Security

DHCP is going to provide a quick initial profile, while IF-MAP can provide more detail about the client and potentially more granular information for the profiler.  For profiling, more information is always the better option.

Thanks Carson,

When you mention Quick Initial Profile does this mean that IF-MAP needs more time? For example, a DHCP discover that has to go through the Gateway will that result in the Gateway publishing the DHCP fingerprint through IF-MAP, or is IF-MAP a slower process looking for other information about the client? Just curious to see how it works. 

In an access request is noticed Fingerprinting details (see below), it would be great I could reconstruct the source of the fingerprint from Clearpass. I can of course test this out in my lab but maybe someone can point me to a document. 

DHCP is going to provide a quick initial profile, while IF-MAP can provide more detail about the client and potentially more granular information for the profiler.  For profiling, more information is always the better option.

As mentioned in the AOS 8 user guide, IF-MAP collects HTTP user agent and mDNS data.  Both of those items require some level of either higher level OS operation or user involvement.

Thanks Carson,

When you mention Quick Initial Profile does this mean that IF-MAP needs more time? For example, a DHCP discover that has to go through the Gateway will that result in the Gateway publishing the DHCP fingerprint through IF-MAP, or is IF-MAP a slower process looking for other information about the client? Just curious to see how it works. 

In an access request is noticed Fingerprinting details (see below), it would be great I could reconstruct the source of the fingerprint from Clearpass. I can of course test this out in my lab but maybe someone can point me to a document.