RSD and reported rogue systems

[Linuxxo]

Hi,

We have recently starting to implement RSD and installed in a couple of servers. The sensors are reporting several hundreds rogue systems, but the majority are listed with a DNS name as undefined.hostname.localhost or aXXX-XXX-XXX-XXX.deploy.static.akamaitechnologies.com. The only thing in common is the "Last Detected Organization Name" which is Cisco Systems, Inc.

I understand from a previous post that there may be a DNS related issue somewhere, but the IP addresses they referring to are not assigned to any devices on our network. Is there a way to gather more information about those rogue systems? Also, is it safe to exclude them?

Many thanks. 

[cdinet]

The sensor will see any traffic that is on the nic.  You can go to server settings for the RSD settings to limit what is considered rogue for your network.  You can edit the detected systems matching section to limit it to your IP ranges or other criteria, including domain names, etc.  You also might want to look at which sensor is reporting those.  Perhaps that isn't a good choice of server to install a sensor on.  

[Linuxxo]

Hi,

Many thanks for your reply. I have already added all the networks in the policy under the option "Listen only on interfaces with IP addresses in these networks". I will also look at the sensor that is reporting those entries.