Pointing your network at the probe

Once the probe is Online, point your network devices at its LAN IP (shown on the probes list). The probe listens on the standard collector ports; you send to those.

Collector ports

Configure each device to export to the probe’s LAN IP on these ports:

Telemetry	Send to (on the probe’s LAN IP)	On by default?
Syslog (RFC 3164 + RFC 5424)	UDP 514 and TCP 514	Yes
SNMP traps (v1 / v2c)	UDP 162	Yes
sFlow	UDP 6343	No — must be enabled
NetFlow (v5 / v9)	UDP 2055	No — must be enabled

Caution

sFlow and NetFlow are off by default. The flow collector (flow_collector) ships disabled. Turn it on in the probe config before pointing exporters at 6343/2055, or the flow data is dropped. See Configuring the probe.

SNMP polling (the probe reaches out)

SNMP is different — the probe polls your devices outbound on UDP 161; you don’t point anything at the probe for this. SNMP polling is on by default with community public and SNMP v2c, and the probe auto-discovers devices it learns about from syslog, sFlow, and discovery.

To poll a device the probe must have the right community string (or v3 credentials) and the device must permit SNMP from the probe’s IP. Set the communities and version in the probe config — see Configuring the probe.

Device discovery

Discovery is on by default: the probe reads the ARP table and listens for mDNS/Bonjour, SSDP/UPnP, and LLDP to build a device inventory. Active ICMP sweeps (ping_sweep) are off by default; enable them in config if you want the probe to actively probe the subnet.

Verify data is arriving

After you’ve pointed a device at the probe, ask Claude:

Using Probe MCP, show me the syslog volume for the last 15 minutes, and search the live syslog for anything from that switch’s IP.

Stored rollups (like syslog volume) confirm ingest is working; a live search confirms the probe is receiving and indexing messages right now. If nothing shows up, check the port, the device’s export config, and that the collector is enabled — see Troubleshooting.