1. Help
  2. Asset Management & CMDB
  3. Native Discovery
  4. Prerequisites for SNMP, SSH and WMI
  1. Help
  2. Asset Management & CMDB
  3. Native Discovery
  4. Prerequisites for SNMP, SSH and WMI
purple icon for coordination.
We’ve moved!
Our Help Center has a new home and our URLs have changed. Please update your bookmark to this page before April 30, 2026

Prerequisites for SNMP, SSH and WMI

What the infrastructure team must open and configure before the first scan.

All connections start at the hub's server, not at Xurrent and not at your computer. If a device can be reached from your laptop but not from the hub server, discovery will fail for that device. Run every test below on the hub server.

Network access

ConnectionPortNotes
SNMP, hub to deviceUDP 161, or the port in the credential setConnectionless. Check the return path through stateful firewalls and endpoint security.
SSH, hub to deviceTCP 22, or the port in the credential setAllow the hub's address specifically.
WMI over WinRM, hub to deviceTCP 5986 (HTTPS, preferred) and TCP 5985 (HTTP)The hub prefers the encrypted listener.
WMI over DCOM, hub to deviceTCP 135 and the dynamic RPC range (49152 to 65535 by default)Used only where the hub's own operating system supports it.
Hub to XurrentOutbound HTTPS (TCP 443)No inbound rule is required.

Setting up each device type

  • SNMP devices. Enable the SNMP agent and add the hub server's address to the device's allow list. Match the community string, or the v3 user, authentication and privacy settings, to the credential set. Widen the SNMP view if the device hides its system information.
  • Linux and macOS. Make sure the SSH service is running and the account may log in. On macOS, turn on Remote Login in System Settings > General > Sharing. If the account must use sudo, allow it without a password for the discovery commands only. The first time the hub reaches a host it remembers the host's SSH key. If the host is rebuilt, the hub withholds the password until the new key is accepted on the hub server with xt-hub accept-host-key <address> <fingerprint>.
  • Windows. Enable WinRM with a listener, ideally HTTPS with a certificate the hub trusts. Use an account that is a member of local Administrators, or of Remote Management Users for scoped non-administrator access, and that is allowed to query WMI. A local administrator account other than the built-in Administrator can be refused because of remote token filtering. For domain sign-in with Kerberos, the hub must reach a domain controller and its clock must match the domain.

Test from the hub server

ProtocolTest
SNMPsnmpwalk -v2c -c <community> <ip> 1.3.6.1.2.1.1.1.0 (needs the net-snmp tools)
SSHnc -vz <ip> 22 or ssh -p 22 <user>@<ip>
WMInc -vz <ip> 5986, nc -vz <ip> 5985, nc -vz <ip> 135. On a Windows hub use Test-NetConnection <ip> -Port 5986. A port check does not prove the account works, so run a real scan against one device.

For the credentials each protocol needs, see Discovery Credential Sets.