cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
jmcg
Reliable Contributor
Reliable Contributor
Report Inappropriate Content
Message 1 of 5

Rogue system sensor scan multiple subnet

Hello,

I would like to make my sensor scan multiple subnet (like on DHCP server)

How can I achieve this ? I thought it was auto.

We have over 1500 subnets, I don't want to install a RSD Sensor on each.

4 Replies
YashT
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 2 of 5

Re: Rogue system sensor scan multiple subnet

Hello @jmcg ,

You can install Rogue System Detection sensors on these types of systems:

  • DNS or any system that is always connected to the subnet and monitoring traffic — These systems are the best place to install Rogue System Detection sensors because they are not often turned on or off and are seldom disconnected from the network.
  • DHCP servers on multicast subnets — DHCP servers constantly monitor multicast traffic and instantly detect when a new system connects to the subnet.
  • All systems on a multicast subnet — This allows you to configure Active sensor election in the Rogue System Detection server settings. Once configured, all systems on a multicast subnet run an election algorithm to set some system sensors as active and the remainder as passive. The configuration settings control how often the software runs the algorithm.
Was my reply helpful?
If you find this post useful, Please give it a Kudos! l Also, Please don't forget to select "Accept as a solution" if this reply resolves your query!

Thanks and regards,
Yash T
jmcg
Reliable Contributor
Reliable Contributor
Report Inappropriate Content
Message 3 of 5

Re: Rogue system sensor scan multiple subnet

We wanted to install on DNS and DHCP servers but HQ wanted a dedicated server to scan subnet.

So sensors are installed on dedicated servers.
There is no way I can tell Sensors to try to scan all subnets discovered by ePO ?
YashT
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 4 of 5

Re: Rogue system sensor scan multiple subnet

Hello @jmcg ,

If the sensor is installed on DHCP then any system connecting to DHCP from any subnet will be captured by sensor and information will be sent to epo, but if you are installing in one dedicated server on particular subnet it will only cover the subnet on which it is installed.

How RSD detection works: To detect systems on the network, the sensor uses WinPCap, a packet capture library.

It captures layer-2 broadcast packets sent by systems that are connected to the same network broadcast segment. It also listens passively to all layer-2 traffic for other network protocols, such as ARP and DHCP.

NOTE: The sensor doesn't determine whether the system is a rogue system. It detects systems connected to the network and reports these detection's back to the McAfee ePO server, which determines whether the system is rogue based on user-configured settings.

 

Was my reply helpful?
If you find this post useful, Please give it a Kudos! l Also, Please don't forget to select "Accept as a solution" if this reply resolves your query!

Thanks and regards,
Yash T
jmcg
Reliable Contributor
Reliable Contributor
Report Inappropriate Content
Message 5 of 5

Re: Rogue system sensor scan multiple subnet

I understand, but our DHCP and DNS servers are in Linux OS. Since you don't have support for Linux, we had no choice to build our dedicated servers.

Now I just need a solution, number are just number, If I can tell the RSD Sensor to scan others subnet this could be great.

I would like to know if I edit the sensor.db and add subnet is the subnet table and source has networkAdapter, will RSD Sensor will scan it ?
You Deserve an Award
Don't forget, when your helpful posts earn a kudos or get accepted as a solution you can unlock perks and badges. Those aren't the only badges, either. How many can you collect? Click here to learn more.

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community