Under Devices on the Metrics tab you will see a list of all the devices that ExtraHop has auto-discovered and created a device object for in the datastore. Many people wonder why there are L2 and L3 devices. This is an artifact of how ExtraHop does default device discovery. A typical path through device discovery and metric recording would have these stages:
ExtraHop first learns of a device via its MAC; it creates (discovers) an L2 device and associates the flows (and L7 metrics) with that L2 device.
Once it sees an ARP involving that MAC, it creates (discovers) the L3 version of the device and begins associating future flows (and L7 metrics) with the L3 device; the L2 device stops getting any metrics of consequence. This L2 device then is associated with the L3 device as a “parent” and does not count towards the device count limit.
Router devices are handled in a slightly different way, and there are also multiple additional ways to enable device discovery, but this post just aims to cover the most common approach.