Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials
Store

Detecting Node Status

Is there any other way to detect node status besides using ICMP?

We do not allow ICMP on our networks do to all the exploits that can utilize it. So as a result all my devices are showing in a down status, but I am still collecting all networking and port stats on it. I am not able to collect CPU or Memory stats.

Any help would be appreciated.

Find more posts tagged with

Accepted answers

All comments

iunderwo

ICMP really shouldn't be blocked in its entirety...this totally breaks things like MTU discovery, which can cause lots of stuff not to work if fragmentation is needed anywhere along a network path. Another consequence of disabling ICMP is that it becomes very difficult to assess the health of the network from any point in the network.

Assuming you're running a private network, the incidence of ICMP exploitation is really very low. In fact, most DoS attacks nowadays seem to either be port-specific, or just a random sampling of garbage. Most routers can also ignore directed broadcast packets. However, if all your devices are on public address space, careful filtering and access controls should be applied.

The best practice in a maximum security case is to allow ICMP echo from / reply to your polling machine only and lock everyone else out. No other protocols are designed with a fast enough turnaround time to allow an accurate measure of raw response...which ICMP echo is designed for.

// Ian Underwood - Service Management
// Level 3 Communications

Network_Guru

quote:Originally posted by Malvado

We do not allow ICMP on our networks

This is kind of ambiguous statement. Whatever you are using to "not allow" ICMP on your network will have to have an exception created to allow ICMP to & from your Orion Server
& all polled devices. This should not compromise your security policy too much.

To my knowledge, there is really no other way to monitor the status of devices using Orion.

-=Cheers=-
NG

Malvado

All of our user segments are remote and are behind routers / firewalls, as a result none of the firewalls allow icmp, The SNMP gets that we do are from a network that is behind a DMZ that is only accessable from certain networks. We do not allow wide spread ICMP accross the country or network. each local subnet has the ability to ICMP, but they are unable to ICMP outside of there local network.

My problem is the DMZ I am in I am not able to ICMP out to any devices I can get all the SNMP traps from the devices. Is there a way I can use SNMP to get the node status of these remote devices?

pancamo

It's a bad idea to not allow ICMP... Our firewall guys tried this and it ended up causing major problems when retransmissions occur...

..this totally breaks things like MTU discovery...

quote:Originally posted by Malvado

All of our user segments are remote and are behind routers / firewalls, as a result none of the firewalls allow icmp, The SNMP gets that we do are from a network that is behind a DMZ that is only accessable from certain networks. We do not allow wide spread ICMP accross the country or network. each local subnet has the ability to ICMP, but they are unable to ICMP outside of there local network.

My problem is the DMZ I am in I am not able to ICMP out to any devices I can get all the SNMP traps from the devices. Is there a way I can use SNMP to get the node status of these remote devices?

iunderwo

quote:Originally posted by Malvado

All of our user segments are remote and are behind routers / firewalls, as a result none of the firewalls allow icmp, The SNMP gets that we do are from a network that is behind a DMZ that is only accessable from certain networks. We do not allow wide spread ICMP accross the country or network. each local subnet has the ability to ICMP, but they are unable to ICMP outside of there local network.

You'll need to make a case to the firewall guys to allow your poller's IP address to do its job. There are more clever SNMP exploits than ICMP ones. I'd start with a test-case for a site and build off that as a reason you need ICMP opened to one address. There's really no other way I can think of around it.

// Ian Underwood - Service Management
// Level 3 Communications