Shazzam probe not checking port 161

[Community Alums]

Trying to troubleshoot why some firewalls are not being discovered when I noticed in the shazzam input discovery log for two devices (same model) the probe is not checking port 161.  It does check 161 on other devices including firewalls, this is the first time I've seen this issue. Our environment is pretty much OOB, there have been no customizations in the discovery space outside from custom patterns and classifiers. Any idea why the Shazzam probe wouldn't check 161 for these devices specifically?

[deepthic3]

@Community Alums : I am encountering a similar issue. I would appreciate it if you could provide an update here if you have got any resolution. Thank you!

[blanm]

Hi, Were any of you able to find a solution to this issue? We are experiencing the same. 

[Andy H1]

I can't open the screenshot for some reason, but it looks like port 22 is listed as "open"? Apparently, Shazzam doesn't probe all the ports at the same time. Rather, it looks like there's a base subset of ports it tries first and will only probe other ports (such as SNMP) depending on the results. You can change the order (priority) in which ports are tried, but I'd advise research before doing so because there are some well documented side effects that are often undesirable, particularly where SSH and SNMP are involved as many network devices have both ports open.

Link:  ServiceNow Docs - Port Probes 

"When a port probe encounters a protocol in use, the Shazzam sensor checks the port probe record to determine which classification probe to launch. The common protocols WMI, SSH, SNMP, and HTTP in the base system have priority numbers that control the order in which they are launched.

The priority is as follows:

• 1 - WMI
• 2 - SSH
• 3 - SNMP
• 4 - HTTP

In the base system, the WMI probe is always launched first, and if it is successful on a device, no other port probes are launched for that device. If the WMI probe is not successful, then the SSH probe is launched to gather information on the device. If it is not successful, the SNMP probe is launched. This method allows Discovery to classify a device correctly if the device is running more than one protocol (for example, SSH, SNMP, and HTTP)."

[Harish Bainsla]

Hi 

Please login to mid server and check below things

1. Ping Ip address 

2. Run  command to check port is open or not