How Unmanaged Detector works?

I'm aware of the use of the unmanaged detector.

What I'd like to know is "how" it works (logic, data written in the DB and so on).

I mean, I think something like this:

• the machine enabled as unamanged detector collect the MAC addresses in its own subnet and this list is sent to the SEPM;
• SEPM compares this list with the list of MAC address already managed;
• if there are MACs detected but not managed, then these MACs are written in the DB (with probably time of detection).

Something similar?

Thanks!