Network scan tool/appliance horror stories

Tue Oct 30 05:47:12 UTC 2012

On Mon, Oct 29, 2012 at 12:10:40PM -0700, Pedersen, Sean wrote:
> We're evaluating several tools at the moment, and one vendor wants to
> dynamically scan our network to pick up hosts - SNMP, port-scans, WMI,
> the works. I was curious if anyone had any particularly gruesome horror
> stories of scanning tools run amok.

Check your netmask on the to-be-discovered network and what the rate
of discovery is. I have seen internal systems attempt to scan and 
discover nodes in a /16 and promptly set off a flood of alarms on all 
PDUs (6 per rack) and plenty of other devices that thought they are 
being attacked.

-andreas