• State Not Answered
  • Locked Locked
  • Replies 1 reply
  • Subscribers 24 subscribers
  • Views 1702 views
  • Users 0 members are here
Options
Related
This discussion has been locked. The information referenced herein may be inaccurate due to age, software updates, or external references.
You can no longer post new replies to this discussion. If you have a similar question you can start a new discussion in this forum.

UDT - Rogue Devices

lufffunk

I have a approved Whitelist using DNS names, which shows to have 200 odd devices in the list.

When I look at the rogue devices, there are >300 listed and on closer inspection some of them are devices which are in my allowed list (some have multiple NIC's).

Why is the correlation not working correctly, I see a similar issue if I use IP addresses.

Thanks

Mike

Parents
  • 0

    Endpoints are group with IP, DNS and MAC.  If you only created a whitelist for DNS, but the endpoint is detected on the MAC address level, it will still be rogue device.  The most basic information that UDT gathers is the MAC address, it would be best to create whitelist using the MAC addresses.

Reply
  • 0

    Endpoints are group with IP, DNS and MAC.  If you only created a whitelist for DNS, but the endpoint is detected on the MAC address level, it will still be rogue device.  The most basic information that UDT gathers is the MAC address, it would be best to create whitelist using the MAC addresses.

Children
No Data

SolarWinds solutions are rooted in our deep connection to our user base in the THWACK® online community. More than 195,000 members are here to solve problems, share technology and best practices, and directly contribute to our product development process.

SolarWinds Customer Success Center Certification SolarWinds Lab Link Accounts
About THWACK Blogs Federal & Government Edit Settings Free Tools & Trials
Legal Documents Terms of Use Privacy California Privacy Rights Security Information
©2021 SolarWinds Worldwide, LLC. All Rights Reserved.