Rogue system sensor scan multiple subnet

[jmcg]

Hello,

I would like to make my sensor scan multiple subnet (like on DHCP server)

How can I achieve this ? I thought it was auto.

We have over 1500 subnets, I don't want to install a RSD Sensor on each.

[YashT]

Hello @jmcg ,

You can install Rogue System Detection sensors on these types of systems:

• DNS or any system that is always connected to the subnet and monitoring traffic — These systems are the best place to install Rogue System Detection sensors because they are not often turned on or off and are seldom disconnected from the network.
• DHCP servers on multicast subnets — DHCP servers constantly monitor multicast traffic and instantly detect when a new system connects to the subnet.
• All systems on a multicast subnet — This allows you to configure Active sensor election in the Rogue System Detection server settings. Once configured, all systems on a multicast subnet run an election algorithm to set some system sensors as active and the remainder as passive. The configuration settings control how often the software runs the algorithm.

[jmcg]

We wanted to install on DNS and DHCP servers but HQ wanted a dedicated server to scan subnet.

So sensors are installed on dedicated servers.
There is no way I can tell Sensors to try to scan all subnets discovered by ePO ?

[YashT]

Hello @jmcg ,

If the sensor is installed on DHCP then any system connecting to DHCP from any subnet will be captured by sensor and information will be sent to epo, but if you are installing in one dedicated server on particular subnet it will only cover the subnet on which it is installed.

How RSD detection works: To detect systems on the network, the sensor uses WinPCap, a packet capture library.

It captures layer-2 broadcast packets sent by systems that are connected to the same network broadcast segment. It also listens passively to all layer-2 traffic for other network protocols, such as ARP and DHCP.

NOTE: The sensor doesn't determine whether the system is a rogue system. It detects systems connected to the network and reports these detection's back to the McAfee ePO server, which determines whether the system is rogue based on user-configured settings.

[jmcg]

I understand, but our DHCP and DNS servers are in Linux OS. Since you don't have support for Linux, we had no choice to build our dedicated servers.

Now I just need a solution, number are just number, If I can tell the RSD Sensor to scan others subnet this could be great.

I would like to know if I edit the sensor.db and add subnet is the subnet table and source has networkAdapter, will RSD Sensor will scan it ?