We have recently starting to implement RSD and installed in a couple of servers. The sensors are reporting several hundreds rogue systems, but the majority are listed with a DNS name as undefined.hostname.localhost or aXXX-XXX-XXX-XXX.deploy.static.akamaitechnologies.com. The only thing in common is the "Last Detected Organization Name" which is Cisco Systems, Inc.
I understand from a previous post that there may be a DNS related issue somewhere, but the IP addresses they referring to are not assigned to any devices on our network. Is there a way to gather more information about those rogue systems? Also, is it safe to exclude them?
The sensor will see any traffic that is on the nic. You can go to server settings for the RSD settings to limit what is considered rogue for your network. You can edit the detected systems matching section to limit it to your IP ranges or other criteria, including domain names, etc. You also might want to look at which sensor is reporting those. Perhaps that isn't a good choice of server to install a sensor on.
Was my reply helpful? If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?
Many thanks for your reply. I have already added all the networks in the policy under the option "Listen only on interfaces with IP addresses in these networks". I will also look at the sensor that is reporting those entries.
Don't forget, when your helpful posts earn a kudos or get accepted as a solution you can unlock perks and badges. Those aren't the only badges, either. How many can you collect? Click here to learn more.
Community Help Hub
New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.