# 3 How it works

Network discovery basically consists of two phases: Discovery and
Actions.

First, we discover a host or a service, and generate discovery event or
several events.

Then we process the events and apply certain actions depending of type
of discovered device, IP, its status, up/down time, etc.

#### Discovery

Zabbix periodically scans IP ranges defined in network discovery rules.
Frequency of the check is configurable for each rule individually.

Note that one discovery rule will always be processed by a single
discoverer process. The IP range will not be split between multiple
discoverer processes.

Each rule defines set of service checks to be performed for IP range.

Events generated by network discovery module have Event Source
"Discovery".

Zabbix generates the following events:

|Event|When generated|
|-----|--------------|
|Service Up|Every time Zabbix detects active service.|
|Service Down|Every time Zabbix cannot detect service.|
|Host Up|If at least one of the services is UP for the IP.|
|Host Down|If all services are not responding.|
|Service Discovered|If the service is back after downtime or discovered for the first time.|
|Service Lost|If the service is lost after being up.|
|Host Discovered|If host is back after downtime or discovered for the first time.|
|Host Lost|If host is lost after being up.|

#### Actions

For a description of all conditions available for network discovery
based events see [action
conditions](/manual/config/actions#action_conditions).

For a description of all operations available for network discovery
based events see [operations](/manual/config/actions#operations).