Devices - lots showing as webserver

[ccdesktop]

Hi - testing the new beta and it looks great so far. One thing I have noticed with the device scanning is that several devices are showing as webserver when they are not.

Notably we have Nortel Switches which show as webservers and also Windows Mobile handsets which also show as webservers.

There may be others - but these are the ones known as the moment.

Is there any way of automatically distinguishing these?

Thanks.

[ccdesktop]

The webserver is open on these devices and the other ports are not?
How would you detect a "real" webserver?

Perhaps if no other fields contain data and all you are getting is literally the ip address (as is what I am seeing) then it could be unknown.

Webservers often provide more detail - make, model, name etc.

Just a thought.

[ccdesktop]

If SNMP is not enabled does that mean no more info can be obtained?

Would it be better to categorise these as "Unknown" rather than webserver?

Thanks.

[Hemoco]

If SNMP is not enabled does that mean no more info can be obtained?

Yes, scanning is done on SNMP, SSH and http.
To get the vendor/mode info snmp must be enabled.

Would it be better to categorise these as "Unknown" rather than webserver?

The webserver is open on these devices and the other ports are not?
How would you detect a "real" webserver?

[Hemoco]

First check if snmp is enabled on these devices.
If yes, there will be an OID visible.

There is already a list of known OID's in the database, the idea is to extend this list with new OID's from the community.