Inconsistent data collection across different sites
4 posts · Closed
Good morning,
We use the Network IP Scanner to get various information on PCs in our network, such as user ID, IP address, MAC, etc. But if we, for example, scan four different sites/networks, one site may provide IP, user ID, MAC, OS, and other info, but then the next two sites will only show IP and MAC respectively and miss the other data altogether, and one site may show MAC addresses, but instead of unique MACs will duplicate the same one for each PC listed.
Is there anything we can check to fix that? Maybe this has to do with network routes being blocked? Or firewall rules we need to adjust for ports?
It is hard to tell without knowing anything about your network. It can be virtually anything, from network settings to firewalls and user account privileges (who runs the network scanner).
Regarding identical MAC addresses returned for each PC: this would usually be the case when you are scanning a non-local subnet. Since ARP messages do not pass through routers, the router responds with its own MAC address. Please see this article for helpful information on getting MAC addresses in a different subnet.
The user has full rights to the PCs, so it is likely to be a network problem. We have 5 different locations and the Network Scanner application works well on most of them except one, where we consistently get incomplete results.
Perhaps there are some ports that may be blocked thus preventing us from seeing as much details as we see in our other locations?
Again, it depends on the specific scanning options you have selected, but generally ports 445 and 137-139 need to be accessible. You may need to use a network analyser like Wireshark to see what's happening under the hood to troubleshoot this.