Addmi 12-basic scan
- 1. Scanning Basics Telling Atrium Discovery What and When
- 2. The Basics of Scanning Outline Basic Discovery Essentials: What to scan IP ranges Credentials Exclude ranges When to scan Setting up discovery runs View Results Discovery Run details Node details Provenance details
- 3. The Basics of Scanning Scanning is a process of probing your network to see what information can be gathered about the endpoints found You need to tell Atrium Discovery What to scan (and perhaps what not to scan) IP ranges (one, or a range, or a list) How to access a host (end-point) Credentials available (for logging in) Where the Windows Slave is installed This is covered is depth later in the course
- 4. The Discovery Process Scan of an IP range via the discovery run: The discovery engine tries each IP address in the range looking for endpoints Checks for matches in the exclusion list. Determines the host and OS type (platform) If the host has had a previous successful login, the same credentials will be attempted first If not, login credentials will be attempted in the UI display order, UNIX first then Windows and finally SNMP Run a platform-specific script, and potentially other commands, to learn about the device Writes this information into the datastore
- 5. Choosing IP Ranges Accessed Via “Add new run” List individual machines to scan e.g. 231.234.11.32 Choose subranges e.g. 10.1.1.1-56 Choose subnet Mask e.g. 192.168.1/24
- 6. Scheduling Runs Can add an ad-hoc (snapshot) or scheduled discovery runs
- 7. Choose the Scanning Level Sweep scan Is there anybody there? Note: Host nodes will NOT be created at this level Host Identification - basic host information Host Information - run discovery commands but not patterns Full discovery - the works
- 8. What Scanning Level to Use For general use: Full Discovery to ensure the most amount of information is recovered During initial deployment: Sweep Scans to get a rough understanding of the environment before configuring credentials
- 9. Discovery Protocols Without logging in Telnet banner scraping Port scanning HTTP HEAD Logging in SSH, rlogin, telnet WMI, remcom, rcmd SNMP Port scanning, telnet banner, HTTP HEAD ssh, telnet, rlogin, SNMP, rcmd
- 10. Scanning Credentials You can add credentials for single devices and ranges Can use regex wildcards Will be tried in display order Login credentials SNMP credentials Database credentials
- 11. Login Credentials Can create credentials for a singe device ip or range Can use regex (.* or 10.10.10.(23|25)) or a range specification ( 10.10.10.* or 10.10.1-5.* or 10.10.10.0/24) Will try each credentials in the order displayed By default, will store the last successful credentials for each host to use in future runs
- 12. Setting SNMP Credentials SNMP credentials are called community strings Use or request a readonly (RO) string for tideway discovery
- 13. Add Exclude Ranges Add IP ranges of hosts that should NOT be included in discovery Useful for excluding sensitive or fragile hosts
- 15. View Discovery Results Can look at the types of data recovered DDD (Directly Discovered Data) View discovery access reports Reporting on discovery as a whole
- 16. View Discovery Runs View statistics of an individual discovery run Can drill down to view the host details page or details from DiscoveryAccess Skipped or error results Some no access details No Response (dark space) Errors
- 17. Further Information Online Documentation: http://www.tideway.com/confluence/display/81/Using+BMC+Atrium+Discovery Tideway Foundation Version 7.2 Documentation Title
Editor's Notes
- #5: Additional notes for questions: UNIX is tried first as it fails faster than Windows. This is not configurable. SNMP is tried third, but as SNMP discovery is not configurable and recovers a reduced fixed set of infrastructure information it is left off this slide.
- #6: Need to list by IP, cannot list by name.
- #12: Covered in more details in Discovery Credentials module
- #13: Covered in more details in Discovery Credentials module
- #14: Networking equipment, Fragile hosts, storage equipment, DNS round robin IP’s, global traffic mngr are a few examples of devices or end points that customers have wanted to exclude
- #19: Optionally you may wish to complete the labs that have been prepared to accompany this module. Please download the lab zip file that should be available where you accessed this module. Make sure you have access to a running appliance before attempting the labs. It is best to use the training demo VA provided as it is set up to work with the labs. You may need to review tutorial material in order to work out the solutions.