Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

DHCP fingerprints for Aruba sensors #500

Merged
merged 1 commit into from
Oct 26, 2022

Conversation

dmoinescu-r7
Copy link
Contributor

@dmoinescu-r7 dmoinescu-r7 commented Oct 25, 2022

Description

New DHCP fingerprints for Aruba sensors, based on data observed inside DHCP packets.

How Has This Been Tested?

Ran rake tests, recog_verify, recog_standardize and update_cpes.py

Types of changes

  • New feature (non-breaking change which adds functionality)

Checklist:

  • I have updated the documentation accordingly (or changes are not required).
  • I have added tests to cover my changes (or new tests are not required).
  • All new and existing tests passed.

<example>Aruba-Sensor</example>
<param pos="0" name="hw.vendor" value="Aruba Networks"/>
<param pos="1" name="hw.model"/>
<param pos="0" name="hw.device" value="Sensor"/>
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Would "Network Management Device" be a better classification than "Sensor"? They are mentioned with the text "network management device" on CDW's website, but I was unable to locate such language on Aruba's website.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I took that text from the Aruba site. Other sites (resellers, presumably) have different descriptions - for instance, model Q9X65A is described in various places as:

  • LTE Sensor
  • LTE Sensor - wireless network management device
  • LTE Wireless Sensor Network Management Device
  • User Experience Insight LTE Sensor
  • UXI sensor

The full description for the other 2 models mentioned in examples (R3R67A, R7H75A) seems to be User Experience Insight Sensor G-Series - wireless network management device.

So I think both sensor and network management device are reasonable descriptions. I don't have a strong opinion on the matter.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

To get another opinion I contacted @TomSellers who agreed both are correct, but "Network Management Device" would be more specific.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Updated hw.device to "Network Management Device"

Copy link
Contributor

@mkienow-r7 mkienow-r7 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you for the contribution @dmoinescu-r7!

@mkienow-r7 mkienow-r7 merged commit e952c3c into rapid7:main Oct 26, 2022
@dmoinescu-r7 dmoinescu-r7 deleted the dmoinescu/aruba-sensor branch November 3, 2022 08:49
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants