For a device in question with no ports open, then it's snmp is not accessable.
But, for example, could the ARP table of specific remote smart devices like switches be indexed and then checked against when deciding if the device should be intered in the database.
ie, if device is pingable and if I can find a mac address in a table of a remote switch... add it under some unknown catagory?
Similarly as to how lan mapping software works these days.
Ofcourse this could cause lots of junk entered depending.
I'd like to be able to add manually a device using it's mac address , IE ip phone 🙂
Specifically NEC seems to not be scannable.