Answer
PROBLEM
During the initial part of the scan, GFI LanGuard correctly identifies the device, but during port scanning it changes to an incorrect device.
ENVIRONMENT
- GFI LanGuard
- All Supported Environments
SOLUTION
It is possible to remove the offending information from the fingerprint files, but that could be reflected in future scans.
In some cases SNMP gives more reliable information than banners, and in others the banner information is more reliable. It is hard to determine which is the best in operating system identification.
CAUSE
GFI LanGuard may have determined the operating system originally using SNMP and then, because of banners it received from specific ports, it indicated to GFI LanGuard that the machine was running a different operating system.
NOTES:
NOTES:
- GFI LanGuard supports SNMPv1 and SNMPv2c.
- SNMPv3 and SNMP over TLS/DTLS are not supported.
For more information on how GFI LanGuard detects the Operating System of a machine, note: How does GFI LanGuard determine the Operating System running on a device?