Ping

Device existence is determined by sending an ICMP ping request to each possible IP address in a specified range or subnet. When a device receives a ping, it responds with a reply, reporting the presence of the device to the discovery engine.

You can use this method to perform a comprehensive search that finds all devices.

This method is unusable if your network firewall does not allow Ping requests.

This method may not be best for the subnets that are sparse (those with few devices in their address space). The engine may spend a lot of time waiting for responses from the devices that don't exist. This situation occurs because the engine waits until the specified timeout period expires, and then, if applicable, the engine retries one or more times.

ARP

Device existence is initially determined by reading the ARP Cache table of a network infrastructure device (such as a switch or router). The ARP Cache table is read from the device, and then each device in the table is individually contacted and discovered.

This discovery method gives the discovery engine a set of devices to discover.

However, ARP Cache table entries are removed after relatively short periods of inactivity. This means that the scan by itself is not aware of inactive devices. You can fix this issue by sending a ping to each device in a target network. This process refreshes the table, which has all of the devices in it.