3 Replies Latest reply on Aug 13, 2013 11:31 AM by networkingkool

    IP Address Manager: v4.0.0 - Subnet Scan vs. Subnet ICMP Scan ?

    ajurado

      I have a current situation on which I have a subnet for printers and I noticed that printers change from "used" to "transient" status every time an scanning takes place.

       

      here is an example to illustrate what is happening (I selected one node to simplify the issue).

       

      IPAM problem.JPG

       

      What I am trying to understand is why this is happening? is there a difference between "Subnet Scan" and "Subnet ICMP scan"?

      if yes, where do I control this setting? I rather have "Subnet ICMP scanning" done at all times because it's more accurate.

       

      I am probably missing a setting somewhere and I would greatly appreciated if you point me into the right direction.

       

      tks.

        • Re: IP Address Manager: v4.0.0 - Subnet Scan vs. Subnet ICMP Scan ?
          networkingkool

          Hi,

           

          "Subnet Scan" and "ICMP Scan" are different. "Subnet Scan" is process of scanning DHCP Server Scope, default is 4 hour between each interval. "ICMP Scan" is process of sending echo to all IP of Subnet.

          I think ICMP Scan always faster than Subnet Scan, that why you see ICMP Scan first then Subnet Scan. I just think hehe

          I 'm sure that, you also created a Network Scope of this printer subnet in DHCP Server, However to this printer, you manually set its IP Address. The "ICMP Scan" can ping printer's IP, but later "Subnet Scan" cannot find the IP in DHCP Scope database. As a result IP status first change to Used then immediately change to Transient.

           

          HTH,

          1 of 1 people found this helpful
            • Re: IP Address Manager: v4.0.0 - Subnet Scan vs. Subnet ICMP Scan ?
              ajurado

              First of all thank you for taking the time to read my post and reply.

               

              You are 90% correct. I did open a support ticket with Solarwinds and here are the findings:

               

              The first scan indeed is "ICMP" (ICMP Subnet Scan), the second scan it is a "SNMP Scan" (Subnet Scan). For some unknown reason the ICMP scan does find the printer and set the proper value, but when the SNMP scan takes place the printer can't response to SNMP and set the value to transient. I noticed the behavior on the packet capture (using WireShark)

               

              Capture.JPG

               

              Here is my setup:

               

              • I don't query my DCHP server as I am running InfloBlox and Solarwinds doesn't support anything but Microsoft or Cisco (I believe)
              • On the printer subnet there about 200 printers. Some printer do support snmp, yet others don't.
              • Not all devices on my subnets support SNMP

               

              The IPAM Problem

               

              • IPAM it is not flexible enough to specifythe type of scan to perform per subnet. These options (ICMP and SNMP) are global. (Unless I just don'tknow the product too well and probably missed that setting)

               

              The Fix:

               

              • I Don't know either the tech support.
                • Re: IP Address Manager: v4.0.0 - Subnet Scan vs. Subnet ICMP Scan ?
                  networkingkool

                  Hi,

                   

                  In IPAM Admin guide, it does  not clearly say SNMP scan is another scan method called "Neighbor Scan", but I believe that SNMP Scan is Neighbor Scan. Please feel free to open that Admin guide and do a search with "SNMP Scan". And "Subnet Scan" is a normal scan from Windows DHCP Server, for example

                  But I get confused when you said that you aren't monitoring any DHCP Server..

                  Let's wait for answer from Solarwind support Tech

                   

                  Thanks,