Log in to create and rate content, and to follow, bookmark, and share content with other members. Not a member? Join Now!

AnsweredAssumed Answered

How to find out all the dead hosts and detect their licences

Question asked by Ahmed Abunada on Jul 26, 2015
Latest reply on Jul 27, 2015 by djprakash

Like • Show 0 Likes0
Comment • 7

Hello friends ,

I have got a question. First , I need to find out all the dead host in order to reduce the licences consuming . in other words , during my regular scaning , there are many dead or non important Ips . this is consuming licenses , Could any one explain what is the correct way to check all these Ips as a first stage and how to remove their licence .

Best Regards

No one else has this question

Outcomes

7 Replies

djprakash Jul 27, 2015 3:09 AM
Mark Correct
Correct Answer
Hi,

Step 1 : Perform an asset search based on "last scan date". Identify what means "dead to you".
Step 2 : Remove the IP's form Step 1 in your Host list. (Assets-Host Assets)

I can give you a faster workflow if the number of Ip's from step 1 is very large.

Cheers,
DJ
Like • Show 0 Likes0
Actions
- Ahmed Abunada @ djprakash on Jul 27, 2015 4:02 AM
  Mark Correct
  Correct Answer
  Hello DJ
  Thanks for your contribution , let me explain exactly what I mean by dead host , all the Ips that quays are not able to run any thing on it . I would like to determined all these Ips , so I can remove them .
  these Ips already been scanned by me , but somehow some of them become dead hosts . I have got a huge Ips.
  Could you please give more explanation . I wanted to submit a report for all these dead hosts
  
  THANKS
  Like • Show 0 Likes0
  Actions
  - djprakash @ Ahmed Abunada on Jul 27, 2015 4:18 AM
    Mark Correct
    Correct Answer
    Ahmed,
    
    So, you will have to run a current scan and see which one's did not respond. (Not all non-responding ones can be called dead).
    This may result in deletion of data that might affect your compliance program.
    
    Create an assetgroupcalled “ToBeDeleted”
    Addallavailable IP’s in yoursubscription to it and save the AG
    Nowgo to Assetsearch
    Run an Assetsearch on the AG “ToBeDeleted”. Justselect the AG and hitsearch. This returnsa list of All IP’s in yoursubscription that has ben scanned at-least once. (If it has been scanned at-least once, it isnt a dead host). You may modify this search to suit your meaning of "Dead host"
    On this assetsearch result, selectall IP’s and select “Launch a scan” (Dont run the scan, justhit launch) option from the action menu
    In the Launch Vulnerability scan window, copy the target IP range
    Nowgo back to the Assetgroup tab and select to edit the Assetgroup you created called the “ToBeDeleted”
    In the Edit AG window, go to the IP’s tab, click Manually.
    In the manual entry IP window, paste the range you have copied and click “Remove"
    Nowsaveyourassetgroup again
    Delete or do whatever you want to do to the list of IP’s now in “ToBeDeleted"
    
    Hope this helps.
    1 person found this helpful
    Like • Show 0 Likes0
    Actions
    - Ahmed Abunada @ djprakash on Jul 27, 2015 4:42 AM
      Mark Correct
      Correct Answer
      Dj , how about this solution ,
      
      Export all the IPs and perform a new mapping against them . the mapping results will show me all the live and dead hosts , after that I can collect all the dead and remove them .
      Like • Show 0 Likes0
      Actions
      - djprakash @ Ahmed Abunada on Jul 27, 2015 4:48 AM
        Mark Correct
        Correct Answer
        Mapping happens on very limited hosts and mapping does not need a license to run. Scan will be a better way.
        I suggest connect with your TAM as you will be deleting data based on the result.
        Like • Show 0 Likes0
        Actions
        Ahmed Abunada @ djprakash on Jul 27, 2015 4:54 AM
        Mark Correct
        Correct Answer
        Good , If I want to check out all the live and dead host regardless who ever been scanned or not , Based on the result I can go back I remove what I want . Am I clear for you .
        Like • Show 0 Likes0
        Actions
        djprakash @ Ahmed Abunada on Jul 27, 2015 5:18 AM
        Mark Correct
        Correct Answer
        (It does not let me edit my earlier post.)
        I meant this :
        
        Mapping happens on very limited PORTS and mapping does not need a license to run. Scan will be a better way.
        Yes, if it has been scanned at least once it will appear in your asset search.make your selection there in-case you have hosts that has been de-commissioned.
        
        I suggest connect with your TAM as you will be deleting data based on the result.
        
        - Look at last scan date of a host before you delete.
        Like • Show 0 Likes0
        Actions

How to find out all the dead hosts and detect their licences

Outcomes

Related Content

Recommended Content