IP / Port Scan

[ericguyer]

What is the best practice for conducting an IP / port scan using FNMS for Oracle software?

Specifically, how may I set up FNMS to replicate what Oracle would otherwise execute via its "LMS Discovery Tool" that looks for where Oracle might be running based on open ports? Candidates would then be "promoted" for interrogation via agent.

From a technical perspective, this includes the following products, common ports, etc:

• Database: 1521 – 1528
• Internet Application Server: 7776 – 7778, 4443, 7443, 8250
• WebLogic: 7001 – 7003
• HTTP and HTTPS protocols
• All applicable IP ranges

[mfranz · Accepted solution]

Hi,

I wouldn't generally rely on the discovery function. Especially in enterprise environments there are usually way too many blockers (routing, firewalls) for this to work in a useful way. And the moment you get your firewall changes done, you would kind of solution to expect on the other end.

Also you shouldn't have to rely on discovery, if processes are working as they should (Deployment, Configuration Management, Change Management).

Discovery in FNMS is used in two ways:

• Identify devices
  You can define port as you want here, but I guess you won't be able to process the specific ports found open easily. Not sure if the information is stored somewhere in the databse at all.
  
  
• Identify specific applications (in order to collect inventory)
  For this, there are specific inputs provided.
  
  

Beyond that, you might want to consider 3rd party tools.

Best regards,

Markward

[ChrisG]

Similar to the comment from @mfranz, best practice would generally avoid gathering Oracle LMS information using IP/port scanning. It is typically very difficult to get that to work reliably and robustly in real-world locked down datacentre environments.

Typical best practice is to install the FlexNet inventory agent on the relevant computers, and have it gather the LMS information as part of its inventory gathering process. If the full agent cannot be installed, the inventory gathering process can be executed in a standalone (not installed) fashion.