SIM using portscans or community name guessing ?

[Mikael Rönnbäck]

Our security department asked me if I could verify that the SIM server is responsible for this or if there's something else to be looked into. They have received alerts in the IDS system that the SIM server is performing portscans and "SNMP community name guessing" towards a number of target servers.

Does anyone know if this is the method SIM 4.1 operates ? We did not get these alerts when we used the old CIM 7 installation.

[Joel Rubenstein]

During the device identification task SIM will attempt to use each SNMP community string name defined in the global protocol settings. Once it has determined the actual community string name used by the device it stores this information in the nodesecurity.xml file and should no longer need to perform any "SNMP community name guessing".

[Ivan KOVAC]

Hello

I now that under Global Protocol settings is option to enter more then one Read community string. The identification process attempts communication to the system using each of entered communities until a successful response is obtained. Is this "SNMP community name guessing"?

i.