Correlation of assets discovered by multiple scans

[ian_midgley]

Hi, is there anything that explains how the different scanning techniques correlate what they find? For example, we have a number of Windows servers that are running Apache and we have AD Computer Path and IP Range scanning configured. The servers are discovered via both scans but each gets a Windows asset created from the AD Computer Path scan and a Linux asset from the IP Range scan (discovered via HTTP I think). Both assets have the same IP address. Should Lansweeper be able to recognise these as the same asset?

[ian_midgley]

That makes sense. We didn't have the credentials set on the IP Range scan so I guess it couldn't determine that it was a Windows server and so added it as a Linux asset which is actually a bit weird since it wasn't running SSH so why should it think it was Linux as opposed to just Webserver? Also, Lansweeper could have probed port 135 or 445 to confirm it was Windows, and similarly 111 for Linux. This raises another question. Is there a flowchart anywhere that describes how Lansweeper determines the asset type? I have lots of assets of type Network device. what combination of attributes makes it a Network device? It must have got more than the IP address as those appear as Unknown but there isn't any OID information. Some of the assets that I would say are Network devices (such as some of my Cisco switches) are being reported as Linux which isn't very helpful. It would be nice to have an indication of what information Lansweeper is basing it's determination on. Is there a log file to tell me what it has tried for a particular asset?

[FrankSc]

Hi,
If the correct credentials are also mapped to the IP range scanning target, the servers should be discovered by both scans. Based on the asset name that is found, both should then merge them into 1 asset.

https://www.lansweeper.com/knowledgebase/how-lansweeper-uniquely-identifies-assets/