> For the complete documentation index, see [llms.txt](https://docs.enginsight.com/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.enginsight.com/docs/knowledge-base/english/watchdog/how-does-the-enginsight-watchdog-behave-on-the-network.md).

# How does the Enginsight Watchdog behave on the network?

The Watchdog is an Enginsight component that is installed in a subnet to monitor, for example, network devices on which no Pulsar can be installed, or that you want to inventory without using an agent.

On the network, the Watchdog behaves as follows:

## Concurrent Connections

A maximum of 1,024 connections are established in parallel across all networks. This applies to connections via ICMP, TCP, and UDP.

A maximum of 384 IP addresses are contacted in parallel per subnet. Several small local subnets within the same interface are treated as one network to protect against ARP flooding in flat Layer 2 structures.

For longer scanning intervals, the Watchdog automatically reduces the number of parallel connections. However, it is difficult to make a generally applicable statement here, as the value also depends on the number and size of the monitored networks.

The duration of downstream states (`ESTABLISHED`, `TIME_WAIT`) is determined by the operating system of the host or by the network components in between.

***

## Connections per Minute

Here, too, it is difficult to make a generally applicable statement, as the value also depends on the number and size of the monitored networks.

The following values can be used as a calculation basis:

* Timeout for ping/TCP dials: 500 ms
* Ports per target: 51 (maximum of 10 ports in parallel)
* IP addresses per subnet in parallel: maximum of 384 (smaller local subnets are then automatically combined into one subnet)

***

## Target Ports

{% hint style="warning" %}
**Please note**: Source ports are assigned dynamically by the operating system and depend on the respective default configuration of the operating system.
{% endhint %}

The Watchdog target ports include the following ports:

<table><thead><tr><th width="168.5859375">Protocol</th><th>Ports</th></tr></thead><tbody><tr><td>UDP</td><td>161 (SNMP)</td></tr><tr><td>TCP</td><td>21, 22, 23, 25, 53, 80, 88, 110, 111, 135, 137–139, 143, 160, 161, 443, 445, 465, 515, 587, 631, 993, 995, 1433, 1521, 1537, 1538, 1541, 1542, 1553, 2869, 3306, 3389, 3910, 3911, 5357, 5432, 5672, 5984, 6379, 6443, 7000, 7001, 7210, 8080, 8181, 9100, 10250, 27017</td></tr></tbody></table>

***

## Fingerprinting and Dependencies

The Watchdog has its own scan logic and has no dependencies towards operating system tools.

Active fingerprinting is performed once per asset every 24 hours. Additional fingerprinting is performed if the MAC address changes.

The following services are used for active fingerprinting:

* DNS via the system resolver
* SNMP (UDP/161)
* HTTP (TCP/80, 443, 5357, 8080)

Passive fingerprinting runs continuously and evaluates mDNS, LLDP, SSDP, and other services without establishing active connections of its own.

***

## Further Resources

**Knowledge Base**

* [How can I scan public IP address ranges with the Enginsight Watchdog?](/docs/knowledge-base/english/watchdog/how-can-i-scan-public-ip-address-ranges-with-the-enginsight-watchdog.md)

***