Symantec 11281411 Administration Guide - Page 20

20 Managing Symantec AntiVirus Managing with the Symantec System Center Using the Discovery Service The Symantec System Center console runs a single Windows NT service, the Symantec System Center Discovery Service (Nsctop.exe). This service is responsible for discovering the computers running Symantec AntiVirus server that appear in the Symantec System Center console. The Discovery service also populates the Symantec System Center console with objects. You can choose one of the following Discovery types: ■ Load from cache only ■ Local Discovery ■ Intense Discovery See "Understanding Load from cache only discovery type" on page 22. See "Understanding Local Discovery" on page 22. See "Understanding Intense Discovery" on page 23. How discovering computers on the network works To discover computers on the network, a computer running Symantec AntiVirus server sends a ping packet to a computer running Symantec AntiVirus client. The ping program verifies that the remote computer exists and can accept requests. When the Ping Discovery Service (Intel PDS) hears a ping, it responds with a pong packet. Ping and pong packets are about 1 KB. A successful pingpong discovery ensures that the computer is working. The pong also provides valuable information, such as the following: ■ Date of the computer's virus definitions files ■ When the computer was last infected Both IP and IPX pings are sent to the remote computer running Symantec AntiVirus server to determine what type of protocol it uses. Pings are also sent that support Norton AntiVirus Corporate Edition and LANDesk Virus Protect, legacy versions of Symantec AntiVirus. The data from the computer running Symantec AntiVirus client is stored on the computer running Symantec AntiVirus server that is the client's parent server. The Symantec System Center console reads each parent server's registry to get the data that it displays in the console. Following the completion of this process, Normal Discovery runs.