LAN Watch

Monitor > LAN Watch

Agent > LAN Watch

LAN Watch uses an existing agent on a managed machine to periodically scan the local area network for any and all new devices connected to that LAN since the last time LAN Watch ran. These new devices can be workstations and servers without agents or SNMP devices. Optionally, the VSA can send an alert when a LAN Watch discovers any new device. LAN Watch effectively uses the agent as a proxy to scan a LAN behind a firewall that might not be accessible from a remote server.

Note: LAN Watch can only identify SNMP devices that share the same SNMP Community Read value as the managed machine performing the LAN Watch.

Using Multiple Machines on the Same LAN

There are only two reasons to do a SNMP LAN Watch on multiple machines within a scan range:

1. There are multiple SNMP Communities within the scan range and therefore there are multiple machines with different SNMP Community Read values.
2. The user wishes to have redundant SNMP monitoring.

Alert on new device

If Alert on new device is checked and a new device is discovered by LAN Watch, an alert is sent to all email addresses listed in Email Recipients. LAN Watch alerts and email recipients can also be specified using the Monitor > Alerts page.

Note: Machines that have not connected to the LAN for more than 7 days and then connect are flagged as new devices and will generate an alert.

Ignore devices seen in the last N days

Enter the number of days to suppress alerts for new devices. This prevents creating alerts for devices that are connected to the network temporarily.

Scan

Click Scan to schedule a recurring LAN Watch scan on each selected machine ID. The scan runs every interval that you set. The default is 1 day.

Date/Time

Enter the year, month, day, hour, and minute to schedule this task.

Skip alert if MAC address matches existing agent

Checking this box suppresses alerts if the scan identifies that the MAC address of a network device belongs to an existing managed machine with an agent on it. Otherwise a managed machine that was offline for several days and comes back online triggers an unnecessary alert during a LAN Watch.

Cancel

Click Cancel to stop the scheduled scan. Cancel also deletes all records of the devices identified on a LAN from the VSA. If you re-schedule LAN Watch after clicking Cancel, each device on the LAN generates a new alert.

Every N periods

This task is always performed as a recurring task. Enter the number of times to run this task each time period.

Email Recipients

If alerts are enabled, enter the email addresses where alert notifications are sent. You can specify a different email address for each managed machine, even if it is for the same event. The From email address is specified using the System > Configure page.

Scan range

Set the minimum and maximum IP addresses to scan here. Selecting a machine ID to scan, by checking the box next to that machine's name, automatically fills in the minimum and maximum IP range based on that machine's IP address and subnet mask.

Note: LAN Watch does not scan more than 2048 IP addresses. If the subnet mask of the machine running LAN Watch specifies a larger IP range, LAN Watch truncates it to 2048 addresses. LAN Watch only detects addresses on the local subnet to the machine you run LAN Watch from. For example, with a subnet mask of 255.255.255.0, there can be no more that 253 other devices on the local subnet.

After alert run select script on this machine ID

If checked, a script is run when an alert is triggered. You must click the select script link to choose a script to run. You can optionally direct the script to run on a specified range of machine IDs by clicking this machine ID link. These specified machine IDs do not have to match the machine ID that triggered the alert.

Check-in status

These icons indicate the agent check-in status of each managed machine:

Agent has checked in

Agent has not recently checked in

Agent has never checked in

Online but waiting for first audit to complete

The agent is online but remote control is disabled

Machine ID.Group ID

The list of Machine ID.Group IDs displayed is based on the Machine ID / Group ID filter and the machine groups the administrator is authorized to see using System > Group Access.

IP Range Scanned

The IP addresses that are scanned by the selected machine ID when LAN Watch runs.

Last Scan

This timestamp shows when a machine ID was last scanned. When this date changes, new scan data is available to view.

Recurring Interval

The time interval used to determine how often LAN Watch runs.

Alert Active

If checked, LAN Watch alerts are enabled for this scan.

Days Off

Suppresses alerts for new devices for this number of days.

Skip MAC

If checked, suppresses alerts if the scan identifies that the MAC address of a network device belongs to an existing managed machine with an agent on it.

Topic 398: Send Feedback