Skip to content

TikMan v1.9.23

Choose a tag to compare

@pgadient pgadient released this 14 Jul 16:42

Device types: utility gear is no longer filed as "Server"

Most devices on a LAN are utility gear — printers, copiers, phones, switches, access
points — that happen to serve a web UI. Anything with an open port used to end up as
"Server". Two things were wrong:

  • The printer, SIP and RTSP ports were never scanned, so the rules that recognise
    them outright could never fire. The scan now probes 515 (LPD), 554 (RTSP),
    631 (IPP), 5060 (SIP) and 9100 (JetDirect)
    , each with its own badge.
  • The classifier fell back to "has 80/443/22 ⇒ Server." It now trusts, in order:
    the model line (firewall / printer / access point / phone — one vendor ships
    firewalls, switches and APs under the same OUI), then the definitive services,
    then the Windows signature (RDP, or WMI+SMB — which outranks the OUI), then
    purpose-built makers, then a real mailbox server. Bare SMTP no longer implies
    a server — that is what every copier's scan-to-mail listens on. A device with only a
    web or SSH port is left unknown rather than mislabelled.

Fixed, all seen on a real scan:

  • Toshiba e-STUDIO copier and Brother MFPs read as servers → now Printer
  • Yealink desk phones and a Cisco SPA122 ATA read as servers/switches → now Phone
  • Zyxel NWA access points read as switches → now Access Point
  • A Windows workstation on a Zyxel-branded NIC read as a switch → now PC