Rogue System Sensor Detects as Printer

[avilt]

I have setup RSD on ePO and on clients for each subnet. In my ePO it shows all L3 interfaces from Cisco L3 switch as printers. I expect this to display it as unknow or Cisco device. How can I fine tune this settings and reporting?

[tao]

Have you updated the Detected System OUIs: The OUI (Organizational Unique Identifier) is used to identify the vendor, manufacturer or other organization of a particular piece of equipment. ePO uses this to identify the vendor of a specific network interface controller (NIC) whether physical or virtual. This information is maintained by the IEEE Registration Authority. (Server Settings / Detected System OUIs)

[avilt]

Where can I get these OUI for ePO. Also does ePO store MAC address of each managed device?

[avilt]

Following list is available, which list should I import in ePO?

IEEE MA-L Assignments (.csv)

IEEE MA-M Assignments( .csv)

IEEE MA-S Assignments (.csv)

IEEE IAB Assignments (.csv)

IEEE CID Assignments (.csv)

IEEE Ethertype Assignments (.csv)

IEEE Manufacturer ID Assignments (.csv)

IEEE Operator ID Assignments (.csv

[tao]

You may consider going to ePO / Configuration Server Settings / Detected System OUIs / Edit / Update

[avilt]

Thank you, updated the file

Now under interface it shows it as Cisco but still the OS is listed as Rico Printer.

[boschind]

it happens in my ePO installation too - ricoh printer reported as Cisco OUI

does exist an alternative addr where to update OUI list ?

http://standards.ieee.org/regauth/oui/oui.txt

update: just found this link Sanitized IEEE OUI Data (oui.txt)

is someone using it ?

[boschind]

hello avilt

have you configured the OUIs sensors exclusion list ?

this should help to reduce the workload for RSD sensors and ePO server

[Former Member]

ok, and what is sense downloading oui.txt to my EPO?

[cdinet]

The oui.txt updates the vendor list for vendor identification. Adding an exclusion tells the sensor to ignore that vendor. What is the mac address that is being identified as a printer?