Communication Encryption between MID server and target devices

Ankush13 · ‎09-03-2014

I was wondering what kind of secure communication is happening between MID server and target servers while they are communicating during discovery. Can this be pulled down via wireshark? Or is it encrypted with some algorithm of some sort.

- AL

doug_schulze · ‎09-04-2014

Great thread! Awesome contributions.. For windows we use Packet privacy as outlined here... Authentication Level (COM)

You can see it set in the /agent/lib/WMIScanner script on the midserver host

WMIScanner.prototype = {

defaultRoot: 'root\\cimv2',

wbemFlagReturnImmediately: 0x10,

wbemFlagForwardOnly: 0x20,

PktPrivacy: 6,

View solution in original post

Frank1975 · ‎09-04-2014

The Data Stream between the MID Server and the Target Server is encrypted. Please have a look here:

MID Server Requirements - ServiceNow Wiki

Hope that helps.

Frank

JBark · ‎09-04-2014

I believe that link refers to the connection between the MID server and the SNow instance?

Frank1975 · ‎09-04-2014

Oh, sorry, i just checked the SSH within number 4.1 "Discovery logs into a machine with SSH and runs commands within an encrypted session to gather system information"

for WMI i am not sure.

Thanks

Frank

JBark · ‎09-04-2014

Good catch Frank, I missed that for SSH. Interesting question, I'll try and wireshark a Windows discovery today and see what I get.