Forescout · eyeSight / eyeControl · Lesson 3 of 10

Discovery: passive first, active with a written list

eyeSight can watch (passive) or poke (active). A careless NMAP on 10.50.1.0/24 is how a PLC locks up. This lesson is how Forescout finds devices — and the written exception list for active methods.

Updated 2026-08-18·16 min read·L2 primary·Quiz at end

After this page you can

Contrast passive vs active discovery.
Name SNMP/WMI/NMAP as active and when to allow them.
Exclude OT prefixes from active scans.
Prove a host was seen passively before you scan it.

The ticket

Biomed: “Your scanner crashed the infusion VLAN.” The policy had “NMAP all unknowns.” That is not visibility. That is an incident.

Quick interview answer

Passive: SPAN/TAP, DHCP, banners that already exist. Active: SNMP, WMI, NMAP, authenticated queries. Docs: eyeSight uses a mix after a device is seen. Production rule: passive everywhere; active only on IT user/server subnets that signed the change. OT/medical: passive + vendor-approved methods only.

Passive watch versus active probe — If you did not write the prefix on a change ticket, do not NMAP it.

Lab data · dummy only

Enterprise Manager fs-em 10.10.10.30 · Appliance fs-app1 10.10.10.31 · span/mirror on sw-access-01 · same LAN 10.20.30.0/24 · Priya 10.20.30.80 · printer 10.20.30.60 · OT PLC 10.50.1.10. Not a live customer.

Two ways to see

	Passive	Active
How	SPAN, DHCP, traffic	NMAP, SNMP, WMI, login
Risk	Low	Can fault OT / printers
Use	Default	IT subnets, after classify attempt

https://fs-em.techclick-lab.in

Training mock · not live

Forescout Console

Asset InventoryPolicyChannelsTools

Tools → Options → Discovery

Active scanning

Passive

On — all channels

NMAP

Allow 10.20.30.0/24 only

Exclude

10.50.1.0/24 OT

Schedule

Off-hours for IT servers

eyeSight classification uses passive + active. Training mock.

Allow-list

Allow: 10.20.30.0/24 users. Deny/exclude: 10.50.1.0/24 PLC, 10.60.0.0/24 medical. Review quarterly.

How you set it

Side A — prefixes
Write the list before clicking.
Side B — console
Discovery / Internal Network. Active methods scoped. OT excluded.
Side C — prove
A new laptop appears from DHCP/span before any NMAP. PLC appears from traffic only.

Four discovery failures

1 · NMAP all RFC1918

2 · WMI as domain admin everywhere

3 · No DHCP visibility (no span of DHCP server)

4 · Calling empty inventory a product bug

How to prove it

Close the ticket only when

1) Exclude list contains OT. 2) A test host is seen passively. 3) No active hit on 10.50.1.10. 4) Change ticket attached.

Traps

Wrong	Right
Scan to classify faster	Better SPAN + DHCP
One global NMAP	Per-segment allow

Forescout class series: Three products · First day · Discovery · Classification · Policy · Enforcement · Switch plugin · eyeExtend · OT / IoT · vs ISE + interview

Sources

Forescout eyeSight — passive and active classification methods.
Internal change-control: no OT scan without vendor approval.