The NetVer detector is listening the network dispatcher which sends events about any new system on the network .It's a pair - IP and MAC. Information comes from ARP collector which sends it to dispatcher during the parsing and writing it's into NIMI DB.
Detector checks this pair against :
- Infoblox DHCP subnet ranges;
- MISCOMP registered MACs;
- MISCOMP MAC lists which belong static IP in MISCOMP;
- temporary registration users.
Detection is usually pretty close to real time.
The main key is MAC .If it not registered SCOMP - it will be an UR issue