Loading...

Knowledge Center


Subnets that contain only a single IP address are listed in the Rogue System Detection Uncovered Subnets
Technical Articles ID:   KB85341
Last Modified:  2/10/2017
Rated:


Environment

McAfee Rogue System Detection (RSD) 5.x, 4.7.x

Problem

After you install RSD, the Uncovered Subnets section of the RSD Detected Systems page is populated with a large number of subnets that contain a single IP address. These are systems with a /32 subnet mask, and are also known as a self-configured subnet. You may see this behavior regardless of whether any RSD Sensors have been deployed.

Cause

Managed systems within the ePO System Tree report their subnet mask as '/32'.

RSD uses a stored procedure within the ePO database to gather a list of subnets from the ePO System Tree. If a system that exists in the ePO System Tree reports that it has a self-configured /32 subnet mask, that information will be included in the Uncovered Subnets list if the system does not have an RSD Sensor installed.

This situation appears limited to certain VPN configurations.

Solution

While the information from the ePO System Tree is technically accurate, it may not be desirable to have these types of subnets listed. To permanently ignore these subnets:
  1. Log on to the ePO console.
  2. Click Menu, Systems, Detected Systems, Uncovered.
  3. Sort using the Subnet Mask column.
  4. Select the subnets you want to ignore using the checkboxes on the left.
  5. Click Actions, Detected Subnet, Ignore.

Rate this document

Affected Products

Beta Translate with

Select a desired language below to translate this page.

Glossary of Technical Terms


 Highlight Glossary Terms

Please take a moment to browse our Glossary of Technical Terms.