Presence: office and remote
How VerOps classifies devices as office, remote or unknown against trusted office networks (SSID/BSSID, CIDR, gateway MAC) — and why presence is network-inferred and never a guarantee of physical presence.
What presence is — and what it is not
Presence classifies each device as Office (with a location), Remote, or Unknown, by comparing the network facts the agent already reports against the trusted office networks your organization defines. It answers a practical operational question: is this machine on one of our networks, and which one?
Presence is network-inferred. It is never a guarantee of physical presence. VerOps observes which network a device is attached to — nothing more. A laptop left plugged in at a desk reads Office with nobody near it. Someone working on site over a guest network or a VPN reads Remote. A device that has simply not reported recently reads Unknown. Treat presence as an operational signal, never as an attendance, timekeeping or productivity record.
How a device is classified
Presence requires the network collection module to be on. With it enabled, the agent reports interfaces, MAC addresses, IP addresses, the default gateway, DNS servers, Wi-Fi SSID/BSSID and VPN state. VerOps matches those facts against your office-network definitions:
| Office network definition | Matches when the device reports | Good for |
|---|---|---|
| Wi-Fi SSID / BSSID | A connected SSID, or a specific access-point BSSID, on your list | Laptops on corporate Wi-Fi. BSSIDs can distinguish floors or buildings sharing one SSID. |
| CIDR range | Any interface IP inside a listed range | Wired desks, VLANs, site-specific subnets. |
| Gateway MAC | The default gateway's MAC address on your list | Sites whose addressing overlaps (several offices all using 192.168.1.0/24). |
Each definition carries a location name, which is what the Office pill displays. A device matching none of the trusted networks — including one reaching you only through a VPN — classifies as Remote. A device that has reported no usable network facts classifies as Unknown.
Configuring trusted office networks
Define them under Inventory → Policy. A few practices make the results far more reliable:
- Prefer gateway MACs and BSSIDs to CIDRs where sites reuse private ranges. RFC-1918 overlap between offices is the single most common cause of a device appearing at the wrong location.
- Name locations the way your facilities team does — the location string is what appears on pills, in dashboards and in reports.
- Add the guest network too, or deliberately leave it out. Either is defensible; be explicit about which you chose, because it changes what Office means in your data.
- Expect VPN users to read Remote. That is correct behaviour: they are not on the office network, they are tunnelling into it.
Changes take effect as devices report; no reinstall or agent change is involved.
Where presence surfaces
- A presence pill on each row of the Hosts table, and a filter chip to narrow to Office, Remote or Unknown.
- The Network & presence tab of the asset detail page, showing the raw network facts the classification was made from — so you can always see why a device was classified as it was.
- A presence changed event on the asset timeline whenever the classification flips.
- The fleet split (office / remote / unknown, by location) is chartable on dashboards alongside your own metrics.
Reasonable uses
Presence exists to answer estate questions, and it is genuinely good at them:
- Finding hardware. "Which site is asset
A-1042actually at?" — combined with the asset's location label, this is how lost kit gets found. - Capacity and refresh planning. How much of the fleet is regularly on site, and at which locations.
- Rollout targeting. Scheduling a disruptive update for machines that are on the office network rather than on a hotel connection.
- Patch context. A machine that is critically behind on updates and permanently remote is a different problem from one that is behind and sitting on your LAN.
Note: Because presence describes devices rather than people, do not build attendance, hybrid-working compliance or performance processes on it. The classification is inferred from network attachment and will be wrong for any individual on any given day — a fact that matters far less for capacity planning than it does for anything involving a person's record.
The collection side of presence — which module produces these facts, and how to switch it — is documented in Collection policy and presence.