Patent ID: 8331263

Claim:
A system comprising: at least one scan server within an enterprise network, the scan server configured to locate machines on the enterprise network and determine security states of the machines and services the machines are exposing on the enterprise network; at least one local link segment within the enterprise network; at least one agent within the enterprise network coupled to a corresponding one of the at least one local link segment; and at least one router coupled to place one of the at least one scan server in communication with one of the at least one agent, the communication between the scan server and the agent flowing through the at least one router; wherein responsive to a request of the scan server to discover at least one network node coupled to the local link segment, the agent is configured to: send a query message on the local link segment, maintain one or more responses from one or more network nodes on the local link segment within a predetermined time window after sending the query message, the predetermined time window being adjustable to compensate for noisiness and latency of the local link segment, obtain a link-local address corresponding to a network node of the one or more network nodes, convert the link-local address that is valid only within the local link segment to a routable site-local address that is valid within the enterprise network and invalid on a public network, and provide the routable site-local address to the scan server via the at least one router, and wherein a time delay between the scan server sending the request to the agent to discover the at least one network node and the agent providing the routable site-local address to the scan server is configured to be less than or equal to a preconfigured response time.