integration's **CIDRs** to stop discovering it.

To stop polling a device you confirmed earlier, select it on **Devices & Inventory**, choose **delete selected**, then confirm. Deleting is permanent: polling stops and the device leaves the inventory and the topology map. A device that still answers in a swept range comes back as a new candidate.

## Read the topology map

Open **Network › Topology** to see the **Enterprise topology map**.

> **Links come from LLDP only**
>
> Tracix draws a link between two devices only when one of them reports the other as an LLDP neighbor. Devices that don't run LLDP, or that Tracix can't poll for LLDP-MIB, appear without links. The map doesn't draw links from MAC address or ARP tables; those tables are on each switch's device page.

What the map shows:

* **Devices and links.** Each link joins the two interfaces the LLDP report names. Select a link to see both ends, their interfaces and when the link was first and last seen.
* **Confidence.** Every link carries a confidence score. A link that both neighbors report scores higher than one only one side reports, and a link nothing has reported for a while loses confidence. Links below 50% draw dotted.
* **Stubs.** A neighbor that Tracix doesn't poll appears as a stub device, so gaps in discovery stay visible.
* **Staleness.** A device Tracix hasn't heard from in 30 minutes is marked stale, the same rule the inventory uses.
* **Quality bar.** The bar above the map counts devices, endpoints, low-confidence edges, stale nodes and unknown endpoints.

Use the **Sites** and **Devices** views to switch between a site overview and individual devices, the site filter to focus on one site, and search to find a device on the map. Select **Refresh** to rebuild the map.

### Pin a device's role

The map places firewalls, routers and switch tiers by inference. When it places a device wrong, select the device, choose a role under **Device role** in the side panel, and the pin fixes its tier on the map. The roles are firewall, router, core switch, distribution switch, access switch, switch, wireless controller and load balancer. Choose **Auto** to let inference decide again. Pinning needs write access to network devices.

## Next steps

- [Devices and SNMP profiles](https://tracix.io/docs/network/devices): Add ranges and read device pages

- [Flow analysis](https://tracix.io/docs/network/flow-analysis): See the traffic between devices

- [SNMP polling and traps](https://tracix.io/docs/collect/network-data/snmp): Credentials, traps and ports