Discovery Protocol Helpers

Open-AudIT 7 ships 70 discovery helpers. Sixty-one of them need no credentials at all - they identify a device purely from what its own protocol says back. The remaining nine use credentials to perform a full audit and are listed separately at the end.

Every helper is triggered by an open port, so a helper is never called speculatively. A network of Windows machines is never probed for PLCs. The full parsed reply is kept in the discovery log as JSON, so the evidence behind every attribute is one click away.

"Best case attributes" means what the helper records when a device answers fully. A device that answers only partially yields fewer. Every helper also records the raw response against the device, and sets the device type shown.

Credential-free helpers

Helper	Port	Proto	Device types	What it does	Best case attributes

Helper	Port	Proto	Device types	What it does	Best case attributes
getAmt	16992, 16993	TCP	computer	Reads the Intel AMT management interface on a business PC	Manufacturer, Description
getAmx	9131	UDP	from response	Listens for the AMX Device Discovery beacon from AV control gear	Manufacturer, Model, Firmware, UUID
getAtg	10001	TCP	environment monitor	Queries a fuel tank gauge controller over the Veeder-Root ATG protocol	Description
getAvReceiver	80, 8090	TCP	media device	Reads the HTTP control API of a Denon, Marantz, Yamaha or Bose receiver	Manufacturer, Model, Firmware/OS version, Name
getBacnet	47808	UDP	building management	Reads the BACnet object identity of a building management device	Manufacturer, Model, Firmware, Description, Location, Application software
getBlink	80	TCP	security camera	Identifies a Blink home camera over HTTP	Manufacturer, Firmware/OS version
getBroadlink	80	UDP	from response	Identifies a BroadLink smart home controller	Manufacturer, Model
getBydBattery	8080	TCP	power device	Reads holding registers from a BYD Battery-Box BMU over Modbus RTU-over-TCP	Manufacturer, Model, Serial, Firmware/OS version
getCast	8008	TCP	media device	Reads the eureka_info endpoint of a Google Cast device	Manufacturer, Model, Firmware/OS version, Name, MAC
getCodesys	1200, 2455	TCP	plc	Identifies a CoDeSys V2 runtime PLC	Model, Firmware/OS version, OS name, OS group, OS CPE
getCrestron	41794	UDP	av device	Reads hostname, model and firmware from a Crestron control processor	Manufacturer, Firmware/OS version, Name
getCspv4	2222	TCP	plc	Identifies an Allen-Bradley CSP v4 / PCCC device	Manufacturer
getDahua	37810	UDP	security camera	Queries a Dahua camera or recorder over the DHIP discovery protocol	Manufacturer, Model, Serial, Firmware/OS version, MAC
getDicom	104, 11112	TCP	medical imaging	Performs a DICOM association request against a medical imaging node	Software, Description, UUID
getDnp3	20000	TCP	plc	Identifies a DNP3 outstation in a SCADA network	Presence only
getDvrip	34569	UDP	from response	Unauthenticated DVRIP search against a recorder, returning channel count	Manufacturer, Serial, Firmware/OS version, Name, MAC
getEnip	44818	TCP	plc	Reads the EtherNet/IP identity object from an industrial device	Manufacturer, Model number, Model, Serial, Firmware/OS version, Description
getEufy	32108	UDP	security camera	Confirms a Eufy / ThroughTek P2P camera or NVR	Manufacturer
getExtron	23	TCP	av device	Reads the SIS banner from an Extron AV device	Manufacturer, Firmware/OS version
getFhir	443, 80, 8080, 8443	TCP	records software, not a type	Reads the capability statement from an HL7 FHIR healthcare server	Software, Description
getFox	1911	TCP	plc	Reads the Niagara Fox (Tridium) identity block from a building controller	Manufacturer, Model, Serial, Firmware/OS version, OS name, OS group, OS CPE, Hostname, Name, UUID, Software
getHikvision	37020	UDP	security camera	Queries a Hikvision camera or NVR over the SADP discovery protocol	Manufacturer, Model, Serial, Firmware/OS version, MAC
getHue	80, 443	TCP	iot device	Reads the /api/config endpoint of a Philips Hue bridge	Manufacturer, Model, Serial, Firmware/OS version, Name, MAC
getIpmi	623	UDP	remote management	Queries the baseboard management controller of a server over IPMI	Manufacturer, Firmware, Description
getJetdirect	9100	TCP	printer	Sends PJL INFO queries to an HP JetDirect or raw print server	Manufacturer, Model, Serial, Description
getKnx	3671	UDP	building management	Identifies a KNX/IP building automation gateway	Model, Serial, MAC
getLifx	56700	UDP	iot device	Identifies a LIFX smart light	Manufacturer, Model number, Firmware/OS version, Name
getMdns	5353	UDP	from advertised services	Enumerates advertised services over mDNS / DNS-SD (Bonjour)	Manufacturer, Hostname, Name
getMiio	54321	UDP	iot device	Confirms a Xiaomi ecosystem device - Aqara, Mi, Roborock and others	Manufacturer, Serial
getModicon	502	TCP	plc	Reads the identity of a Schneider Electric Modicon PLC over Modbus	Manufacturer, Model number, Model, Firmware/OS version
getNetbios	137	UDP	enrichment only	Reads hostname, domain and MAC from a NetBIOS node status query	Hostname, Name, MAC, Domain
getNut	3493	TCP	ups	Queries a UPS managed by Network UPS Tools	Manufacturer, Model, Description
getOmron	9600	TCP	plc	Identifies an Omron PLC over the FINS protocol	Manufacturer
getOnvif	3702	UDP	security camera	Discovers an ONVIF security camera over WS-Discovery	Manufacturer, Model, Description
getPcworx	1962	TCP	plc	Identifies a Phoenix Contact PC Worx PLC	Model number, Model, Firmware/OS version
getPjlink	4352	TCP	projector	Reads the PJLink connect banner from a network projector	Manufacturer, Model, Name
getPlaystation	987, 9302	UDP	game console	Queries a Sony PlayStation over the DDP protocol (987 PS4, 9302 PS5)	Manufacturer, Model, Serial, Firmware, OS name, OS group, OS CPE, Hostname, Name
getPlex	32400	TCP	media server	Reads the /identity endpoint of a Plex Media Server	Manufacturer, Serial, Firmware/OS version
getPowerwall	443	TCP	power device	Reads /api/status from a Tesla Powerwall or Backup Gateway	Manufacturer, Model, Firmware/OS version
getProconos	20547	TCP	plc	Identifies a ProConOS-enabled PLC	Model
getQnap	443, 8080	TCP	nas	Reads model and firmware from a QNAP NAS over HTTP	Manufacturer, Model, Firmware, Hostname
getRedfish	443, 80	TCP	remote management	Reads the Redfish service root from a modern server BMC - iLO, iDRAC, XClarity	Manufacturer, Model, UUID, Description
getRoku	8060	TCP	media device	Queries a Roku device over the External Control Protocol	Manufacturer, Model number, Model, Serial, Firmware/OS version, Name
getS7	102	TCP	plc	Reads the identity of a Siemens SIMATIC S7 PLC over S7comm	Model number, Model, Serial, Firmware/OS version, Name, UUID
getSamsungMdc	1515	TCP	media device	Reads the serial number from a Samsung commercial display over MDC	Manufacturer, Serial
getSamsungTv	8001	TCP	smart tv	Reads the device API of a Samsung Tizen smart TV	Manufacturer, Model number, Model, OS name, Name, MAC
getShelly	80	TCP	smart plug	Reads the /shelly endpoint of a Shelly smart home device	Manufacturer, Model, Firmware/OS version, Name, MAC
getSip	5060	UDP, TCP	voip phone	Sends a SIP OPTIONS request to a VoIP phone or gateway	Model
getSlp	427	UDP	computer	Identifies a device, typically VMware ESXi, over Service Location Protocol	Manufacturer
getSolar	80	TCP	power device	Reads the HTTP API of a Fronius or Enphase solar inverter	Manufacturer, Model, Serial, Firmware/OS version
getSSDP	1900	UDP	from response	Reads the UPnP device description advertised over SSDP, then fetches the device's own description page	Manufacturer, Model number, Model, Serial, Firmware, Name, UUID, Description, Location
getTlsCert	443	TCP	enrichment only	Reads the TLS certificate a device presents and infers the vendor from it	Manufacturer, DNS hostname, Description
getTPLink	9999	TCP	smart plug	Queries a TP-Link Kasa smart device	Manufacturer, Model, Serial, Firmware, Name, MAC, UUID, Description, Location
getTuya	6666, 6667	UDP	iot device	Identifies a Tuya smart home device	Manufacturer, Model, Serial, Firmware/OS version
getTwoN	80, 443	TCP	voip phone	Reads /api/system/info from a 2N IP intercom	Manufacturer, Model, Serial, Firmware/OS version, Name, MAC
getUbiquiti	10001	UDP	from response	Reads the Ubiquiti discovery response from a UniFi or airMAX device	Manufacturer, Model number, Model, Serial, Firmware/OS version, Hostname, Name, MAC
getWinrmInfo	5985, 5986	TCP	enrichment only	Reads hostname and domain from the WinRM NTLM challenge, without authenticating	Hostname, FQDN, Name, Domain
getWsd	3702	UDP	computer, printer	Discovers a WSD printer or computer over WS-Discovery	Presence only
getXbox	5050	UDP	game console	Queries a Microsoft Xbox over the SmartGlass protocol	Manufacturer, Serial, Name
getYeelight	1982	UDP	iot device	Identifies a Yeelight smart light	Manufacturer, Model, Serial, Firmware/OS version, Name
getZkteco	4370	TCP	access control	Reads serial, device name and firmware from a ZKTeco access control terminal	Manufacturer, Serial, Firmware/OS version, Name

Credentialed helpers

These nine use stored credentials to go beyond identification and perform a full audit.

Helper	Port	Proto	Device types	What it does	Best case attributes

Helper	Port	Proto	Device types	What it does	Best case attributes
getSNMP	161	UDP	from sysObjectID	Walks a device over SNMP v1, v2c or v3	Network interfaces, Routes, ARP table, IP addresses, Access points, Modules, Radios, Virtual machines, SNMP version
getSSH	22, plus custom	TCP	from response	Logs in over SSH and identifies the operating system	Manufacturer, OS name, OS group, OS family, sysDescr, CLI config
getSSHAuditResult	22, plus custom	TCP	computer, network device	Runs the full audit script over SSH and processes the result	Complete hardware, software and configuration audit
getWindows	5985, 5986, 135, 445	TCP	computer	Audits Windows over WinRM, then WMI via psexec / winexe, then wmic	Complete hardware, software and configuration audit
getDhcp	67	UDP	enrichment only	Reads the DHCP server's lease data for names devices reported themselves	Hostname from the device's own DHCP request
getEsx	80, 443	TCP	computer	Identifies a VMware ESXi host over SOAP, then audits it and its guests	Manufacturer, OS name, OS group, OS family, Firmware/OS version, Form factor, guest VMs
getProxmox	8006	TCP	computer	Identifies a Proxmox VE host over its API, then audits it and its guests	Manufacturer, OS name, OS group, OS family, Form factor, guest VMs
getNutanix	9440	TCP	computer	Calls the Nutanix v2.0 cluster API, then retrieves the cluster, hosts and VMs	Manufacturer, OS name, OS group, OS family, Form factor, cluster, hosts, VMs
getXcpng	443	TCP	computer	Identifies an XCP-ng or XenServer host over XAPI, then audits it and its guests	Manufacturer, OS name, OS group, OS family, Form factor, guest VMs

Notes

"From response" / "from advertised services" means the helper does not assign one fixed device type. It classifies from what the device reports, so a single helper can return a camera, an NVR, a printer or a media player as appropriate.

"Enrichment only" means the helper adds attributes to a device that has already been found by other means, rather than identifying a new class of device on its own.

getRedfish, getIpmi and getAmt are the three service-processor helpers. Between them they identify the management controller in most modern server hardware without credentials.

getTlsCert is deliberately conservative. A certificate is evidence of a name, not proof of a device, so it records the vendor and hostname it can read and nothing more.

getOnvif and getWsd both listen on 3702/udp. They are separate helpers because WS-Discovery carries both the ONVIF camera profile and the WSD printer profile, and the reply says which.

getUbiquiti and getAtg both use port 10001, one UDP and one TCP, and are unrelated protocols that happen to share a port number.