I have a current situation on which I have a subnet for printers and I noticed that printers change from "used" to "transient" status every time an scanning takes place.
here is an example to illustrate what is happening (I selected one node to simplify the issue).
What I am trying to understand is why this is happening? is there a difference between "Subnet Scan" and "Subnet ICMP scan"?
if yes, where do I control this setting? I rather have "Subnet ICMP scanning" done at all times because it's more accurate.
I am probably missing a setting somewhere and I would greatly appreciated if you point me into the right direction.
"Subnet Scan" and "ICMP Scan" are different. "Subnet Scan" is process of scanning DHCP Server Scope, default is 4 hour between each interval. "ICMP Scan" is process of sending echo to all IP of Subnet.
I think ICMP Scan always faster than Subnet Scan, that why you see ICMP Scan first then Subnet Scan. I just think hehe
I 'm sure that, you also created a Network Scope of this printer subnet in DHCP Server, However to this printer, you manually set its IP Address. The "ICMP Scan" can ping printer's IP, but later "Subnet Scan" cannot find the IP in DHCP Scope database. As a result IP status first change to Used then immediately change to Transient.
First of all thank you for taking the time to read my post and reply.
You are 90% correct. I did open a support ticket with Solarwinds and here are the findings:
The first scan indeed is "ICMP" (ICMP Subnet Scan), the second scan it is a "SNMP Scan" (Subnet Scan). For some unknown reason the ICMP scan does find the printer and set the proper value, but when the SNMP scan takes place the printer can't response to SNMP and set the value to transient. I noticed the behavior on the packet capture (using WireShark)
Here is my setup:
The IPAM Problem
In IPAM Admin guide, it does not clearly say SNMP scan is another scan method called "Neighbor Scan", but I believe that SNMP Scan is Neighbor Scan. Please feel free to open that Admin guide and do a search with "SNMP Scan". And "Subnet Scan" is a normal scan from Windows DHCP Server, for example
But I get confused when you said that you aren't monitoring any DHCP Server..
Let's wait for answer from Solarwind support Tech
SolarWinds solutions are rooted in our deep connection to our user base in the THWACK® online community. More than 150,000 members are here to solve problems, share technology and best practices, and directly contribute to our product development process.