Finding XP Pro SP3 as "Windows-2000-LAN-Manager"

[Brian Bergin]

Every XP Pro SP3 box on our LAN has so far showed up as "Windows-2000-LAN-Manager" in Thunderbolt.

[Michael Holloway]

As the trial TBA works today, we don't do any sort of heavy OS fingerprinting.  Doing so might cause security software on machines or IDS/IPS systems to falsely flag malicious-intent activity from the TBA device.  XP's SMB/CIFs server identifies itself as Windows-2000-LAN-Manager, and so, today, we just go with that.  In the future, we are looking for other passive OS fingerprinting techniques to help us refine what the TBA presents at the portal.  All suggestions are welcome!

-mike

[Brian Bergin]

If SNMP was installed on the workstations/servers would that make it easier to get a valid OS version?  If so, then document it so that admins can opt to install SNMP on the systems.

[Michael Holloway]

Definitely.  SNMP support is something I'd love to see prioritized high up the list during this trial.  Marc, :)  Picking up the system.sysName.0 will be trivial.  There are also additional SNMP monitors that should be coming soon,  heck they almost made into the trial at release.  Which SNMP monitors would you be most interested in seeing?  CPU Load, Load Factor, Memory, Uptime, something else?

-mike

[Marcos Hernandez]

From the marketing side I can say that we will be asking for the gathering and corresponding representation, across the board, of the most common MIB OID's, like CPU, memory, uptime, etc.

Marcos

[Brian Bergin]

Oh yes!  All of those would be excellent.  Free disk space would be excellent too.