McAfee EPOLICY ORCHESTRATOR 4.0.2 - Guide de l'utilisateur télécharger pdf (Page 191)

• The sensor implements aging on the MAC filter. After a specified time, MAC addresses for

systems that have already been detected are removed from the filter, causing those systems

to be re-detected and reported to the server. This process ensures that you receive accurate

and current information about detected systems.

Data gathering and communications to the server

Once the sensor detects a system on the local network, it gathers information about that system

from the data contained in the network packet. This information includes:

• DNS name.

• Operating system version.

• NetBIOS information (domain membership, system name, and the list of currently logged-on

users).

All of the NetBIOS-related information gathered is subject to standard limitations of authorization

and other limitations, as documented in the Microsoft management API.

The sensor packages the gathered information into an XML message, then sends the message

via secure HTTPS to the ePolicy Orchestrator server for processing. The server then uses the

ePolicy Orchestrator data to determine whether the system is a rogue system.

Bandwidth use and sensor configuration

To save bandwidth in large deployments, you can configure how often the sensor sends detection

messages to the server. You can configure the sensor to cache detection events for a given

time period, such as one hour, then to send a single message containing all the events from

that time period. For more information, see

Configuring Rogue System Detection policy settings

Systems that host sensors

Install sensors on systems that are likely to remain on and connected to the network at all

times, such as servers. If you don’t have a server running in a given broadcast segment, install

sensors on several workstations to ensure that at least one sensor is connected to the network

at all times.

TIP: To guarantee that your Rogue System Detection coverage is complete, you must install

at least one sensor in each broadcast segment of your network. Installing more than one sensor

in a broadcast segment does not create issues around duplicate messages because the server

filters any duplicates. However, additional active sensors in each subnet results in traffic sent

from each sensor to the server. While maintaining as many as five or ten sensors in a broadcast

segment should not cause any bandwidth issues, you should not maintain more sensors in a

broadcast segment than is necessary to guarantee coverage.

DHCP servers

If you use DHCP servers in your network, you can install sensors on them. Sensors installed on

DHCP servers (or spanned ports on DHCP servers) report on all subnets connected to it by

listening for DHCP responses. Using sensors on DHCP servers reduces the number of sensors

you need to install and manage on your network to ensure coverage, but it does not eliminate

the need to install sensors to systems that use static IP address.

TIP: Installing sensors on DHCP servers can improve coverage of your network. However, it is

still necessary to install sensors in broadcast segments that use static IP address, or that have

Detecting Rogue Systems

How the Rogue System Sensor works

191McAfee ePolicy Orchestrator 4.0.2 Product Guide

1 2 ... 186 187 188 189 190 191 192 193 194 195 196 ... 227 228

Commentaires sur ces manuels

Pas de commentaire

McAfee EPOLICY ORCHESTRATOR 4.0.2 - Guide de l'utilisateur Page 191

Commentaires sur ces manuels

Produits connexes et manuels pour Logiciel McAfee EPOLICY ORCHESTRATOR 4.0.2 -