Discovery SNMP Confusion: Linux Server Versus Intermec Printer

[andrewmccabe]

I am running discovery on Helsinki.

During discovery, I encounter numerous Linux Servers where the SSH Authentication fails because of invalid credentials (it is a large diverse somewhat decentralized environment with multiple IT Departments).

Classification Order

1. Try Windows
2. Try SSH (Open Systems)
3. Try SNMP
4. Try Others … there are a total of 14 (the order
   is only specified for 4 or 5 of them)

When a Linux server fails SSH authentication, it starts SNMP discovery.

1) SNMP asks the device for basic information to get started

2) an OID of .1.3.6.1.4.1.8072.3.2.10 is returned because it is the standard response for a Linux Server

ServiceNow has an SNMP OID Classification of .1.3.6.1.4.1.8072.3.2.10 defined as an Printer manufactured by Intermec. An SNMP Walk of an Intermec Printer does return this OID.

Here is the problem: I have over 1000 Intermec Printers in my environment as well as hundreds of Linux Servers that I currently cannot authenticate to ...

I am looking for advise on the best approach to identify Intermec Printers correctly AND identify Linux Servers that I cannot authenticate to ...

Can I force a change in the Identifier or Classifier to distinguish these two different kind of devices that return the same OID?

Any advise would be helpful

Thank You!

[dedeepyatirugu]

Hi Andrew,

Did you find some way to solve it. We have the similar issue. Please post the solution here if you found any.

Thanks In advance.

[Daniel Needles1]

Yeah, so in another life I wrote monitoring software.  Basically what happened is the vendor likely was new to SNMP and didn't realize they needed to register with IANA.  Instead, they got a hold of NET-SNMP libraries and used what it had out of the box.  Of course ServiceNow got caught in the cross fire and cannot use this SysOID to make any assumptions about the responding device.  The solution for me was to use the sysDescr because though the vendor was too lazy to sign up with IANA.org for their own enterprise OID (https://www.iana.org/assignments/enterprise-numbers/enterprise-numbers) and used the Net-SNMP one out of the box, they did at least populate the sysDescr with a unique description. So instead of adding a SNMP OID and a Classifier, I simply added a SNMP Classifier based on the SysDescr. Specifically, Discovery Definitions => CI Classification => SNMP. There (in this case) I created a reference to a BarracudaDevice with a Classificiation Criteria (tab) with sysdescr contains Barracuda Email Security Gateway. NOTE: I first had to create a Baracude Email Security Gateway child class under Network Gear. A dated but still applicable YouTube video on this is - https://www.youtube.com/watch?v=6ULRbpGOSB4 Also if you want this to show up in Changes and Incidents, not just tasks you need to add it to the Principal Class, which can be done by navigating to cmdb_class_info.LIST, create a new Class, click the drop down arrow on Class and set Principal Class to True.

[doug_schulze]

Andrew, does the sysdescr of the snmp classify return show anything that identifies as a liunx device as the model name or that? If so you can use a classification criteria in the printer classifier that says sysdescr does not contain linux or something like that.

[Daniel Needles1]

I come from the monitoring space and this is a common problem.  Small shops cannot hire experienced workers and so they skip steps.  In this case they went and got NET-SNMP which is used industry wide for 30 years for SNMP. 

Carnegie Mellon University developed the package, which MIT and then UC Davis picked up (where I grew up and went to college - http://www.mit.edu/afs.new/net/tools.new/src/ucd-snmp/ucd-snmp-3.6.2/FAQ ) and then it was open sourced as net-snmp on SourceForge (before GIT.) 

Out of the box, net-snmp provides some generic sysoids that are meant as examples.  Unfortunately many such as HP, Lenovo, and others, used these instead of creating their own.  What the Intermec folks should have done was to go to IANA and request their own number (https://www.iana.org/assignments/enterprise-numbers/enterprise-numbers) and then populate the sysoid with that. 

For example, my entry:

41402

  NMS Guru, Inc

    Daniel L. Needles

      guru&nmsguru.com

That said, you can work around it if the vendor (hopefully) populated the SysDesc.  So in the classifier you simply use SysDesc instead of the SysOID for Identification. 

To do this grab SNMPWALK via yum/etc on Linux or install Cygwin on Windows and opt into net-snmp.  Next walk the SNMP MIB-II table, or just walk as it will show at the top.  For example, via NET-SNMP's SNMP v3

snmpwalk -v3 -l authpriv -u USER -a SHA -A "SHA" -x AES -X "AES" HOSTORIP

where you replace USER, SHA, AES and HOSTORIP with the right values.

Then look at the sysDesc value.  If it is unique enough, you can make this work by adding a new device class.  Use the filter navigator to go to "CI Classification" and create a new one likely extending off an existing table and specifying the sysdescr in the Classification Criteria.   

This dated but sufficient video can get you most of the way with the comments used above:  https://www.youtube.com/watch?v=6ULRbpGOSB4