Pages: [1]   Go Down
Author Topic: Recon server using NMAP  (Read 1540 times)
0 Members and 1 Guest are viewing this topic.
pablort
Newbie
*

Karma: 0
Offline Offline

Posts: 1


View Profile
« on: December 07, 2009, 11:35:53 PM »

Hello there,

I'd very much like to have the recon server using NMAP to both learn about new hosts and it's services as well as to keep an eye on services that shouldn't be running on hosts. The mapping between a network range and a network template just doesn't feel right.

The idea is to work the adding/removing of services automatically through discovery instead of manually adding all services to hosts on the pandora_console.

Are there any works in that direction ?
Logged

Sancho Lerena
Administrator
Expert member
*****

Karma: 24
Offline Offline

Posts: 1141


I can see everything... with my glasses :-)


View Profile WWW
« Reply #1 on: December 09, 2009, 12:07:41 PM »

Mmm, I understand you want to add automatically services (Tcp ports) that are listening in target machines, right ?, even if this host is already monitored.

But what happen with non-responsible ports ?, we should "delete" it from the current monitorization?.

By the way, Pandora FMS 3.0 is using NMAP and Xprobe2 to detect new host and fingerprinting them, the old way to tcp scan hosts was used only in 1.x and 2.x, nmap is much much better :-)

Hello there,

I'd very much like to have the recon server using NMAP to both learn about new hosts and it's services as well as to keep an eye on services that shouldn't be running on hosts. The mapping between a network range and a network template just doesn't feel right.

The idea is to work the adding/removing of services automatically through discovery instead of manually adding all services to hosts on the pandora_console.

Are there any works in that direction ?
Logged

-- See you in the other screen.

randy_srs
Full Member
***

Karma: 0
Offline Offline

Posts: 39


View Profile
« Reply #2 on: February 11, 2010, 11:19:45 PM »

my problem is Recon seems to add host multiple times

ie:

192.168.4.11 is the same as srs-rdp-srv which has a client running

is there a way to get recon to ignore or bypass units that have agents running
Logged

Sancho Lerena
Administrator
Expert member
*****

Karma: 24
Offline Offline

Posts: 1141


I can see everything... with my glasses :-)


View Profile WWW
« Reply #3 on: February 17, 2010, 03:26:36 AM »

Recon try to match by current IP addresses, so if an agent who actually exists HAS an IP in the range being scanned by recon, it should not get added again, just be sure it has a correct IP address assigned.

This was a bug in 2.1 (to have duped agents detected) but 3.0 fix this problem.

my problem is Recon seems to add host multiple times

ie:

192.168.4.11 is the same as srs-rdp-srv which has a client running

is there a way to get recon to ignore or bypass units that have agents running
Logged

-- See you in the other screen.

Pages: [1]   Go Up
Print
 
Jump to:  


SourceForge.net Logo  This site is monitored by Pandora FMS   ArticaST