Drift (baseline vs live)

What it does: captures a baseline of who's on your network (a sweep + the ARP cache, recording each host's IP, DNS name, MAC, and vendor), then on a later "Check drift" compares the live network to that baseline and flags what changed. It's the intended-state-vs-actual-state idea: your saved snapshot is the source of truth, no external database required.

Findings:

• NEW HOST — something is on the network that wasn't in the baseline (a possible rogue). Worth attention.
• MAC CHANGED — same IP, different MAC than before (IP↔MAC drift): a device swap, a DHCP reassignment, or MAC spoofing. Worth attention.
• HOSTNAME / MISSING — a name changed, or a baseline host isn't responding now (moved, off, or firewalled).

Safe to run: yes — it only sweeps and reads the ARP cache (same as Discovery + ARP). It changes nothing on any device. Warn-level findings (NEW HOST, MAC CHANGED) also open an Incident so the investigation is logged.

Reading results: red tags need a look; grey tags are informational. A NEW HOST or MAC CHANGE is the cue to run the rogue-device playbook — identify the vendor, locate the switch port, verify building/closet, then contain ON the switch (SubnetSlinger never shuts a port for you). Re-capture the baseline once you've accounted for the change.