Discovery · A Panta Rhei service by Kramer
One appliance on your site.
Every VLAN, every device.
Layer-2 and Layer-3 discovery of every IP device, from any brand, across the networks and VLANs you allow — each one found, identified by MAC address, and kept current.
Inside your perimeter.
Nothing of yours to build.
Discovery is a service of the Site Agent: a Kramer appliance on your network, running Ubuntu Linux with its services containerized, reporting to Panta Rhei over secure TCP and HTTPS.
- VLAN 10AV controlScanned
- VLAN 20AV mediaScanned
- VLAN 30Dante audioScanned
- VLAN 40CorporateExcluded
- VLAN 50VoiceExcluded
- VLAN 60Building managementExcluded
- A Kramer appliance, on your site
Nothing to install on a server you maintain, and nothing installed on the devices themselves.
- Ubuntu Linux, containerized
Discovery, monitoring and automation run as isolated containers, updated by replacement.
- Secure TCP and HTTPS
To the Kramer cloud, or to a Panta Rhei deployed entirely inside your own network.
Six ways of asking.
One silence proves nothing.
A device that ignores a ping still answers ARP. One that advertises nothing still opens a port. Several protocols run against the same range, and a device is built from what they agree on.
- 01Layer 2 · link
ARP scan
Hosts that never answer a ping, by MAC address
- 02Layer 3 · network
ICMP
Which addresses are live
- 03Service discovery
mDNS
What a device says it is
- 04Service discovery
UPnP
Vendor, model and description
- 05Vendor protocol
Kramer protocol
Exact model, version and serial on Kramer hardware
- 06Layer 4 · transport
Port scanning
A service fingerprint when nothing announces itself
& more
The set grows as device families are added.
It scans what you allow.
Nothing else.
Which networks and VLANs the agent may touch is your decision, made per VLAN — not something it infers from what it can reach.
- ✦Multiple networks and VLANs. One agent discovers across every network and VLAN it has been given reach to.
- ✦Opt-in per VLAN. A VLAN you exclude is never probed. Voice, card access and building management stay out of scope.
- ✦Separate networks, separate agents. Isolated networks each get their own agent. No route is opened between them, and everything still lands in one inventory.
A network answers inconsistently.
An inventory should not.
Anything that scans repeatedly has to decide what a changed answer means. These are the decisions Discovery makes.
- Periodic checks, on your schedule
How often it re-checks is configuration. The load on your network is something you set.
- Policies against false positives
A device asleep or a port that answers once is not a new fact. Policies decide what counts as a change.
- Duplicate IPs handled deliberately
Two devices on one address is surfaced as a conflict, not resolved by silently picking a winner.
- A swap is detected, not guessed
When the hardware behind an address changes, the record follows the MAC. Nobody re-runs anything.
- 09:12…:7C:A4Display, room 4.12Seen
- 09:47—No answerHeld, not removed
- 10:05…:1F:B2Display, room 4.12Swap detected · record updated
- 10:31…:7C:A4 + …:0E:91Two devices, one addressDuplicate IP · flagged
Deployment at a glance — the page above, in the form the question usually gets asked in.
- Where it runs
- A Kramer appliance on your site. Ubuntu Linux, services containerized.
- What it talks to
- The Panta Rhei service over secure TCP and HTTPS — Kramer cloud, or inside your perimeter.
- What it scans
- Only the VLANs you opt in. An excluded VLAN is never probed.
- What it finds
- Any IP-connected device, from any brand. Monitoring and control are vendor-neutral; configuration and firmware updates apply to Kramer devices.
- How it finds it
- Layer-2 and Layer-3 discovery: ARP, ICMP, mDNS, UPnP, port scanning and a Kramer protocol. Nothing is installed on the devices themselves.
- Across segmentation
- One agent per isolated network. No route opened between them.
- How often
- Periodic re-checks at an interval you configure, with false-positive policies.
- Device identity
- Keyed on MAC address. Duplicate IPs surfaced, hardware swaps detected.
Audio routing,
from the same discovery.
The most recent addition. Dante devices come back from the same scan as everything else, and the agent's local gateway subscribes and unsubscribes channels between them — so a control system routes audio through the platform, on site, even when the link to the platform is down.
- GET
/dante/api/devicesThe Dante devices discovered on the local network.
- POST
/dante/api/channel/subscribe/…Route a source channel to an input channel.
- POST
/dante/api/channel/unsubscribe/…Remove a subscription and stop the route.
Exposed by the Site Agent on the local network. HTTP Basic authentication, credentials set in Site Agent Manager.
The questions IT and security actually ask.
What exactly gets installed on our network?
A Kramer appliance running Ubuntu Linux, with the Site Agent's services containerized on it. Discovery is one of those services. There is no separate server, no software on a machine you maintain, and no agent on the devices themselves.
What does the appliance talk to, and over what?
The Panta Rhei service, over secure TCP and HTTPS. That is either the Kramer-operated cloud, US or EU, or a Panta Rhei deployed entirely inside your own perimeter. The exact egress list is confirmed with your network team during deployment.
Which networks and VLANs does it scan?
Only the ones you give it. Discovery reaches across multiple networks and VLANs, and scanning is opt-in per VLAN. A VLAN you exclude is never probed.
Our network is segmented. Does that mean opening routes between segments?
No. Isolated networks each get their own agent, placed inside a network it can legitimately reach. Nothing is bridged, and what every agent finds still lands in the same inventory.
Which protocols does it use, and how often?
ARP scanning, ICMP, mDNS, UPnP, a Kramer protocol for Kramer hardware, and port scanning, among others. It re-checks periodically at an interval you configure, with policies that suppress false positives.
What happens with duplicate IPs, or when hardware is swapped?
Identity is keyed on the MAC address, not the IP. Two devices on one address is surfaced as a conflict rather than silently resolved, and a swap behind an address is detected and the record updated without anyone re-running anything.
Does it work with equipment we did not buy from Kramer?
Yes. Any IP-connected device from any vendor is discovered, monitored and controlled. The Kramer protocol means Kramer hardware is identified exactly rather than inferred. Configuration and firmware updates apply to Kramer devices.
Is there a Discovery screen to open?
No. Discovery runs continuously on the agent, and what it finds surfaces where you work: in Device Inventory, against spaces in the environment tree, and as the devices that alerts, automation and monitoring address.
Point it at your network and see.
Bring a real site — segmented, mixed-vendor, whatever you actually have — and we will show you what comes back.
Reviewing this for a security sign-off? The posture summary is here.