Excluding an IP from discovery

Todd36 · ‎01-30-2020

Is there a way to exclude a specific IP from being discovered?

Use case: we have seed lists of IPs that are automatically generated that SN imports into range lists and some IPs may never actually be discovered but the attempts raise red flags on the targets. We like to keep specific IPs from being discovered.

I tried to add an IP to the MID as an exclude, see attached, but that's apparently not what it's for as it when through the discovery attempt anyway.

DaveHertel · ‎01-30-2020

Hi - Yes, discovery can be set to exclude IPS from jobs. On the Disco job defintion there is IP range items... and a table for defining exclusion IPs discovery_range_item_exclude I don't think this table is exposed in left nav by default ( but u can add it of course or make a favorite)

its a little awkward... but the process:

1. create schedule

2. create ip range for that schedule (save it)

3. drill into ip range and definition specific IPs to exclude, either singular or a range

EXAMPLE

then drill into ip range, and ADD a Discovery Range item exclusion record. like this... where .10 thru .20 is excluded

which, can be seen in the exclusion table:discovery_range_item_exclude

DOCS: https://docs.servicenow.com/bundle/geneva-it-operations-management/page/product/discovery/task/t_Exc...

Hope this helps?

View solution in original post

DaveHertel · ‎02-04-2020

Hi -- I don't quite understand the question "they send traffic to ... IPAddress". The IPs defined in the job will be hit of course (except exclusions) but i don't see how the MID would be reaching out to the Aruba* IPs... since its not part of the scope of the job.
but.... food for thought.... maybe add an IP range to the job, that IS the Aruba box... and then inside that range, exclude those IPs. its a hack I know, but maybe it'll force the disco to respect all IPs you want to be excluded, including this unusual one that is getting hit for some reason.

If that works, please reply to share the knowledge... a new twist on an old issue 🙂

Hope this helps..

John Krueger · ‎02-19-2020

Thank you Dave. I'm sorry to report that I can neither confirm nor deny your idea's results because I've since been informed my original exclusions were working. In other words ServiceNow was not the source of the suspect traffic.

However to clarify I was trying to describe Aruba network devices sending login attempts to iLO (integrated lights out server managers) to authentication.

Perhaps I'll be able to try your idea at some point with a future challenge:)

Runjay Patel · ‎12-20-2020

Check out this video, it will clear all your doubts and help you to understand Discovery queries in details.

Link: https://www.youtube.com/watch?v=30JbWVsusyE&t=10s&ab_channel=ServiceNowHelpdesk

It help you to understand below points.

Discovery Overview
Discovery prerequisite
Understanding Discovery Phases in details
Discovery credentials and IP Affinity
Mid Server Management with Cluster and Load Balancer
Schedule jobs
Set up discovery from scratch to end
Live implementation with real world data.
Troubleshooting on various aspects
Many more other issue related to mid server, CIs
Cloud discovery
Service Mapping

Please mark reply as Helpful/Correct, if applicable. Thanks!!