jgorsky
Posts 5
|
Some folks have asked recently if it was possible for Beacon to differentiate between endpoints running Vista and other Windows variants.
The DHCP vendor class for Vista is the same for XP (MSFT 5.0) so it is not possible to differentiate on that attribute alone, but the DHCP options/requested options are different so that presents one opportunity, and the web user agents for the popular browsers running on Vista present another -- assuming of course port 80 traffic from the endpoints of interest is being seen by NetWatch...
The information in the DHCP client request that may be used to differentiate Vista vs XP is a combination of the VCI (Msft 5.0) and the DHCP options/requested options. You could use a logical AND block in an advanced XML rule (to access the DHCP options data) as follows:
<Rule name="Vista OS">
<RuleEntity entity="Windows Vista" cf="0.90"/>
<AND>
<DHCPVendor vendor="/MSFT 5.0/"/>
<DHCPOptions option-list="/^53,61,12,81,60,55/"/>
<DHCPReqOptions option-list="/^1,15,3,6,44,46,47,31,33,121,249,43/"/>
</AND>
</Rule>
Alternatively, if NetWatch is able to analyze these stations traffic, from the web browser user agents, both IE and Firefox include the string 'Windows NT 6.0' so, you could use a web user agent rule (configured via the UI) that matched on this string--again if NetWatch can see the web traffic from these endpoints and collecting this data.
The full agents look as follows:
FF
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.0.1) Gecko/2008070208 Firefox/3.0.1
IE
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; SLCC1; .NET CLR 2.0.50727; .NET CLR 3.0.04506)
|