Find a device

You can create a detailed search for a device based on information observed over the wire, such as IP address, MAC address, hostname, or protocol activity. You can also search by customized information such as device tag or custom names associated with the device.

1. Log into the Web UI on the Discover or Command appliance and then click Metrics at the top of the page.
2. Click Devices in the left pane.
3. To filter devices by device details, click Any Column and select one of the following categories:

   Any Column

   Filters results by the exact string that matches any device detail.

   Name

   Filters results by the discovered or custom device name. For example, a discovered device name can include the IP address or hostname. For more information about device names and how to change them, see Change a device name.

   MAC address

   Filters results by the device MAC address. You might see two devices with the same MAC address in the results. During the device discovery process, an L2 parent device (MAC address only) and L3 child device (IP address) are created for every IP address observed on the wire. The L3 device has L2-L7 protocol metrics associated with it. For more information, see Device Discovery FAQ

   VLAN

   Filters results by the device Virtual Local Area Network (VLAN) tag.

   IP address

   Filters results by the device IP address. The IP address criteria can include CIDR notation in IP address or subnet prefix length format. For example, 10.10.0.0/16 for IPv4 networks or 2001:db8::/32 for IPv6 networks.

   Node (Command appliance only)

   Filters results by devices associated with a connected Discover appliance name.

   Tag

   Filters results by a user-defined device tag. For more information, see Add a tag to a device.

   Type

   Filters results by the following device attributes that you select from the drop-down list:

   Activity: Filters results by metric activity associated with the device. For example, selecting Activity: HTTP Server returns devices with HTTP server metrics, and any other device with a device role set to WWW Server.

   Device Type: Filters results by a device role, such as gateway, firewall, load balancer, and WWW Server. For more information about device roles and how to change them, see Change or add a device role.

   Class: Filters results by a device class, such as node, remote, and custom devices.

4. To filter results by L2 or L3 device type, click All Devices to the right of the search field and then select one of the following categories:

   L2 device

   An L2 device in the ExtraHop system has a MAC address only. ExtraHop automatically creates an L2 device based on a MAC address, and all network throughput activity is tracked against that device. For more information about an L2 device, see Device Discovery FAQ in the Device Discovery FAQ.

   L3 device

   An L3 device in the ExtraHop system has an observed IP address that comes from local traffic or from traffic coming from a router. For more information, see Device Discovery FAQ in the Device Discovery FAQ.

5. Click Search.

   Note:

   You can download the list of devices to a CSV file. In the upper right corner of the page, click the command menu and then select CSV.

6. Click the name of the device you are searching for from the list of results.
   A protocol page for the device opens, which displays an overview of network throughput and top protocol activity.

Activity groups contain devices that are automatically grouped together based on observed protocol traffic over the wire. Searching for a device within an activity group helps you quickly locate a client or server that is associated with a protocol, or discover a decommissioned device that is still actively communicating over a protocol.

1. Log into the Web UI on the Discover or Command appliance and click Metrics at the top of the page.
2. Click Activity Group in the left pane.
3. Select an activity group, such as HTTP Servers. A protocol page for the device group appears.
4. In the top right corner of the page, click Group Members. A page appears that contains all of the devices that sent HTTP responses over the wire.

   Note:

   This page only displays devices within the group that have metrics associated with them for the selected time interval. To see all of the devices within the group, click Devices in the left pane of the protocol page, as shown in the following figure.

5. Click on a web server device name in the table. A protocol page for the web server appears. This page displays traffic and protocol metrics associated with that web server.
6. In the left pane in the Server Activity section, click HTTP to view the total number of HTTP responses sent by this device.
   

   Note:

   If you do not see an activity group for a protocol that you were expecting to see, the ExtraHop system might not have observed that type of protocol traffic over the wire yet, or the protocol might require a module license. For more information, see the I don't see the protocol traffic I was expecting? section in the License FAQ.

If you want to know which devices are actively talking to each other, you can drill down by Peer IPs from a device or device group protocol page.

1. Log into the Web UI on the Discover or Command appliance.
2. Click Metrics and then select Device, Activity Group, or Device Group in the left pane.
3. Search for a device or device group, and then click the name of a device or device group from the list of results.
   A protocol page for that selected device or device group appears.
4. In the Details section near the upper right corner of the page, click Peer IPs.
   
   A list of peer devices appears, which are broken down by IP address. You can investigate network bytes and packets information for each peer device, as shown in the following figure.
5. To view network latency (round trip time) metrics for each peer device, complete the following steps:
   1. Click Back to Overview or the back button to return to the original protocol page for the device or device group.
   2. Click TCP in the left pane.
   3. In the Details section near the upper right corner of the page, click Peer IPs.