Behaviors and Probes

[mihai1107]

Hello! 

I am using Behaviors for Discovery schedules. For the behavior, we have 2 phases for Functionalities:

Phase 1: every other protocol, no SSH

Phase 2: SSH only

I noticed that during discovery, the Shazzam probe only tries Phase 1 protocols and ignores Phase 2 protocol(SSH). Devices using SSH are not discovered during the schedule run.

Has anyone encountered this issue?

Thanks!

[Fabian Kunzke]

Hey,

the way you have implemented won't work. In Phase 1 alls available ports of a device are scanned. Then a list of ports which respond positively is handed over to the next phases of the discovery. These phases then only scan what is in the list.

So if you exclude the ssh protocol from the initial phase 1 scan list, the ssh protocol won't be on the phase 1 list. So your phase 2 (classification) won't use it for scanning. To scan certain ports & protocols in phase 2-4, they must be scanned in phase 1.

Hope this helps.

Regards

Fabian

[mihai1107]

Hello! Thanks for your answer!

Maybe I was not clear enough, I meant the "Phase" here

In the past, with this same configuration, there were no problems. 

[Fabian Kunzke · Accepted solution]

Hello,

Yes, these are also the phases I am referring to. I don't know how or why this worked in the past, but as I described, this should not work.

What is your use-case behind this?

Regards

Fabian

[mihai1107]

Thank you for your response!