release 070814

1 What is the minimum configuration for iNetSec Smart Finder?

Frequently One Sensor appliance and one Manager Computer is the minimum configuration. The Manager software is in-

Asked stalled on Windows Server OS. Chart software can run on any PC as a standard application.

Questions 2 How many IP segments ca be managed by the iNetSec Smart Finder?
Smart Finder can manage up to 250 IP segments. One Sensor can manage up to 16 IP segments and one Manager
can manage up to 250 IP segments by using multiple sensors.

3 How many endpoint devices can be managed by iNetSec Smart Finder?
Smart Finder can manage up to 10,000 endpoint devices. One Sensor can manage up to 3,000 endpoint devices
(1,000 concurrently). One Manager can manage up to 10,000 endpoint devices by using multiple sensors.

4 If a customer needed to manage over 10,000 endpoint devices, what type of solution can be provided?
In that case, it’s recommended to use two Managers and to operate two separate systems.

5 If 10,001 endpoint devices were connected to one Manager, what would happen?
In that situation the system would keep working, however the accuracy of the results is not guaranteed and is
unpredictable. It’s recommended to work with a system with up to 10,000 endpoint devices. It is possible to see
this situation in the Event Viewer Window of the Manager and in the Windows Event Log of Manager Computer.
The Sensor would behave in the same way if the number of devices exceeded the limit of 3,000.

6 How does iNetSec Smart Finder operate on IP segments where a Sensor is not deployed?
iNetSec Smart Finder controls only IP segments where Sensors are deployed, and it cannot manage IP segments
not covered by a Sensor. Make sure to deploy Sensors in IP segments that you would like to manage with iNetSec
Smart Finder.

7 If an endpoint has an inappropriate IP address in a IP segment managed by a Sensor, how does iNetSec Smart
Finder manage such endpoint device?
iNetSec Smart Finder would detect a device with an IP address inappropriate for the IP segment, when the IP ad-
dress belongs to another subnet mask. iNetSec Smat Finder would block such devices from accessing the networ
and would not register it in the device list.

8 Can I use two iNetSec Smart Finder Sensors on one IP segment for fault tolerance or load sharing?
No. Only one Sensor can be used for each IP segment. In order to minimize the time to replace a Sensor in case of
failure, consider to keep one or more spare Sensors.

9 Can I detect, classify and block each guest OS on a virtualization environment?
“Yes. Use bridge mode for guest OS’s if the host computer uses virtual software like VMware Server, Virtual PC,
Windows 7 for XP mode and similar. If the host computer uses NAT mode, only the host computer is detected and
classified. In this case, all network accesses from the host computer including those initiated by guest OS’s are
blocked if the computer is not authorized.

10 Can iNetSec Smart Finder detect and control devices with fixed IP addresses?
Yes. iNetSec Smart Finder works both in fixed IP addresses environment and in DHCP enviroment and can detect
and control devices with either fixed or dynamically assigned IP addresses.
 release 070814

11 Can iNetSec Smart Finder detect a device that doesn’t issue ARP requests?
Frequently Yes. iNetSec Smart Finder can detect such devices within 24 hours.

Asked
12 Can the Manager software be installed on a virtual machine?
Questions Yes. Any operating system are also supported when running on Vmware vSphere or on Hyper-V that officially sup-
ports the operating system.

13 Do I need to install any agent software on the endpoint devices?
No. iNetSec Smart Finder is an agentless solution. It doesn’t require the installation of any agent software on end-
point devices.

14 How does iNetSec Smart Finder classify endpoint devices?
iNetSec Smart Finder classifies devices thanks to proprietary algorithms. The algorithms include device specific
methods that are provided with the Device Dictionary. The use of a mirror port improves time and quality of the
device classification.

15 Once classified, can a Device Type change?
iNetSec Smart Finder identifies devices by MAC address. If a user uses a device with a removable adapter such as
a USB wireless adapter, and the adapter is then used with another device, the Device Type corresponding to the
MAC address would change. iNetSec Smart Finder verifies the Device Types of classified devices once a week. If the
Device Type changed, Smart Finder would re-classify the Device with the new Device Type. To prevent the change
after the device is classified, you can set “Device Type Update” to “No” on “Device Information Window” Manager.
From version V3.0L20, iNetSec Smart Finder supports device reclassification. This means that if a device is unclassi-
fied, it can be classified later on when Smart Finder receives additional information to classify the device.

16 How are OS Types and Device Types classified for each version of Windows OS?
The results of classification for each Window OS are as follows:
(*1) Windows NT Server is classified as “”Windows NT”” but Windows NT Workstation is displayed blank.
(*2) In case the OS is Windows Vista or later, and its network location is set as “”Public Network”” or Network Discov-
ery function is turned off, the Device Type is classified as “”Unclassified”” and the OS Type is displayed blank.
Windows OS Device Type OS Types
Windows 98 Windows Windows 98
Windows Me Windows Windows Me
Windows NT Windows Windows NT (*1)
Windows 2000 Windows Windows 2000
Windows XP Windows Windows XP
Windows Server 2003 Windows Windows Server 2003
Windows Vista (*2) Windows Windows Vista
Windows Server 2008 (*2) Windows Windows Server 2008
Windows 7 (*2) Windows Windows 7
Windows 8 Windows Windows 8
Windows 8.1 Windows Windows 8.1
Windows Server 2012 Wndows Windows Server 2012

 release 070814

17 What does the Uptime tab in Power Consumption Window in Chart show?
Frequently The Uptime tab shows the aggregated uptime of all devices per each day or month. You can specify an IP segment

Asked or an IP segment group to see the uptime on a specific IP segment or IP segments. Otherwise, Chart aggregates
uptime of the all devices on all the IP segment groups that you can refer to. The table shows the uptime by unit of

Questions 30 min.

18 What does the Printer Usage of Chart show?
The Printer Usage displays the number of total pages printed by printers in specific IP segments. The number of
pages may not be equal to the actual paper consumption if a printer has features such as duplex printing or N up
printing.

19 What are the hardware requirements for the Manager?
The requirements are listed in the User’s Guide. The Manager can support up to 10,000 endpoint devices.

20 Can I use iNetSec Smart Finder if a NAT environment exists on the communication path between Sensor and
Manager?
Yes, you can use iNetSec Smart Finder.

21 Can iNetSec Smart Finder detect and classify endpoint devices in network environments that include wireless
access points?
If the access points are set in bridge mode, iNetSec Smart Finder would detect and classify all the devices connect-
ed via the wireless access points. If the access points are set in router mode, iNetSec Smart Finder may fail to detect
and classify appropriately the devices.

22 Can iNetSec Smart Finder detect and classify all the devices connected to the network?
iNetSec Smart Finder uses ARP Request to detect devices connected to the network. Therefore, it cannot detect
devices that don’t use ARP (such as AppleTalk, IPX, SNA, DECnet, IPv6, etc).
In case an endpoint security product with ARP anti-spoofing feature was running on a device, the Registration
Form might not be displayed on that device or the device might not be blocked temporarily.

23 How are the three ports on the Sensor used for each configuration?
During the initial setup, LAN0 is used to change the Sensor’s settings from factory default. During normal opera-
tions, the ports are used as follows, depending on the number of IP segments to manage.
3 port configuration (Up to 3 IP segments) tagged VLAN configuration (Up to 16 IP segments)
LAN0 X X
LAN1 X -
LAN2 X X
Three IP segments: All the ports can be used to manage IP segments and to configure the Sensor. LAN1 and LAN2
can be used to configure the Sensor after the initial configuration through LAN0 port.
Up to 16 IP segments: Either LAN0 or LAN2 can be used to configure Sensor. Only LAN2 is configured as tagged
VLAN port and can be used to manage IP segments. If Application Monitoring and/or Behavioral IPS function are
used, please refer to the User’s Guide or to the Getting Started Guide.

 release 070814

24 In an network environment that uses VRRP (Virtual Router Redundancy Protocol), how does iNetSec Smart
Frequently Finder handle a MAC address of the Virtual Router and the MAC addresses of physical routers?

Asked All the MAC addresses are detected by iNetSec Smart Finder. The classified device type depends on the physical
routers but both physical and Virtual routers are classified as “”Routers””.

Questions
25 Does the Manager support multiple administrators?
Yes. The management of specific IP segment groups can be assigned to other administrators.

26 In Blocking Mode, is a web browser opened automatically when a blocked device tries to connect to the net-
work?
No. The user of the device needs to open the web browser manually. Then the web browser is automatically redi-
rected to a specific URL that shows the reason why the devices was blocked.

27 Can I customize the message displayed in the Blocking Notification Window?
Yes. You can customize it under system settings in the Manager software.

28 Can I customize the fields in the Registration Form Window?
Yes. You can add company logo, a header, a footer and Terms & Condition. You can also change colors of items on
the Registration Form Window in addition to the following field’s customizations:
- Change name
- Set the field mandatory or optional
- Set the field visible or invisible
The maximum number of fields is 5. It is not possible to add more fields.

29 Can I disable the Notification Window?
Yes. You can disable the following notifications:
- “”Blocking Notification Window (New Device)””
- “”Blocking Notification (Pending)””
- “”Blocking Notification (Rejected Device)””

30 What types of notification messages displayed in the web browser can be customized?
You can customize the message and the title of the following notifications:
- “”Blocking Notification Window (New Device)””
- “”Blocking Notification (Pending)””
- “”Blocking Notification (Rejected Device)””
- “”Registration Form Window (Manager)””
- Footers of these notifications
By deploying a web server for the External Registration Form Window, you can fully customize the Registration
Form.

31 Since iNetSec Smart Finder provides only the MAC address of an unauthorized device when using email notifi-
cation or SMNP, how can I see more information about that device?
A notification contains only the MAC address of the device. However in the Manager you can find more informa-
tion related to that MAC address such as the device type and the detected IP segment.
The device information includes the following:
 release 070814

32 Does a Sensor send a notification when the IP address of a detected device changes?
Frequently Yes. Also, exceptions can be set for changes of IP addresses in IP Address Change Notification Exception.

Asked
33 How does iNetSec Smart Finder identify a device?
Questions iNetSec Smart Finder uses the MAC address to identify a device.

34 Can I approve multiple devices at once?
Yes. You can approve multiple devices by selecting multiple devices in the Manager. You can also approve multiple
devices by importing a CSV file of device information with multiple approvals.

35 How can I approve a registration request subimitted through Registration Form?
You can approve with one of the following methods:
- In the Manager, select the device and manually approve it.
- Simply approve it by the command included in the notification e-mail.

36 Can a blocked device communicate with other devices if they are in the same IP segment?
No. Even if they are in the same IP segment, the blocked device cannot communicate with any other devices.

37 Why do I see some device types classified as “Unclassified”?
iNetSec Smart Finder can classify all the device types except the “Unclassified” ones. This might be due to several
reasons, for example the device information is not defined in the Device Dictionary. You can contact us and pro-
vide such information in order to be included in one of the future Device Dictionary upgrades.

38 How can an abnormal status of a Sensor be notified?
The Sensor’s health is checked in one of the following ways:
- The Manager checks the health of the Sensors.
- A Sensor can check another Sensor in case of multiple Sensors deployed.
- A Sensor checks its health status by itself.
If a Sensor is found in an abnormal status, this situation is notified to the administrator by email or by SNMP trap.

39 Can multiple email addresses be set to receive notification emails?
Yes.

40 How long does it take for an e-mail notification to be sent?
A notification email is sent immediately when an event happens.
The email is sent from the Sensor’s IP that is assigned as Communication Route in the Sensor Basic Setting window.
You have to change the SMTP settings in the Manager and confirm that your SMTP server can send email by Sen-
sor’s request.

41 After some settings are changed in the Manager, how long does it take for these settings to be implemented
on the Sensor?
It takes 1 minute by default from iNetSec version V3.0L20. You can change the sync interval time by selecting 1, 5
or 10 minutes for the “Sync interval between Manager and Sensor” in the Manager.
 release 070814

42 Which network protocol is used for the communication between Manager and Sensor?
Frequently A proprietary protocol on TCP is used for the communication.

Asked HTTPS is also supported for encrypted communication.

Questions 43 After how long is an event deleted for a new detected device?
Events are automatically deleted after a specified period of time. The period of time is selected in “Event Reten-
tion Period” under System Setting in the Manager. The maximum selectable time is 90 days. If the total number of
events reaches 100,000, events are automatically deleted from the oldest to the newest even if they are still within
the time limit.

44 Is the operation history of an administrator recorded?
Yes. The logfiles are saved in the folder “OperationLogs” every day and are deleted after 400 days from creation.
“OperationLogs” is in the same folder where the Manager is installed.

45 What types of information can be exported?
The following types of information can be exported into CSV files:
- Events (Events log, such as new device detections and abnormal status of a Sensors)
- Device List
- Sensor List
- IP Address Change Notification Exception
- Application Information

46 Are the CSV files imported into the Manager required to have specific formats?
Yes. The formats are described in the User’s Guide.

47 Can I backup the Sensor’s basic configuration parameters?
Yes. You can backup the basic configuration parameters of a Sensor such as IP address, netmask and gateways
through the web page for the configuration of the Sensor.

48 In case the Sensor is checking the health of other Sensors, how is the checking order decided?
The order is decided by the Manager.

49 Is a Device List shared among Sensors?
The Device Lists are managed by IP Segment Groups. Each Sensor downloads the Device List related to the IP Seg-
ment Group that contains an IP Segment that it can manage and uses this Device List to manage devices in that
Segment Group.

50 Which component of iNetSec Smart Finder handles the Registration Form Window?
The Sensor pushes the Registration Form Window and the Blocking Window, not the Manager. If a web server was
deployed as External Registration Form Server, the web server would handle it. For devices that don’t have a web
browser, like printers, you can send the Registration Form via the Manager. In this case, a user who wants to regis-
ter this type of device can submit the Registration Form from a different device, for example a PC.
 release 070814

51 Can iNetSec Smart Finder output graphical statistics and reports related to unauthorized endpoint devices?
Frequently With Chart, iNetSec Smart Finder can generate reports on number of devices and % rate of device types, but no

Asked information about unauthorized devices is provided in the form of graphical reports. Such information can be
exported into CSV files and graphical reports can be created with external tools like MS Excel.

Questions
52 Can iNetSec Smat Finder compare the Printed Usage and Power Consumption with the data of last year?
No. iNetSec Smart Finder doesn’t have such a function.

53 How is the Power Consumption calculated in Chart?
The Power Consumption of a device on Chart is calculated as follow:
Power Consumption = Uptime x Average Power Consumption
Uptime is the sum of the device’s running time checked by the Sensor every 30 minutes.
Average Power Consumption is a pre-defined value for the device. The pre-defined value can be modified.

54 Which component of iNetSec Smart Finder gathers the number of pages printed by network printers?
The Sensor is able to obtain these values. The gathered information is collected in the Manager. Consequently
Chart would download and use the collected data, and generate reports.

55 Can the data displayed on Chart be seen on the Manager?
No. Chart downloads the data from the Manager and calculates the displayed values.

56 Can the Manager provide information on uptime and numbers of pages printed by network printers?
No. This information is calculated and displayed only in Chart.

57 How are the numbers for Printer Usage calculated?
They are gathered as Standard MIB from printers. This is not the number of paper sheets but the number of pages.
One double side printed page is counted as 2 pages.

58 If a printer is a multi-purpose peripheral that has functions of scanner, facsimile and copier, is the number of
copied paper also counted as the number of printed pages?
Yes. The number of copied paper is also recorded and counted as number of printed pages in the same MIB.

59 Can I set the Rated Power Consumption for each device?
Yes. You can set it in the “Device Information Window” of Manager for each device. Also, you can set values for
multiple devices at once by exporting, editing and importing the Device List.

60 How many applications is iNetSec Smart Finder able to detect?
For the first product release, 1500+ applications are present in the Application dictionary and all can be detected.
In addition, iNetSec Smart Finder can detect sub-applications or user actions for some of applications such as
Facebook and Youtube.

 release 070814

61 How often are the Applicaton Dictionaries updated?

Frequently The Applicaton Dictionaries are typically updated every 3 months.

Asked
62 Can the Sensors work while the Manager software is down?
Questions Yes. The Sensors can detect, classify and block devices even while the Manager is down. However, in that condition
you cannot change any settings related to the Sensors and you cannot authorize submitted Application Forms. All
the information of detected devices is stored in the Sensor, and is sent to the Manager once the Manager is up and
running again. However, if the Sensors and the Manager cannot communicate for too long, after reaching 150 Ap-
plication Forms, some Application Forms may be deleted. Chart is not able to download information directly from
the Sensors when the Manager is down.

63 What do I do if a Sensor is not working properly?
Consult the User’s Guide first. Replace the Sensor if necessary. Ways to change Sensor are described in “”8.1 Sensor
Maintenance”” in the User’s Guide. If a Sensor is not working, it cannnot detect and block devices, however this
condition doesn’t have any impact on the network.

64 How can I replace a Sensor with a new one?
You can set the basic configuration on a new Sensor manually or by restoring it from a backup. In fact you can
automatically inherit the sensor’s settings with the customize config command (pq_cutstomize_config.exe).
Remove the old Sensor and wait until the status of Sensor becomes abnormal in the Manager. Replace the old
Sensor with the new Sensor. The settings for the old Sensor are downloaded from Manager into the new Sensor
automatically. If the firmware of the new Sensor is older, the firmware is also automatically updated by Manager.
For the detailed procedure, refer to “”8.1 Sensor Maintenance”” in the User’s Guide.

65 Can I automatically remove a device from the approved device list after a specified expiration date.
Yes. You can set an expiration date for each device. Expired devices are automatically removed from the device
database of iNetSec Smart Finder. If thoese devices try to access the network again after the expiration date, they
are categorized under the “”Detected/Requested”” list. In case iNetSec Smart Finder was working in Blocking Mode,
these device would be blocked.

66 How can I update the firmware of the Sensor?
After a new patch module is applied on the Manager, the Sensor’s firmware starts to be updated automatically.
Therefore, you need to consider the time it takes to apply the patch since Sensors cannot block devices during that
time. Patch modules are available on our web site.

67 How can I update the Manager?
By applying a patch module to the Manager, a Manager update is automatically applied to the vManager, if the
patch module contains the Manager update.
The patch modules are available in our web site.

68 Does the Sensor need to be rebooted after updating the Device Dictionary?
No. The Sensor doesn’t need to be rebooted.
 release 070814

69 Does the Manager need to be rebooted after updating the Device Dictionary?
Frequently No. The Manager doesn’t need to be rebooted.

Asked
70 What is the slide switch on the back of the Sensor?
Questions That switch is used only for maintenance purpose, and it’s recommended not to change it during normal opera-
tion. The switch must stay positioned on “1”.

71 What are the USB ports in the back of the Sensor?
The USB ports are used only for maintenance purpose, and it’s recommended not to use them during normal
operation. Please don’t try to plug any USB devices into the ports.

72 What is the MTBF(Mean Time Between Failure) of the Sensor?
The MTBF of the Sensor is 430,000 hours. The MTBF of the AC adopter is 200,000 hours. Consequently the MTBF of
the Sensor should be considered 200,000 hours for safety reasons.
The above values are just statistical and do not guarantee the working conditions of the Sensor.