Why the CMDB is always out of date

Most organizations maintain a CMDB (a spreadsheet, a ServiceNow instance, or a custom database) that is supposed to contain every device and endpoint on the network. In practice, these are perpetually stale. A new VM spins up, a contractor plugs in a laptop, a printer gets moved to a different VLAN, and the CMDB does not know about any of it until someone manually updates it. By then, three more changes have happened.

SAMURAI skips the CMDB and builds a live endpoint table from the data already on your devices, so nobody types anything in and there’s no reconciliation script to maintain. The network tells you what’s on it, instead of the other way around.

Ten sources, merged in a fixed order

Endpoint aggregation runs with 10 concurrent workers, each pulling data from a different source and merging results into a single table. The order is deliberate: later sources can enrich earlier records, but they can’t overwrite higher-priority data.

Source priority (in order)

  1. MAC tables. Every switch port learns the MAC addresses behind it, which makes this the most reliable link between a physical port and a device, so every record starts here.
  2. ARP/IP. Maps MAC addresses to IP addresses. Combined with MAC tables, this gives you “device X with MAC Y has IP Z on port Gi1/0/3.”
  3. DHCP snooping. The same MAC-to-IP mapping from the DHCP server’s side, which helps once ARP entries have aged out.
  4. CDP/LLDP neighbors. Tells you what’s connected to each port. A Cisco phone advertising itself via CDP enriches the endpoint with device name, model, and capabilities.
  5. 802.1X sessions. Adds authentication state, username, and authorization policy to the endpoint record.
  6. OUI vendor lookup. The first three octets of the MAC address identify the manufacturer. SAMURAI ships a 39,000-entry IEEE OUI database inside the image, so lookups never leave the box.
  7. Gateway interfaces. Router interfaces acting as gateways are tagged with Vendor: "Gateway". Loopback, Tunnel, LISP, and NVE interfaces are skipped; they are infrastructure, not endpoints.
  8. Router ARP and neighbors. Extends the ARP view beyond switches into the routing layer.
  9. Palo Alto routing and IPSec. Firewalls see endpoints that switches don’t, especially across VPN tunnels.
  10. APIC fvCEp hosts. In ACI fabrics, the APIC tracks every endpoint learned on the fabric. This last layer adds fabric-specific data such as EPG membership and encapsulation.

Once endpoints are correlated, the search engine supports field-scoped queries with CIDR awareness. Searching ip:10.240.0.0/16 returns every endpoint in that subnet. Searching vendor:cisco filters by OUI-resolved manufacturer. The search parser supports AND/OR/NOT operators, quoted phrases, and negation (-ip:10.240). All of it runs against the correlated table, and a field-scoped query returns in under a second even when that table is large. The demo page shows this table, captured from a real production deployment.