...
As we can see there are two parts to IP Discovery.
1: ICMP Discovery:
ScanEngine will PING
...
a given IP address and awaits an respond, if there is an Device capable to respond to PING ScanEngine will mark the IP in question as success and move to the second part of the IP Discovery.
2: TCP Discovery or PORT Scan.
Once we know that there is actual Device using the IP discovered in step 1, ScanEngine will scan Basic/Common PORT's in order to "guess" what type of the Device is it.
The Basic/Common PORT's we will scan by default are: 22,23,80,443,135,139,445,5985,5986,902, but this can be adjusted if needed to include any unusual Port's used in the Estate.
Based on the outcome of the Port scan we will "guess" what type of the Device it is and append an Suspected OS to it, if applicable or, if the certainty is high enough to guess the OS.
NOTE: As mentioned above we really guess the OS and that is due to fact that ScanEngine will NOT ATTEMPT to log in into the found Device.
How to set up an IP Discovery Project.
...
It's highly recommended to use one ScanEngine per 0.5 million IP's or /13 Subnet, per Location. This will speed up the Discovery process.
We recommend to disable Target logging as well, so the ScanEngine performance on Disk IO will be as minimal as possible. There will be nothing to report in the Targets logs anyway and therefore are not required for any troubleshooting purpose.Let's now focus on how to create and set up the Location with all necessary Connections and Product Adapters for IP Discovery only.
Locations:
- Lets add an Subnet we would like to scan, create a Sub-Location (One Location per ScanEngine Adjust the Server Settings accordingly to set appropriated ScanEngine for the Location) Details page can be left as is, Scan Window can be setup if needed. Target sets, click on Create
Choose Target as Device
Type as Subnet
Name is mandatory: We will use IPSubnet24 in this example.
Start IP will be Subnet first IP: 192.168.1.0 NOTE: https://kthx.at/subnetmask/ List of Subnets with all details
Subnet Mask Bits: 24
Click on Save & Close
2. Connections setup.
For IP Discovery we need to disable all Connections and Enable only ICMP Provider and TCP Provider and save the changes.
3. Product Adapters set up.
Once again we disable all adapters and enable only Device Discovery, save changes.
4. Locations are set up now, we wont be adding any Credentials as we don't need these. Now we can set up an Project as usually and start our IP Discovery scan.
Make sure that ALL Product Adapters are disable and only DEVICE DISCOVERY is enabled. Finish the Project setup and now we can run our IP Discovery for 192.168.1.0 /24 Subnet IP space.
Results diagnostics:
- Project Summary page will show how many Targets we setup to scan and how many Devices scan did find.
- Diagnostics page will show more details about each found device as shown bellow
3. Getting the results from the iQSonarSE DB.
To get the list of Found Devices run the SQL query against the iQSonarSE DB. The query will give us list which can be saved as CSV with Headers.
SELECT j.JobID, j.IPAddress, j.StartDate AS [Scan Start],j.EndDate AS [Scan Ends], fd.SuspectedOS FROM jobs.t_job j
join history.t_ArtifactHistory ah ON ah.JobID = j.JobID
join model.t_FoundDevice fd ON fd.FoundDeviceID = ah.ObjectID
WHERE ObjectType = 'FoundDevice'
and DeviceID is null