What qualifies as a webserver for lansweeper scans?

[tcrlansweeper]

On our asset list we have around 50 of these "webservers" with almost no information, I am not sure what lansweeper is looking at to get the info or where it comes from. They look like this: 

When I visit the associated IP address, it goes to this generic Sophos screen: 

We use a Sophos firewall and have Sophos clients installed on each computer, and the ESMTP makes me think it's something do with how our Sophos filters emails, but I don't really have much else to go on. I would love if someone could direct me on how to get some more information on these "webservers."

Thank you!

[mkhuber1]

A cause for the MAC address not to show up is if the device is on another subnet or different VLAN

[Nisanth]

Though if a reply packet is received by the host scanning an IP on another subnet/VLAN a MAC address will be associated with that packet, even if that address has been altered to mask the source device. Haven't seen a switch or firewall normally forward packets without source MAC address but I figure it's possible.

[tcrlansweeper]

Would there be any other way to figure out the MAC address since advanced IP scanner isn't finding anything?

[Nisanth]

My mistake on this, scanning with tools like Advanced IP Scanner won't show MAC addresses for IPs on different subnets/VLANs per mkhuber1. That info needs to be pulled from routers or switches that route that subnet/VLAN, so try the below per mkhuber1's other post:

"When I run into "unknowns" like this I use the ARP cache on a router or core switch to find the MAC Address and then lookup that MAC to find the NIC manufacturer."

[RCorbeil]

From your screencap, I'd guess that the device is being identified as a web server because it's running an FTP server. When you try to visit the IP address, you're likely using a web browser and trying to connect to an HTTP server, which the device isn't running, so it's no surprise you can't connect. Try using an FTP client and you should get a response. (If you can't do it from the command line, grab a copy of Filezilla.)

[tcrlansweeper]

Update, I wasn't able to connect to an ftp server through filezilla or cmd, the connection just times out every time. Thanks for the suggestion

[mkhuber1]

When I run into "unknowns" like this I use the ARP cache on a router or core switch to find the MAC Address and then lookup that MAC to find the NIC manufacturer.

Some times the NIC manufacturer is enough to give some kind of clue about the device.

[tcrlansweeper]

Thank you, I will try to figure out how to do this

[Nisanth]

Also check if the associated IPs belong to your computers that have the Sophos client installed on them. Though I can't see why a client would have a running and open?? SMTP service.

Now that I think of it, if I recall correctly from the one time that I scanned network subnets on a network that had a Sophos firewall, it returned odd results for IP addresses/subnets that couldn't be scanned - possibly similar results to what you're seeing where it was showing an FTP or SMTP service on those IP addresses. Try scanning your subnets using a tool like Advanced IP Scanner. If you see similar results it's mostly likely caused by a configuration on the Sophos firewall.