Network Sonar Wizard discovery settings

Hi. I'm testing a network discovery, but some options are not clear enough for me.

1. If I want to discover only ICMP nodes (not SNMP/WMI) these settings above are suitable - is it true?

2. If I set "SNMP retries" and "WMI retries" to "0", no SNMP/WMI-queries will be send at all? (In this case only ICMP-query will be sent?)

3. If I set "SNMP retries" and "WMI retries" to "0", "SNMP Timeout"/"WMI Retries" options will be ignored? It's logical, but just in case.

4. What does "Hop Count" stand for? I guess, this option is relevant with enabled SNMP-discovery only?

Find more posts tagged with

SNMP

icmp

discovery

WMI

sonar

Accepted answers

All comments

tony.johnson

1. Do you want to (a) Add all discovered nodes as ICMP Only or (b) Discover nodes which do not respond to the SNMP or WMI credentials provided in discovery profile?

2/3. If set to 0, discovery will attempt a single interrogation of the node for SNMP/WMI. SNMP/WMI Timeouts are always used if those credentials types have been provided in discovery.

4. https://thwack.solarwinds.com/product-forums/network-performance-monitor-npm/f/forum/64666/what-exactly-does-the-hop-count-in-network-sonar-discovery/30885#30885

"If Hop Count is set to any number greater than zero, Orion Discovery searches for additional devices connected to any discovered device. Each such connection counts as a hop.

For example, consider a network discovery configured to search within the IP address range starting at x.y.z.0 and ending at x.y.z.50. The discovery finds a device at x.y.z.20 that is also connected to a device at a.b.c.45. If the Hop Count for this discovery is 1 or greater, the device at a.b.c.45 is included in the discovery results, even though a.b.c.45 is not within the IP address range initially specified for the discovery.

Solarwinds recommends that you do not set the hop count more than 2-3, as it may start to discover a lot more of your network than you originally specified, and it can cause the discovery to timeout if you have it set to less than 60 minutes."

omavel

[quote userid="57716" url="~/product-forums/network-performance-monitor-npm/f/forum/89667/network-sonar-wizard-discovery-settings/286002#286002"]1. Do you want to (a) Add all discovered nodes as ICMP Only or (b) Discover nodes which do not respond to the SNMP or WMI credentials provided in discovery profile?[/quote]

(a)

[quote userid="57716" url="~/product-forums/network-performance-monitor-npm/f/forum/89667/network-sonar-wizard-discovery-settings/286002#286002"]2/3. If set to 0, discovery will attempt a single interrogation of the node for SNMP/WMI. SNMP/WMI Timeouts are always used if those credentials types have been provided in discovery.[/quote]

Hm... Any way to use only ICMP during discovery?

Failed SNMP/WMI attempts will arouse curiosity among secops guys.

Thanks!

jm_sysadmin

Just don't include any SNMP or WMI credentials in the discovery profile for the ICMP sweep. Then it shouldn't try any.

Also, your SecOps guys should know about this exists, even if preventing failed authorization attempts is admiral in its own right. Orion will be noticed eventually, even if well configured. Monitoring makes lots of packets, and I am always on the top talkers on my network.

But I have tips to make this less painful.

Set up multiple smaller jobs (how many and how targeted depend on your access levels for the accounts.

If you are trying to hit Windows servers, do them first, the AD discovery will let you target many and get them out of the way. Then you don't need that account to be tried anywhere else. You likely know where the majority of the networking gear is placed on your network. Target the IPs or parts of ranges where the Gear that you have SNMP access is set up. Get the known stuff with known access done first, in however many discoveries make sense to you whether that is linux servers, firewalls, storage, etc. Then do the big ICMP sweep of the range with no credentials to find 'stuff' you haven't gotten explicit rights to. Work that shorter list, and life will be better.

omavel

[quote userid="242049" url="~/product-forums/network-performance-monitor-npm/f/forum/89667/network-sonar-wizard-discovery-settings/286013#286013"]Just don't include any SNMP or WMI credentials in the discovery profile for the ICMP sweep. Then it shouldn't try any.[/quote]

Okay, will try, could be a solution

[quote userid="242049" url="~/product-forums/network-performance-monitor-npm/f/forum/89667/network-sonar-wizard-discovery-settings/286013#286013"]Monitoring makes lots of packets, and I am always on the top talkers on my network. [/quote]

OFC, but ICMP-traffic seems more legit than SNMP/WMI failed login attempts.

Thank you