@oneuptime/common 12.0.32 → 12.0.33

package/Tests/Utils/NetworkDevice/SnmpCredentialUtil.test.ts

@@ -0,0 +1,268 @@
+import { describe, expect, test } from "@jest/globals";
+import NetworkDevice from "../../../Models/DatabaseModels/NetworkDevice";
+import NetworkSnmpCredentialProfile from "../../../Models/DatabaseModels/NetworkSnmpCredentialProfile";
+import {
+  SnmpCredentialCarrier,
+  hasUsableCredentials,
+} from "../../../Utils/NetworkDevice/SnmpCredentialUtil";
+
+/*
+ * hasUsableCredentials is the predicate behind the poller's resolution order:
+ * device columns, then the device's profile, then the site's profile, first
+ * usable set wins, and with none the device is only pinged. It cannot throw
+ * and it cannot look broken - a wrong answer just quietly leaves a device
+ * un-walked, or walks it with a set that will never authenticate - so the
+ * whole matrix is pinned here: every spelling of every version, crossed with
+ * every way a credential can be missing.
+ */
+
+const EMPTY_VALUES: ReadonlyArray<string | null | undefined> = [
+  undefined,
+  null,
+  "",
+  " ",
+  "   ",
+  "\t",
+  "\n",
+];
+
+/*
+ * The stored spelling ("V2c"), the probe-contract spelling ("2c"), and the
+ * case drift a hand-written row produces. SnmpVersionUtil.parse accepts all
+ * of them, and this util must agree with parse rather than compare raw text.
+ */
+const V1_SPELLINGS: ReadonlyArray<string> = ["V1", "v1", "1"];
+const V2C_SPELLINGS: ReadonlyArray<string> = ["V2c", "v2c", "V2C", "2c", "2C"];
+const V3_SPELLINGS: ReadonlyArray<string> = ["V3", "v3", "3"];
+
+describe("hasUsableCredentials - v1 and v2c need a community string", () => {
+  test.each([...V1_SPELLINGS, ...V2C_SPELLINGS])(
+    "version %p with a community string is usable",
+    (version: string) => {
+      expect(
+        hasUsableCredentials({
+          snmpVersion: version,
+          snmpCommunityString: "public",
+        }),
+      ).toBe(true);
+    },
+  );
+
+  test.each([...V1_SPELLINGS, ...V2C_SPELLINGS])(
+    "version %p with a whitespace-padded community string is still usable",
+    (version: string) => {
+      expect(
+        hasUsableCredentials({
+          snmpVersion: version,
+          snmpCommunityString: "  public  ",
+        }),
+      ).toBe(true);
+    },
+  );
+
+  const missingCommunity: Array<[string, string | null | undefined]> = [];
+  for (const version of [...V1_SPELLINGS, ...V2C_SPELLINGS]) {
+    for (const empty of EMPTY_VALUES) {
+      missingCommunity.push([version, empty]);
+    }
+  }
+
+  test.each(missingCommunity)(
+    "version %p with community string %p is not usable",
+    (version: string, community: string | null | undefined) => {
+      expect(
+        hasUsableCredentials({
+          snmpVersion: version,
+          snmpCommunityString: community,
+        }),
+      ).toBe(false);
+    },
+  );
+
+  /*
+   * A v3 username on a v2c row is a leftover from switching the version in a
+   * form, not a credential v2c can send. It must not rescue the row.
+   */
+  test.each([...V1_SPELLINGS, ...V2C_SPELLINGS])(
+    "version %p is not rescued by a v3 username",
+    (version: string) => {
+      expect(
+        hasUsableCredentials({
+          snmpVersion: version,
+          snmpCommunityString: "",
+          snmpV3Username: "monitoring",
+        }),
+      ).toBe(false);
+    },
+  );
+});
+
+describe("hasUsableCredentials - v3 needs a security name", () => {
+  test.each(V3_SPELLINGS)(
+    "version %p with a username is usable",
+    (version: string) => {
+      expect(
+        hasUsableCredentials({
+          snmpVersion: version,
+          snmpV3Username: "monitoring",
+        }),
+      ).toBe(true);
+    },
+  );
+
+  /*
+   * Auth and privacy keys are legitimately absent at noAuthNoPriv, so the
+   * predicate reads neither: a v3 row is usable on its username alone. A key
+   * that is missing at a higher security level is the device's error to
+   * report, not this function's to predict.
+   */
+  test.each(V3_SPELLINGS)(
+    "version %p is usable on the username alone, with no keys at all",
+    (version: string) => {
+      const carrier: SnmpCredentialCarrier & {
+        snmpV3AuthKey?: string | undefined;
+        snmpV3PrivKey?: string | undefined;
+      } = {
+        snmpVersion: version,
+        snmpV3Username: "monitoring",
+        snmpV3AuthKey: undefined,
+        snmpV3PrivKey: undefined,
+      };
+
+      expect(hasUsableCredentials(carrier)).toBe(true);
+    },
+  );
+
+  const missingUsername: Array<[string, string | null | undefined]> = [];
+  for (const version of V3_SPELLINGS) {
+    for (const empty of EMPTY_VALUES) {
+      missingUsername.push([version, empty]);
+    }
+  }
+
+  test.each(missingUsername)(
+    "version %p with username %p is not usable",
+    (version: string, username: string | null | undefined) => {
+      expect(
+        hasUsableCredentials({
+          snmpVersion: version,
+          snmpV3Username: username,
+        }),
+      ).toBe(false);
+    },
+  );
+
+  /*
+   * The mirror of the v2c case above. A community string on a v3 row is what
+   * a device that was upgraded from v2c still carries; v3 cannot send it, so
+   * it must not make the row usable.
+   */
+  test.each(V3_SPELLINGS)(
+    "version %p is not rescued by a community string",
+    (version: string) => {
+      expect(
+        hasUsableCredentials({
+          snmpVersion: version,
+          snmpCommunityString: "public",
+          snmpV3Username: "",
+        }),
+      ).toBe(false);
+    },
+  );
+});
+
+describe("hasUsableCredentials - a missing or unrecognised version reads as v2c", () => {
+  /*
+   * The column default on both the device and the profile is "V2c", and
+   * SnmpVersionUtil.parse falls back to v2c for anything it does not
+   * recognise. A row with a community string and no version is therefore
+   * polled as v2c, and this predicate has to say so, or a freshly created
+   * profile that never had its version touched would count as unusable.
+   */
+  test.each([undefined, null, "", "   ", "V4", "snmp", "2"])(
+    "version %p with a community string is usable, as v2c",
+    (version: string | null | undefined) => {
+      expect(
+        hasUsableCredentials({
+          snmpVersion: version,
+          snmpCommunityString: "public",
+        }),
+      ).toBe(true);
+    },
+  );
+
+  test.each([undefined, null, "", "V4"])(
+    "version %p with only a v3 username is not usable, because it is not v3",
+    (version: string | null | undefined) => {
+      expect(
+        hasUsableCredentials({
+          snmpVersion: version,
+          snmpV3Username: "monitoring",
+        }),
+      ).toBe(false);
+    },
+  );
+
+  test("an empty object is not usable", () => {
+    expect(hasUsableCredentials({})).toBe(false);
+  });
+});
+
+describe("hasUsableCredentials - accepts any row carrying the three fields", () => {
+  /*
+   * The resolution order asks this question of a NetworkDevice and then of a
+   * NetworkSnmpCredentialProfile, so both model classes have to be
+   * assignable to the parameter without a cast. These are compile-time
+   * assertions as much as runtime ones: if either model renames one of the
+   * three columns, ts-jest refuses to compile this file.
+   */
+  test("a NetworkDevice row is accepted as-is", () => {
+    const device: NetworkDevice = new NetworkDevice();
+    device.snmpVersion = "V2c";
+    device.snmpCommunityString = "public";
+
+    expect(hasUsableCredentials(device)).toBe(true);
+
+    device.snmpCommunityString = "";
+
+    expect(hasUsableCredentials(device)).toBe(false);
+  });
+
+  test("a NetworkSnmpCredentialProfile row is accepted as-is", () => {
+    const profile: NetworkSnmpCredentialProfile =
+      new NetworkSnmpCredentialProfile();
+    profile.snmpVersion = "V3";
+    profile.snmpV3Username = "monitoring";
+
+    expect(hasUsableCredentials(profile)).toBe(true);
+
+    profile.snmpV3Username = "";
+
+    expect(hasUsableCredentials(profile)).toBe(false);
+  });
+
+  /*
+   * A freshly constructed model has every column undefined. That is the
+   * state of a device registered with nothing but an address - the exact
+   * case profiles exist for - and it must read as "ping only".
+   */
+  test("a bare model with nothing set is not usable", () => {
+    expect(hasUsableCredentials(new NetworkDevice())).toBe(false);
+    expect(hasUsableCredentials(new NetworkSnmpCredentialProfile())).toBe(
+      false,
+    );
+  });
+
+  test("it never mutates the row it is asked about", () => {
+    const carrier: SnmpCredentialCarrier = {
+      snmpVersion: " v3 ",
+      snmpCommunityString: "  public ",
+      snmpV3Username: "  monitoring ",
+    };
+    const snapshot: SnmpCredentialCarrier = { ...carrier };
+
+    hasUsableCredentials(carrier);
+
+    expect(carrier).toEqual(snapshot);
+  });
+});

package/Tests/Utils/NetworkDiscovery/AutoImportRuleMatcher.test.ts

@@ -380,12 +380,19 @@ describe("AutoImportRuleMatcher.ruleMatchesHost", () => {
     });
   });
 
+  /*
+   * The gate asks what the host ANSWERED, not how it would be monitored.
+   *
+   * Under ping-first polling (issue #3562) every discovered host imports as a
+   * probe-polled device — a ping-only host is a first-class device now, not a
+   * monitor-backed stub. So `monitoringMethodForDiscoveredHost` is a constant
+   * and cannot express this question; only `isPingOnlyDiscoveredHost` can.
+   * The gate itself is unchanged and still default-closed: an SNMP credential
+   * typo makes a whole subnet report as ping-only, and a rule silently
+   * importing hundreds of half-identified hosts on that typo is the failure
+   * mode it exists to prevent.
+   */
   describe("the ping-only gate", () => {
-    /*
-     * An SNMP credential typo makes a whole subnet report as ping-only; a
-     * rule silently importing hundreds of half-identified hosts on that typo
-     * is the failure mode the default-closed gate exists to prevent.
-     */
     it("does not let an import rule claim a ping-only host by default", () => {
       expect(
         AutoImportRuleMatcher.ruleMatchesHost(
@@ -395,6 +402,49 @@ describe("AutoImportRuleMatcher.ruleMatchesHost", () => {
       ).toBe(false);
     });
 
+    /*
+     * The regression, stated as the fact it depends on. The gate briefly ran
+     * off the imported monitoring method, which now answers Probe for every
+     * host — so it never fired at all and the default-closed gate was open
+     * for the whole fleet. This pins it to the host's own SNMP answer: two
+     * hosts identical in every field the rule matches on, differing only in
+     * `snmpReachable`, must be claimed differently.
+     */
+    it("keys on the host's SNMP answer, not on the method it would import under", () => {
+      const rule: AutoImportRuleCandidate = { ipMatchTarget: "10.0.0.0/24" };
+
+      expect(
+        AutoImportRuleMatcher.ruleMatchesHost(
+          rule,
+          host({ snmpReachable: true }),
+        ),
+      ).toBe(true);
+      expect(
+        AutoImportRuleMatcher.ruleMatchesHost(
+          rule,
+          host({ snmpReachable: false }),
+        ),
+      ).toBe(false);
+    });
+
+    /*
+     * And through the whole rule set, which is the surface the engine and the
+     * dry-run dialog actually call: a ping-only host does not import at all
+     * on a rule that never opted in.
+     */
+    it("leaves a ping-only host unimported by an evaluation that did not opt in", () => {
+      const evaluation: AutoImportHostEvaluation =
+        AutoImportRuleMatcher.evaluateHost(
+          [{ ipMatchTarget: "10.0.0.0/24" }],
+          host({ snmpReachable: false }),
+        );
+
+      expect(evaluation.shouldImport).toBe(false);
+      expect(evaluation.matchedRules).toEqual([]);
+      // Not a veto — nothing claimed it, which reads differently in a dry run.
+      expect(evaluation.excludedByRule).toBeUndefined();
+    });
+
     it("lets an import rule claim a ping-only host after the explicit opt-in", () => {
       expect(
         AutoImportRuleMatcher.ruleMatchesHost(

package/Tests/Utils/NetworkDiscovery/DiscoveredDeviceBuilder.test.ts

@@ -203,8 +203,10 @@ describe("buildNetworkDeviceFromDiscoveredHost - vendor template auto-apply flag
   });
 
   /*
-   * A ping-only host is never SNMP-polled, so no poll can ever fingerprint
-   * its vendor — the flag would be a dead toggle that reads as a promise.
+   * A ping-only host imports with no credentials, so no poll fingerprints
+   * its vendor until an operator adds some — the flag would be a dead toggle
+   * that reads as a promise. The device is still the scan's probe's to ping;
+   * what it lacks is the SNMP data the template auto-apply keys off.
    */
   it("stays off on a ping-only host even when requested", () => {
     const device: NetworkDevice = buildNetworkDeviceFromDiscoveredHost({
@@ -227,7 +229,7 @@ describe("buildNetworkDeviceFromDiscoveredHost - SNMP host", () => {
     // The address is both the hostname and the registered-host dedup key.
     expect(device.hostname).toBe("10.0.0.5");
     expect(device.description).toBe("Cisco IOS Software, C2960X");
-    expect(device.monitoringMethod).toBe(NetworkDeviceMonitoringMethod.Snmp);
+    expect(device.monitoringMethod).toBe(NetworkDeviceMonitoringMethod.Probe);
   });
 
   /*
@@ -411,19 +413,25 @@ describe("buildNetworkDeviceFromDiscoveredHost - a scan with several SNMP config
 
 describe("buildNetworkDeviceFromDiscoveredHost - ping-only host", () => {
   /*
-   * A ping-only host becomes a monitor-backed device: recorded so it can
-   * belong to a site and appear on the topology map, with binding a monitor
-   * to it a separate deliberate step. Credentials it never answered to must
-   * not ride along.
+   * A ping-only host becomes a Probe device the scan's probe pings: it has
+   * a status from its first poll, belongs to a site, appears on the topology
+   * map, and gets walked the day an operator adds credentials. Credentials
+   * it never answered to must not ride along.
+   *
+   * (It used to become a monitor-backed device with no probe and polling
+   * off, and sat on "Pending" until a Ping monitor was hand-bound — issue
+   * #3447. The three assertions that changed here are the ones that end
+   * that: Probe, the scan's probe, polling on.)
    */
-  it("builds a monitor-backed device with polling off and no credentials", () => {
+  it("builds a Probe device on the scan's probe with polling on and no credentials", () => {
     const device: NetworkDevice = build({
       host: snmpHost({ snmpReachable: false, sysName: undefined }),
     });
 
-    expect(device.monitoringMethod).toBe(NetworkDeviceMonitoringMethod.Monitor);
-    expect(device.isPollingEnabled).toBe(false);
-    expect(device.probeId).toBeUndefined();
+    expect(device.monitoringMethod).toBe(NetworkDeviceMonitoringMethod.Probe);
+    expect(device.isPollingEnabled).toBe(true);
+    expect(device.probeId).toBeInstanceOf(ObjectID);
+    expect(device.probeId?.toString()).toBe(PROBE_ID.toString());
     expect(device.snmpVersion).toBeUndefined();
     expect(device.snmpCommunityString).toBeUndefined();
     expect(device.snmpPort).toBeUndefined();
@@ -443,7 +451,7 @@ describe("buildNetworkDeviceFromDiscoveredHost - ping-only host", () => {
    * the same probe-written jsonb row, and nothing in the database enforces
    * that a ping-only row leaves the first one unset — an older result, a
    * partially-rewritten row, or a probe bug is enough. The builder must decide
-   * on the monitoring method and return BEFORE it ever looks a config up, so
+   * that the host is ping-only and return BEFORE it ever looks a config up, so
    * that a stray id can never conjure credentials onto a device that answered
    * nothing but a ping.
    */
@@ -456,14 +464,84 @@ describe("buildNetworkDeviceFromDiscoveredHost - ping-only host", () => {
       scan: multiConfigScanSource(),
     });
 
-    expect(device.monitoringMethod).toBe(NetworkDeviceMonitoringMethod.Monitor);
-    expect(device.isPollingEnabled).toBe(false);
-    expect(device.probeId).toBeUndefined();
+    expect(device.monitoringMethod).toBe(NetworkDeviceMonitoringMethod.Probe);
+    expect(device.isPollingEnabled).toBe(true);
+    expect(device.probeId?.toString()).toBe(PROBE_ID.toString());
     expect(device.snmpVersion).toBeUndefined();
     expect(device.snmpCommunityString).toBeUndefined();
     expect(device.snmpPort).toBeUndefined();
     expectNoV3Credentials(device);
   });
+
+  /*
+   * The OID template an auto-import rule links is SNMP data the host did not
+   * supply; attaching it would promise a collection that cannot start until
+   * credentials exist. Kept off, like the vendor-template flag above.
+   */
+  it("does not attach the rule's OID template to a ping-only host", () => {
+    const device: NetworkDevice = buildNetworkDeviceFromDiscoveredHost({
+      projectId: PROJECT_ID,
+      host: snmpHost({ snmpReachable: false }),
+      scan: fullScanSource(),
+      oidTemplateId: new ObjectID("44444444-4444-4444-8444-444444444444"),
+    });
+
+    expect(device.oidTemplateId).toBeUndefined();
+  });
+
+  /*
+   * A scan with no probe at all — an API-written row, or a scan whose probe
+   * was deleted between the sweep and the import. The device is still a
+   * Probe device with polling on; it simply has no probe to be claimed by
+   * until one is assigned, which the Settings form requires. Nothing here
+   * may throw or silently fall back to Monitor.
+   */
+  it("still builds a Probe device with polling on when the scan names no probe", () => {
+    const device: NetworkDevice = build({
+      host: snmpHost({ snmpReachable: false }),
+      scan: { ...fullScanSource(), probeId: undefined },
+    });
+
+    expect(device.monitoringMethod).toBe(NetworkDeviceMonitoringMethod.Probe);
+    expect(device.isPollingEnabled).toBe(true);
+    expect(device.probeId).toBeUndefined();
+  });
+});
+
+describe("buildNetworkDeviceFromDiscoveredHost - both kinds of host share the recipe", () => {
+  /*
+   * The point of ping-first polling from the import side: the ONLY thing
+   * that differs between an SNMP host and a ping-only one is the credentials.
+   * Method, probe and polling are identical, so an edit that reintroduced a
+   * "ping-only hosts are different" branch on any of the three fails here.
+   */
+  it("differ only in the credentials they carry", () => {
+    const snmpDevice: NetworkDevice = build({
+      host: snmpHost({ snmpReachable: true }),
+    });
+    const pingOnlyDevice: NetworkDevice = build({
+      host: snmpHost({ snmpReachable: false }),
+    });
+
+    expect(pingOnlyDevice.monitoringMethod).toBe(snmpDevice.monitoringMethod);
+    expect(pingOnlyDevice.isPollingEnabled).toBe(snmpDevice.isPollingEnabled);
+    expect(pingOnlyDevice.probeId?.toString()).toBe(
+      snmpDevice.probeId?.toString(),
+    );
+
+    // Anti-vacuity: the SNMP device really does carry what the other lacks.
+    expect(snmpDevice.snmpCommunityString).toBe("public");
+    expect(pingOnlyDevice.snmpCommunityString).toBeUndefined();
+  });
+
+  it("writes polling on explicitly rather than leaving it to the column", () => {
+    for (const snmpReachable of [true, false, undefined]) {
+      expect(
+        build({ host: snmpHost({ snmpReachable: snmpReachable }) })
+          .isPollingEnabled,
+      ).toBe(true);
+    }
+  });
 });
 
 describe("buildDeviceName", () => {
@@ -848,10 +926,10 @@ describe("the reverse-DNS name (issue #3529)", () => {
       expect(device.name).toBe("core-gw.corp.example.com");
     });
 
-    test("a ping-only host still imports as a monitor-backed device", () => {
+    test("a ping-only host still imports as a credential-less Probe device", () => {
       /*
        * Naming must not change WHAT a host imports as. A PTR record says
-       * nothing about whether the device can be SNMP-polled.
+       * nothing about whether the device answered SNMP.
        */
       const device: NetworkDevice = buildNetworkDeviceFromDiscoveredHost({
         projectId: PROJECT_ID,
@@ -864,10 +942,9 @@ describe("the reverse-DNS name (issue #3529)", () => {
       });
 
       expect(device.name).toBe("cam-lobby.corp.example.com");
-      expect(device.monitoringMethod).toBe(
-        NetworkDeviceMonitoringMethod.Monitor,
-      );
-      expect(device.isPollingEnabled).toBe(false);
+      expect(device.monitoringMethod).toBe(NetworkDeviceMonitoringMethod.Probe);
+      expect(device.isPollingEnabled).toBe(true);
+      expect(device.probeId?.toString()).toBe(PROBE_ID.toString());
       expect(device.snmpCommunityString).toBeUndefined();
     });
 

package/Tests/Utils/NetworkDiscovery/DiscoveryImportEligibility.test.ts

@@ -1,5 +1,6 @@
 import {
   isImportableDiscoveredHost,
+  isPingOnlyDiscoveredHost,
   monitoringMethodForDiscoveredHost,
 } from "../../../Utils/NetworkDiscovery/DiscoveryImportEligibility";
 import NetworkDeviceMonitoringMethod from "../../../Types/NetworkDevice/NetworkDeviceMonitoringMethod";
@@ -7,16 +8,23 @@ import type { DiscoveredNetworkDevice } from "../../../Models/DatabaseModels/Net
 import { describe, expect, test } from "@jest/globals";
 
 /*
- * monitoringMethodForDiscoveredHost is the single decision, shared by the
- * dashboard's Review dialog and the server-side auto-import rule engine, for
- * HOW a discovered host imports. The two must never disagree: the group a
- * host is shown under and the method a rule imports it with are the same call.
+ * The two decisions, shared by the dashboard's Review dialog and the
+ * server-side auto-import rule engine, for HOW a discovered host imports.
+ * The two must never disagree: the group a host is shown under and the
+ * device a rule imports it as are the same call.
  *
- * The one subtlety it guards (issue #3023 / legacy scans): only an EXPLICIT
- * snmpReachable === false is ping-only. undefined means a legacy scan row from
- * before the field existed, where every host answered SNMP, so it must read as
- * SNMP — not Monitor. And a nullish host must not throw, because a single junk
- * element in the jsonb array used to take the whole page down from a table cell.
+ * Under ping-first polling every host imports as a Probe device — the scan's
+ * probe pings it, and walks it over SNMP when it has credentials — so
+ * `monitoringMethodForDiscoveredHost` has one answer for every input, and the
+ * host-level question that still matters is `isPingOnlyDiscoveredHost`:
+ * whether the host carries the scan's credentials or none.
+ *
+ * The one subtlety that predicate guards (issue #3023 / legacy scans): only an
+ * EXPLICIT snmpReachable === false is ping-only. undefined means a legacy scan
+ * row from before the field existed, where every host answered SNMP, so it
+ * must read as an SNMP host. And a nullish host must not throw, because a
+ * single junk element in the jsonb array used to take the whole page down from
+ * a table cell.
  */
 
 function host(
@@ -26,38 +34,108 @@ function host(
 }
 
 describe("monitoringMethodForDiscoveredHost", () => {
-  test("an explicit snmpReachable === false is a monitor-backed device", () => {
+  /*
+   * Ping-only hosts used to import as monitor-backed devices with no probe
+   * and polling off, and sat on "Pending" until an operator hand-bound a
+   * Ping monitor (issue #3447). Reachability is a built-in capability of
+   * every probe-polled device now, so the host the probe just pinged is a
+   * Probe device like any other.
+   */
+  test("an explicit snmpReachable === false is a Probe device, not a monitor-backed one", () => {
     expect(
       monitoringMethodForDiscoveredHost(host({ snmpReachable: false })),
-    ).toBe(NetworkDeviceMonitoringMethod.Monitor);
+    ).toBe(NetworkDeviceMonitoringMethod.Probe);
   });
 
-  test("snmpReachable === true is an SNMP device", () => {
+  test("snmpReachable === true is a Probe device", () => {
     expect(
       monitoringMethodForDiscoveredHost(host({ snmpReachable: true })),
-    ).toBe(NetworkDeviceMonitoringMethod.Snmp);
+    ).toBe(NetworkDeviceMonitoringMethod.Probe);
   });
 
-  test("undefined snmpReachable (legacy scan) reads as SNMP, not Monitor", () => {
+  test("undefined snmpReachable (legacy scan) is a Probe device", () => {
     expect(monitoringMethodForDiscoveredHost(host({}))).toBe(
-      NetworkDeviceMonitoringMethod.Snmp,
+      NetworkDeviceMonitoringMethod.Probe,
     );
     expect(
       monitoringMethodForDiscoveredHost(host({ snmpReachable: undefined })),
-    ).toBe(NetworkDeviceMonitoringMethod.Snmp);
+    ).toBe(NetworkDeviceMonitoringMethod.Probe);
   });
 
-  test("a null host reads as SNMP rather than throwing", () => {
+  test("a null host reads as Probe rather than throwing", () => {
     expect(monitoringMethodForDiscoveredHost(null)).toBe(
-      NetworkDeviceMonitoringMethod.Snmp,
+      NetworkDeviceMonitoringMethod.Probe,
     );
   });
 
-  test("an undefined host reads as SNMP rather than throwing", () => {
+  test("an undefined host reads as Probe rather than throwing", () => {
     expect(monitoringMethodForDiscoveredHost(undefined)).toBe(
-      NetworkDeviceMonitoringMethod.Snmp,
+      NetworkDeviceMonitoringMethod.Probe,
     );
   });
+
+  /*
+   * Discovery never has grounds to choose the Monitor override: every host it
+   * offers was reached by the probe that found it. Stated as a sweep over
+   * every shape the field can take, so a future "return Monitor when X"
+   * cannot creep back in on one branch.
+   */
+  test("never answers Monitor, whatever the host looks like", () => {
+    const hosts: Array<DiscoveredNetworkDevice | null | undefined> = [
+      host({ snmpReachable: false }),
+      host({ snmpReachable: true }),
+      host({}),
+      host({ snmpReachable: false, isAlreadyRegistered: true }),
+      null,
+      undefined,
+    ];
+
+    for (const candidate of hosts) {
+      expect(monitoringMethodForDiscoveredHost(candidate)).not.toBe(
+        NetworkDeviceMonitoringMethod.Monitor,
+      );
+    }
+  });
+});
+
+describe("isPingOnlyDiscoveredHost", () => {
+  test("an explicit snmpReachable === false is ping-only", () => {
+    expect(isPingOnlyDiscoveredHost(host({ snmpReachable: false }))).toBe(true);
+  });
+
+  test("snmpReachable === true is an SNMP host", () => {
+    expect(isPingOnlyDiscoveredHost(host({ snmpReachable: true }))).toBe(false);
+  });
+
+  test("undefined snmpReachable (legacy scan) reads as an SNMP host, not ping-only", () => {
+    /*
+     * Every host on a scan stored before the field existed answered SNMP —
+     * ping-only sweeps did not exist yet. Reading undefined as ping-only
+     * would strip those devices of the scan's credentials on import.
+     */
+    expect(isPingOnlyDiscoveredHost(host({}))).toBe(false);
+    expect(isPingOnlyDiscoveredHost(host({ snmpReachable: undefined }))).toBe(
+      false,
+    );
+  });
+
+  test("a nullish host reads as an SNMP host rather than throwing", () => {
+    expect(isPingOnlyDiscoveredHost(null)).toBe(false);
+    expect(isPingOnlyDiscoveredHost(undefined)).toBe(false);
+  });
+
+  test("only snmpReachable decides — every other field is ignored", () => {
+    expect(
+      isPingOnlyDiscoveredHost(
+        host({
+          isAlreadyRegistered: true,
+          sysDescr: "Some host",
+          sysName: "named-anyway",
+          snmpReachable: false,
+        }),
+      ),
+    ).toBe(true);
+  });
 });
 
 describe("isImportableDiscoveredHost", () => {