cancel
Showing results for 
Search instead for 
Did you mean: 
avilt
Level 8
Report Inappropriate Content
Message 1 of 14

Rogue System Sensor Detects as Printer

I have setup RSD on ePO and on clients for each subnet. In my ePO it shows all L3 interfaces from Cisco L3 switch as printers. I expect this to display it as unknow or Cisco device. How can I fine tune this settings and reporting?

13 Replies
Reliable Contributor tao
Reliable Contributor
Report Inappropriate Content
Message 2 of 14

Re: Rogue System Sensor Detects as Printer

Have you updated the Detected System OUIs: The OUI (Organizational Unique Identifier) is used to identify the vendor, manufacturer or other organization of a particular piece of equipment. ePO uses this to identify the vendor of a specific network interface controller (NIC) whether physical or virtual. This information is maintained by the IEEE Registration Authority. (Server Settings / Detected System OUIs)

If this information was helpful or has answered your question, please select Accept as Solution. This will assist other memebers
avilt
Level 8
Report Inappropriate Content
Message 3 of 14

Re: Rogue System Sensor Detects as Printer

Where can I get these OUI for ePO. Also does ePO store MAC address of each managed device?

avilt
Level 8
Report Inappropriate Content
Message 4 of 14

Re: Rogue System Sensor Detects as Printer

Following list is available, which list should I import in ePO?

IEEE MA-L Assignments (.csv)

IEEE MA-M Assignments( .csv)

IEEE MA-S Assignments (.csv)

IEEE IAB Assignments (.csv)

IEEE CID Assignments (.csv)

IEEE Ethertype Assignments (.csv)

IEEE Manufacturer ID Assignments (.csv)

IEEE Operator ID Assignments (.csv

Reliable Contributor tao
Reliable Contributor
Report Inappropriate Content
Message 5 of 14

Re: Rogue System Sensor Detects as Printer

You may consider going to ePO / Configuration Server Settings / Detected System OUIs / Edit / Update

Untitled.png

If this information was helpful or has answered your question, please select Accept as Solution. This will assist other memebers
avilt
Level 8
Report Inappropriate Content
Message 6 of 14

Re: Rogue System Sensor Detects as Printer

Thank you, updated the file

Now under interface it shows it as Cisco but still the OS is listed as Rico Printer.

boschind
Level 10
Report Inappropriate Content
Message 7 of 14

Re: Rogue System Sensor Detects as Printer

it happens in my ePO installation too - ricoh printer reported as Cisco OUI

does exist an alternative addr where to update OUI list ?

http://standards.ieee.org/regauth/oui/oui.txt

update: just found this link Sanitized IEEE OUI Data (oui.txt)

is someone using it ?

Highlighted
boschind
Level 10
Report Inappropriate Content
Message 8 of 14

Re: Rogue System Sensor Detects as Printer

hello avilt

have you configured the OUIs sensors exclusion list ?

this should help to reduce the workload for RSD sensors and ePO server

Re: Rogue System Sensor Detects as Printer

ok, and what is sense downloading oui.txt to my EPO?

McAfee Employee cdinet
McAfee Employee
Report Inappropriate Content
Message 10 of 14

Re: Rogue System Sensor Detects as Printer

The oui.txt updates the vendor list for vendor identification. Adding an exclusion tells the sensor to ignore that vendor. What is the mac address that is being identified as a printer?

Was my reply helpful?
If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?

More McAfee Tools to Help You

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community