Insights & updates from our experts
Prerequisites for SNMP, SSH and WMI
What the infrastructure team must open and configure before the first scan.
All connections start at the hub's server, not at Xurrent and not at your computer. If a device can be reached from your laptop but not from the hub server, discovery will fail for that device. Run every test below on the hub server.
Network access
| Connection | Port | Notes |
|---|---|---|
| SNMP, hub to device | UDP 161, or the port in the credential set | Connectionless. Check the return path through stateful firewalls and endpoint security. |
| SSH, hub to device | TCP 22, or the port in the credential set | Allow the hub's address specifically. |
| WMI over WinRM, hub to device | TCP 5986 (HTTPS, preferred) and TCP 5985 (HTTP) | The hub prefers the encrypted listener. |
| WMI over DCOM, hub to device | TCP 135 and the dynamic RPC range (49152 to 65535 by default) | Used only where the hub's own operating system supports it. |
| Hub to Xurrent | Outbound HTTPS (TCP 443) | No inbound rule is required. |
Setting up each device type
- SNMP devices. Enable the SNMP agent and add the hub server's address to the device's allow list. Match the community string, or the v3 user, authentication and privacy settings, to the credential set. Widen the SNMP view if the device hides its system information.
- Linux and macOS. Make sure the SSH service is running and the account may log in. On macOS, turn on Remote Login in System Settings > General > Sharing. If the account must use sudo, allow it without a password for the discovery commands only. The first time the hub reaches a host it remembers the host's SSH key. If the host is rebuilt, the hub withholds the password until the new key is accepted on the hub server with
xt-hub accept-host-key <address> <fingerprint>. - Windows. Enable WinRM with a listener, ideally HTTPS with a certificate the hub trusts. Use an account that is a member of local Administrators, or of Remote Management Users for scoped non-administrator access, and that is allowed to query WMI. A local administrator account other than the built-in Administrator can be refused because of remote token filtering. For domain sign-in with Kerberos, the hub must reach a domain controller and its clock must match the domain.
Test from the hub server
| Protocol | Test |
|---|---|
| SNMP | snmpwalk -v2c -c <community> <ip> 1.3.6.1.2.1.1.1.0 (needs the net-snmp tools) |
| SSH | nc -vz <ip> 22 or ssh -p 22 <user>@<ip> |
| WMI | nc -vz <ip> 5986, nc -vz <ip> 5985, nc -vz <ip> 135. On a Windows hub use Test-NetConnection <ip> -Port 5986. A port check does not prove the account works, so run a real scan against one device. |
For the credentials each protocol needs, see Discovery Credential Sets.



.png)




























