RVY200621: Process Description Device and Service Discovery

1. Active Directory

Get computers from Active Directory or another LDAP compatible directory service
Searching objects of class 'computer' Fields imported from the directory are:
- name (with the domain appended, if given by the LDAP query or the value of objectCategory)
- ipHostNumber (IP address)
- objectCategory (if given, used as domain suffix for the name)
- operatingSystem (used only for the option to resolve the OS by the directory)
- userAccountControl (to check if device was disabled)

REQUIREMENTS:

2. Network scans

Get computers from network scans (kinda ping-sweep)
Check for each IP in the given address ranges...
Is port 135 open, is port 22 open or does the address reply to an ICMP echo request (ping)
Merge known computers and computers found
Remove known IPs from the network scan results
Get IPs for known hosts by DNS queries
Query DNS for names, aliases and Ips
If there was no hostname set but just an IP for a known computer, then set the hostname while avoiding bad/broken name strings.
Remove more known IPs from the network scan result
Get IPs for computers from directory search result
Remove computers from the directory search result that overlap with the network scan result.
If a computer in the scan/search results has got an IP address but no hostname and the DNS queries yielded a name for that address then set the hostname for that address.
Set a better hostname that appears to be better than the current hostname
If there were IP addresses found for a computer from a directory search or network scan and one computer from a directory search result is known by one of these IPs and a computer in the directory search result is known by the hostname or address associated with that computer then the computer's hostname is set to the hostname of the computer from the directory search and that computer is removed from the directory search result.

REQUIREMENTS:

3. Determine the host type and hostname

Determine the host type for computers from directory search results
For the option to determine the type by the directory search result, take that type
If such a type was not found on option 'default to Windows' then set Windows as type
Without the option to determine the type by the directory search result, set the type to
Windows if port 135 was open otherwise set the type to Unix if port 22 was open.

Set the hostname for each computer from the network scan result to the hostname associated with its IP address

4. Service Discovery

Probe each computer for Oracle databases
For the option to use remote execution-based Oracle DB discovery, see the document that describes RE based Oracle DB discovery. That discovery method is applied to all known and newly found computers.
For each computer (except those for which a DB has been found by RE based Oracle discovery)
Check if one of the ports that are assumed to indicate an Oracle DB was open (default is 1521)
Discover Oracle DBs on the computers that have the ports open that indicate a DB
For Windows hosts, look for Win32_Service instances that run oracle.exe, extract the SID/Service- or Instance name and check for which of the given ports and SIDs a database answers.
For Unix/Linux hosts, extract the SID/Service- or Instance name from /etc/oratab and check for which of the given ports and SIDs a database answer.

Probe each computer for ESX/vSphere
Check if port 443 is open
Check if a connection can be made by the VMware SDK assuming a service-endpoint of the form 'https://<hostname-or-address>/sdk'.

Comments