Discovery | ReView Documentation

The Discovery Tab RIR scan is the recommended first step in discovering network assets.

The Discovery tab is first step to identifying network resources to add to your inventory. Here, you can use configuration files, paste text configs, or use automated scanning options to identify devices to use for discovery.

The Discovery tab allows the user to gather IP topography data via the following methods, organized as sub-tabs: DHCP, DNS, Firewall, Generic Config, mDNS, Load Balancer, Ping Scan, RIR, Router Configs, SSH Router Config, SNMP, ARP, and SSDP.

Discovery Tab Options

RIR

RIR Scan is the recommended first step in discovering your network assets.

RIR discovery establishes a baseline of public space. From here, ReView will use the current user’s IP / provided IP, and then query the WHOIS system to find its ASN. From there, it queries again in order to discover netblock allocations.

When you open RIR Scan, your public IP is automatically populated, though you may also manually enter an IP.

A screenshot of the RIR Scan interface, showing an entered IP address and the Scan button location circled.

Enter the desired IP address and click “Scan”.

An example of a successful scan, showing scan output, a success message toast of added blocks, and number of pending item flags on the To-Do List and Inventory tabs.

After a successful scan, flags will appear on the To-Do List and Inventory tabs to indicate pending actions.

DHCP

Connects to DHCP usage logs. ReView uses this to determine whether allocated DHCP subnets can be shrunk. Currently supports ISC DHCP, though Microsoft support is expected in a future release.

DNS

Supply DNS Zone files or credentials to an ISC Bind DNS Server to discover hosts. A config file may be uploaded or configuration text pasted directly into the text field.

A screenshot of the DNS Zones input interface prompting the user to select a zone config file.

Firewall

Connects to Firewall configs (OPNsense, Palo Alto, Fortinet). A config file may be uploaded or configuration text pasted directly into the text field.

Generic Config

Attempts to parse non-supported devices via a config file in order to identify network resources and add them to the inventory.

mDNS

Scans for Multicast DNS identifiable devices. Simply enter a service, domain, and a timeout (in seconds).

A screenshot of the Multicast DNS interface prompting the user to enter a server, domain, and timeout prior to scanning.

Load Balancer

Connects to Load Balancer configs (F5). A config file may be uploaded or configuration text pasted directly into the text field.

Ping Scan

Enter a CIDR to detect hosts and add to the inventory. The scan can be adjusted via a slider to emphasize either speed or accuracy or balanced between the two options.

It is recommended to perform a ping scan after an RIR scan in order to discover individual hosts.

A screenshot of the Discovery Ping Scan interface, showing options for CIDR and scan accuracy.

Router Configs

The Router Config page allows the user to either paste full router configs, upload a single config file, or provide an archive of files. ReView parses these configs for configured networks.

Currently supported router configs include the following:

Cisco IOS
Cisco IOS-XR
Juniper
Arista

To upload a config file, from the “Uploading a File” section; select a plain text configuration file or a compressed file with several configurations, and click “Parse File”.

A screenshot of the Router Config Parser, prompting the user to select a config file or paste a config text.

To paste a router config, select “Paste a configuration text”, paste your content, and click “Parse File”.

A screenshot of the Router Config Parse interface, with the Paste Configuration Text option selected, a text field in which to paste the config text, and the Parse File button location circled. prompting the user to select a firewall config file.

SSH Router Config

You may also provide credentials for a router, connect via SSH, and then extract the router config in order to integrate it into the tool.

Select a router type from the dropdown and then click “Add Credentials”.

A screenshot of the SSH Router Config interface prompting the user to add credentials and select Router Type..

Enter SSH credentials in the resulting form and click the “Add” button.

The Add Credentials interface opens a separate modal to enter host, username, port, and password.

SNMP

To initiate an SNMP scan, enter credentials and a router IP.

ARP

Supply SSH credentials and a router type to fetch the ARP table and add its contents to the inventory

A screenshot of the ARP interface prompting the user to add SSH credentials and select router type to scan.

Select a router type and click “Add Credentials”. Enter credentials in the resulting form, and click the “Add” button.

The ARP Add credentials modal, showing input fields for Host, Username, Port, and Password.

SSDP

Initiates a scan to search for devices responding to SSDP. The default timeout is 15 seconds.

A screenshot of the Simple Service Discovery interface prompting the user to enter a timeout, then scan.

Cloud Providers

Select a cloud provider and enter credentials to scan cloud provider hosts and add them to the inventory.

Next Steps

If neighboring devices have been discovered via the router config discovery option, those devices will be populated into the To Do List tab for further scanning.

Once one or more of the available Discovery modules has been processed, all found space will be loaded into the Inventory tab for display and auditing.