Using cached network data on a device to discover unscannable devices
A software agent executing on a computing device receives a request from a client to provide data associated with neighboring devices to the computing device. The client includes a scan engine to perform a network scan of a network that includes the computing device. The software agent accesses device data in a cache of an operating system command, determines, based on the device data, an identifier associated with each device that is neighboring the computing device, converts the device data into a standardized format to create neighboring device data, and sends the neighboring device data to the client.
1 . A method comprising:
executing a software agent on a computing device in a network, the execution comprising:
receiving a request from a scan engine to provide data associated with the computing device;
accessing an Address Resolution Protocol (ARP) cache or a Neighbor Discovery Protocol (NDP) cache maintained on the computing device to obtain a list of neighboring devices of the computing device in the network, wherein the scan engine is not able to directly scan a neighboring device in the list; and
sending, by the software agent, device data about the neighboring device to the scan engine.
2 . The method of claim 1 , further comprising the software agent:
converting the device data into a standardized format that is a same format for a plurality of different operating systems.
3 . The method of claim 1 , wherein
the device data includes an internet protocol (IP) address and a media access control (MAC) address of the neighboring device.
4 . The method of claim 1 , wherein
the computing device implements an application programming interface (API) endpoint for a remote procedure call (RPC) from the scan engine, and the request is received at the API endpoint.
5 . The method of claim 1 , wherein
the neighboring device implements a firewall that is configured to (a) not respond to network scans from the scan engine or (b) prevent the network scans from reaching one or more other computing devices in the network.
6 . The method of claim 1 , wherein
the computing device is a virtual machine.
7 . The method of claim 1 , wherein
the network is a wide area network (WAN).
8 . The method of claim 1 , wherein
the software agent is configured to collect fingerprints of software on the computing device according to instructions from the scan engine.
9 . The method of claim 1 , wherein
the software agent is configured to receive an operating system script from the scan engine and execute the script on the computing device.
10 . The method of claim 1 , wherein
the software agent is executed in one process on the computing device, and
the software agent is configured to invoke another process on the computing device to collect the device data.
11 . A system comprising:
a computer device configured to execute a software agent, the software agent executable to:
receive a request from a scan engine to provide data associated with the computing device;
access an Address Resolution Protocol (ARP) cache or a Neighbor Discovery Protocol (NDP) cache maintained on the computing device to obtain a list of neighboring devices of the computing device in the network, wherein the scan engine is not able to directly scan a neighboring device in the list; and
send, by the software agent, device data about the neighboring device to the scan engine.
12 . The system of claim 11 , wherein the software agent is executable to:
convert the device data into a standardized format that is a same format for a plurality of different operating systems.
13 . The system of claim 11 , wherein
the device data includes an internet protocol (IP) address and a media access control (MAC) address of the neighboring device.
14 . The system of claim 11 , wherein
the computing device implements an application programming interface (API) endpoint for a remote procedure call (RPC) from the scan engine, and
the request is received at the API endpoint.
15 . The system of claim 11 , wherein
the neighboring device implements a firewall that is configured to (a) not respond to network scans from the scan engine or (b) prevent the network scans from reaching one or more other computing devices in the network.
16 . The system of claim 11 , wherein
the computing device is a virtual machine.
17 . The system of claim 11 , wherein
the network is a wide area network (WAN).
18 . The system of claim 11 , wherein
the software agent is executable to receive a software patch from the scan engine.
19 . The system of claim 11 , wherein
the software agent is executable to receive an operating system script from the scan engine and execute the script on the computing device.
20 . The system of claim 11 , wherein
the software agent is executed in one process on the computing device, and the software agent is executable to invoke another process on the computing device to collect the device data.