topic Re: SIM using portscans or community name guessing ? in Server Management - Systems Insight Manager

SIM using portscans or community name guessing ?

Mikael Rönnbäck — Mon, 04 Oct 2004 06:20:16 GMT

Our security department asked me if I could verify that the SIM server is responsible for this or if there's something else to be looked into. They have received alerts in the IDS system that the SIM server is performing portscans and "SNMP community name guessing" towards a number of target servers.

Does anyone know if this is the method SIM 4.1 operates ? We did not get these alerts when we used the old CIM 7 installation.

Re: SIM using portscans or community name guessing ?

Joel Rubenstein — Mon, 04 Oct 2004 08:16:21 GMT

During the device identification task SIM will attempt to use each SNMP community string name defined in the global protocol settings. Once it has determined the actual community string name used by the device it stores this information in the nodesecurity.xml file and should no longer need to perform any "SNMP community name guessing".

Re: SIM using portscans or community name guessing ?

Ivan KOVAC — Mon, 04 Oct 2004 08:24:38 GMT

Hello

I now that under Global Protocol settings is option to enter more then one Read community string. The identification process attempts communication to the system using each of entered communities until a successful response is obtained. Is this "SNMP community name guessing"?

i.