2 Replies Latest reply: Nov 21, 2012 10:57 PM by David! RSS

    Rogue Sensor weirdness

    David!

      Hi

       

      A long time ago (in relative terms) I was the sole administrator of our ePO 4.5 installation with McAfee VSE 8.7 / 8.8

       

      Since then it has been upgraded to ePO 4.6, and a lot of things have changed.

      I don't have any change control, documentation or helpdesk tickets covering this.

       

      What i've come back to is a mess, and i've been working my way through it.   One issue that has me stumped is our Rogue Sensors.

      We had 1 per site, equating to one per subnet as each site is using a /24 subnet.

       

      (eg:  rogue sensor for 10.7.6.0/24 and rogue sensor for 10.9.3.0/24 etc)

       

       

      Previously, the Detected Systems tab would have all of these subnets split up logically on the left sidebar.

      I've come back to this:

       

      rogue_sensor_b0rken.jpg

       

       

      Does anyone have any idea how I can start troubleshooting this?

      Any more information I can provide to assist?

       

       

      thanks for your time.

        • 1. Re: Rogue Sensor weirdness
          rackroyd

          You don't mention which ePO patch is installed, but it looks a lot like an issue which is resolved in ePO 4.6 Patch 3.

           

          Per the patch 3 readme:

           

          77.  Issue – Agents occasionally return incorrect ipV6subnet information that suggests all IPs in the network are in the subnet. (Reference: 699813)

          Resolution – Invalid subnet records are removed upon installation of ePolicy Orchestrator 4.6.3. In addition, RSD ignores invalid subnet values from agents.

           

          Rgds,

           

          Rob.

          • 2. Re: Rogue Sensor weirdness
            David!

            Thanks Rob.   Updating from 4.6.0 original release to 4.6.4 now.