---
title: "How Corelith works - From spreadsheet to live inventory"
description: "See how Corelith imports your existing assets, discovers what's on your network with a single collector, reconciles the two, and keeps your inventory honest."
url: https://corelith.io/how-it-works
---

_How it works_

# Your records, plus what the network actually sees

Corelith takes the asset list you already have and reconciles it, continuously, against every device a collector can see on your network. Here's the whole loop.

[Book my demo](#contact)

[Back to overview](https://corelith.io/)

## The reconciliation loop

Two sources of truth go in. One inventory comes out, and it stays honest because the loop never stops running.

_The collector_

## One appliance, no agents

Everything Corelith learns about your network comes through a single collector. Here's what it does, and what it won't do.

- **Default** - Passive discovery - The collector starts by listening. It reads what your switches and controller already know, and never sends traffic to the devices it's cataloging.

  - **ARP tables**

  - **SNMP forwarding tables**

  - **Controller integration**

  - **Zero packets to endpoints**

- **Opt-in** - Active scanning - Where you allow it, the collector can probe a range to identify device types. You choose which subnets, how fast, and which ranges are permanently off-limits.

  - **Per-subnet**

  - **Rate-limited**

  - **Never-scan zones**

  - **Off by default**

- **Built in** - Enrollment and transport - Each appliance enrolls to your tenant with its own credentials. Snapshots are signed on the way out and verified on arrival, and nothing listens for inbound connections.

  - **Per-tenant enrollment**

  - **Signed snapshots**

  - **Outbound HTTPS only**

  - **No inbound ports**

- **Hardware** - The appliance - A small fanless box with two gigabit ports. Plug it into a switch, power it, and it shows up in your dashboard ready to enroll. One per site is usually enough.

  - **Dual gigabit ports**

  - **Fanless**

  - **Shelf or rack**

  - **One per site**

Passive first, always

The collector will not send a single packet to a range you haven't explicitly enabled. Never-scan zones override everything else, so fragile or sensitive equipment stays untouched even if someone misconfigures a scan later.

_What to expect_

## A typical first two weeks

No project plan required. Here's how it usually goes.

- **Import your records** - Upload your spreadsheet or export. Corelith proposes a field mapping, you confirm it, and your categories, locations, and people are in. - Day 1 - Morning

- **Plug in the collector** - Plug the collector into a switch, enroll it from the dashboard, and give it read-only SNMP access. First passive snapshot arrives within minutes. - Day 1 - Afternoon

- **Work the unknowns** - Open the review queue. Most of what's there is expected infrastructure and a handful of devices nobody had written down. Promote, mark, or flag each one. - Day 2 - Review

- **Turn on active scanning where it helps** - If you want device-type identification on a subnet, enable active scanning for just that range. Everything else stays passive. - Week 1 - Optional

- **Run it, and export the first audit** - Check-outs, location moves, and drift flags are just part of the day now. Run your first audit export and notice how little you had to prepare. - Week 2 - Steady state

## Deployment details

- **What the collector needs from your network** - A wired port with a DHCP or static address, outbound HTTPS to Corelith, and read-only SNMP access to your switches. If you use a supported controller, an API key for it.

- **How many collectors you need** - One per site is the usual answer. A site with multiple isolated networks may want one per segment so passive discovery can see each of them.

- **Internet access** - Outbound only, to send snapshots to Corelith. No inbound ports are opened. If the connection drops, discovery pauses and resumes when it's back.

- **If the collector goes offline** - Your inventory keeps working. Last-seen timestamps stop updating and drift checks pause until the collector is back online.

- **Trying discovery without changing anything** - Yes. Run it passive-only for a couple of weeks and see what it finds before deciding whether to enable any active scanning.

## Where to next?

Pick the next step that fits.

- **Book a demo** - See discovery run against a network like yours.

- **Back to the overview** - Who it's for and how it compares.

- **Talk to us** - Ask about your switches, controller, or network layout.