Identifying devices and device intents in an IoT network

An apparatus, comprising:

• one or more network interfaces;
• a processor coupled to the one or more network interfaces and configured to execute one or more processes;
• and
• a memory configured to store a process that is executable by the processor, the process when executed configured to:
• receive telemetry data collected passively by a sensor application regarding a node in a network, wherein the sensor application passively collects the telemetry data by performing deep packet inspection (DPI) on traffic flowing through networking equipment located on a different side of a Network Address Translation (NAT) boundary defined by a NAT layer in the network than that of the apparatus;
• request, after receiving the telemetry data, that the sensor application perform active discovery of nodes in the network by broadcasting a hello request to the nodes using a communication protocol detected from the telemetry data passively collected by the sensor application;
• receive active discovery data collected by the sensor application via the active discovery of the nodes in the network;
• and
• generate, based on the telemetry data, the active discovery data, and engineering and configuration data associated with the node, an identity profile for the node that comprises two or more unique IP address-MAC address pairs associated with the node, wherein the telemetry data and the active discovery data indicate two or more different IP addresses or two or more different MAC addresses for the node, further wherein engineering and configuration data comprises at least one of:
• a General Station Description (GSD) file, an Electronic Data Sheet (EDS) file, or a Substation Configuration Language (SCL) file.

A tangible, non-transitory, computer-readable medium storing program instructions that cause an asset inventory service executed by one or more devices to perform a process comprising:

• receiving, at the asset inventory service, telemetry data collected passively by a sensor application regarding a node in a network, wherein the sensor application passively collects the telemetry data by performing deep packet inspection (DPI) on traffic flowing through networking equipment located on a different side of a Network Address Translation (NAT) boundary defined by a NAT layer in the network than that of the asset inventory service;
• requesting, by the asset inventory service and after receiving the telemetry data, that the sensor application perform active discovery of nodes in the network by broadcasting a hello request to the nodes using a communication protocol detected from the telemetry data passively collected by the sensor application;
• receiving, at the asset inventory service, active discovery data collected by the sensor application via the active discovery of the nodes in the network;
• and
• generating, by the asset inventory service and based on the telemetry data, the active discovery data, and engineering and configuration data associated with the node, an identity profile for the node that comprises two or more unique IP address-MAC address pairs associated with the node, wherein the telemetry data and the active discovery data indicate two or more different IP addresses or two or more different MAC addresses for the node, further wherein the engineering and configuration data comprises at least one of:
• a General Station Description (GSD) file, an Electronic Data Sheet (EDS) file, or a Substation Configuration Language (SCL) file.