IPAM

IPAM gives Ordyn a tenant-aware view of IPv4 networks and the addresses known inside those networks.

Use it to document networks, reconcile addresses from endpoints and services, reserve addresses, and run lightweight network probes through ordyn-net.

IPAM is available in Inventory > IPAM.

Networks

Networks are organized in a tree by tenant.

The tree contains:

• tenant nodes
• normal folders
• Unassigned for networks without a folder
• Discovered networks for network drafts discovered from endpoint data
• network entries, shown by CIDR and optional name

A network has:

• CIDR
• name
• location
• notes
• enabled state
• folder
• default net node
• ICMP probe setting
• common protocol probe setting
• automatic scan state
• automatic scan interval
• maximum scan duration

Only enabled managed networks are scanned. Discovered networks are drafts. They let you review network information found by Ordyn before enabling it for IPAM management and scans.

Addresses

The address table shows the addresses inside a network.

Ordyn computes the normal IPv4 address rows for the network and merges in stored address data and latest observations. This means free addresses can be shown even when no stored address record exists for that address.

The table supports server-side pagination, searching, sorting, and filtering. The default page size is 100 addresses and larger pages are available when needed.

Address states are derived from the available data:

• Free - no current observation and no reserved/manual address data
• Used - an endpoint, net node, scan, or manual entry currently claims the address
• Reserved - the address is reserved for documentation or planning
• Conflict - multiple sources or manual data disagree about the address

For IPv4 prefixes from /0 through /30, the network and broadcast addresses are treated as non-usable reserved addresses and are not counted as usable hosts. Both addresses in a /31 and the single address in a /32 are usable.

Hosts found by a network scan are stored as IPAM addresses and remain visible even when they are not registered as endpoints. A discovered host stays Used when its latest discovery becomes stale.

Network address counts are shown as:

<used>/<usable>

For example, a /24 network has 254 usable addresses. The network and broadcast addresses are excluded from the usable total.

Address Details

An IP address can have manual documentation such as:

• name
• hostname
• MAC address
• reserved state
• dynamic state
• notes

Latest observation details are shown separately from the edit form. They show which source last reported the address and when it was observed.

If the hostname comes from an endpoint observation, the hostname links to that endpoint.

Network discovery details show the latest scan hostname, MAC address, probe method, latency, and discovered services. The address table shows a service count badge, and the details panel shows the protocol, port, title, server, and banner information reported for each service.

Discovery state is shown as:

• Never - the address has not been found by a network scan
• Reachable - the address was found within the last three configured scan intervals
• Stale - the last discovery is older than three configured scan intervals

Endpoint precedence

When a discovered IP address is also assigned to an endpoint, the endpoint identity takes precedence in the IPAM address row. Network scans continue to update discovery time, latency, MAC address, and service details without replacing the endpoint identity.

IPAM reports a conflict when:

• the endpoint MAC address differs from the MAC address found by the network scan
• more than one endpoint currently claims the same IP address
• manual hostname or MAC documentation differs from the active identity

Manual address documentation remains user-managed. If an endpoint moves away from or releases an address, IPAM falls back to the latest available scan identity for that address.

Data Sources

Ordyn fills IPAM from multiple sources:

• agent endpoint network interfaces and reported system status network interfaces
• generic endpoint network interfaces
• switch endpoint network interfaces and switch management addresses
• printer endpoint network interfaces and printer management addresses
• Telematik card terminal network interfaces and terminal status
• net node reachability probes
• IPAM network scans

Ordyn reconciles endpoint observations periodically and also refreshes reconciliation when relevant networks change. Existing manual address documentation is preserved.

If an endpoint changes IP address, the next reconciliation moves the latest observation to the current address and clears stale latest-observation data from the previous address. Historical observations are kept for traceability.

If Ordyn receives a CIDR from an endpoint or service and no matching managed network exists yet, it can create a disabled discovered network draft. If only an IP address is known and no matching network exists, the address appears after a matching network is created.

Generic Endpoints

Generic endpoints are documentation endpoints without an Ordyn agent.

Use them for devices that should appear in inventory and IPAM but do not run an agent, such as appliances, printers, unmanaged servers, or manually tracked devices.

A generic endpoint can have:

• display name
• serial number
• location
• comments
• one or more network interfaces

Each generic endpoint interface can store IP and MAC information. It can also be configured for ICMP and common protocol probing through a net node.

The same interface probe model is used by agent, switch, printer, and Telematik card terminal interfaces when they have configured IP addresses.

Generic endpoints do not support normal agent jobs, software inventory, or agent health features.

Endpoint Interface Probes

Endpoint interface probes are configured on the endpoint's network interfaces. They are independent from network scans.

An interface is eligible for background probing when:

• the endpoint is approved
• the endpoint has an effective net node
• the interface is not deleted
• the interface has an IP address
• ICMP probing or common protocol probing is enabled on the interface

The effective net node receives the current probe targets in its runtime configuration when it connects and whenever relevant endpoint interface or net-node assignment data changes.

Probe results are shown on the endpoint interface panels and can contribute IPAM observations. Common protocol results can include lightweight service metadata such as protocol, port, banner, page title, server header, reachability, and error details.

Configure the successful probe interval on the net node. The default is 60 seconds, and the allowed range is 30 to 3,600 seconds. Failed targets are retried after 2, 4, 8, and then 10 minutes. A successful result returns the target to the configured interval.

Probe freshness uses the greater of the global endpoint-network freshness setting and twice the net node's probe interval. This prevents a normally scheduled result from becoming stale before the next probe is due.

Ignore Rules

IPAM ignore rules exclude unwanted address observations.

Use them for cases such as:

• home networks
• VPN ranges
• link-local ranges
• temporary lab networks
• addresses reported by a specific endpoint that should not be managed in IPAM

An ignore rule can match a CIDR globally or only when the observation comes from a specific source endpoint or net node.

Ignoring an observation does not delete manual address documentation. It prevents matching source data from contributing to the current IPAM state.

Network Scans

IPAM scans are configured on networks. There is no separate scan-range concept.

Select Run scan to start a manual scan. To scan regularly, enable Run automatic scans in the network form and choose an interval. Automatic scanning is off by default. The default interval is 60 minutes, and the allowed range is 5 minutes to 7 days.

Enabling automatic scans makes the first scan due immediately. After a successful manual or automatic scan, the next automatic scan is scheduled from that completion time. Failed automatic scans retry after 1, 2, 5, 10, and then 15 minutes. The normal configured interval resumes after a successful scan.

When a network scan runs, Ordyn asks the selected net node to scan the network CIDR. The network controls whether the scan includes:

• ICMP reachability checks
• common protocol probes

Scan results are stored as IPAM observations and reconciled into the address table.

The network page shows the active scan's progress and a history of manual and automatic runs. Each history row includes its status, scanned and target address counts, reachable host count, discovered service count, and any error. Scan-run history is retained for 90 days.

One scan can be active for a network at a time. By default, a net node runs up to two network scans at once; additional scans wait in request order. Users with permission to update IPAM can cancel a queued or active scan. Results received before cancellation remain available in IPAM.

The maximum scan duration limits how long a run may remain active. It defaults to 60 minutes and can be configured from 5 minutes to 24 hours for each network. A scan that reaches this limit is stopped and shown as failed in its history.

Network scanning supports IPv4 CIDRs. For prefixes from /0 through /30, the network and broadcast addresses are excluded. Both addresses in a /31 and the single address in a /32 are scanned.

The Maximum IPAM Scan Addresses setting limits the usable addresses in one scan. It defaults to 4,096 and accepts values from 1 to 65,536. A network that exceeds the limit cannot be enabled for automatic scanning or started manually.

Discovered hosts are added to IPAM only. A network scan does not create endpoints.

Common protocol probes are lightweight service checks. They are intended to identify reachable services, not to change device state.

Current common protocol probes are:

Port	Protocol
21	FTP
22	SSH
23	Telnet
80	HTTP
443	HTTPS
445	SMB
631	IPP
3389	RDP
5900	VNC
8080	HTTP alternate
8443	HTTPS alternate

Limitations

Network scanning supports IPv4 only. IPv6 addresses can still enter IPAM from endpoint and service observations, but IPv6 networks cannot be scanned.

IPAM is inventory and documentation. It does not change endpoint network configuration, DHCP configuration, DNS records, or switch configuration.