Re: Strange Nessus Behavior

[Renaud Deraison <deraison@nessus.org>]

Hi,

On Dec 20, 2006, at 3:53 PM, Steven Adair wrote:

> To recap from above:
>
> Issue 1: Using just a scanner plugin and 1 port.. Nessus seems to scan
> multiple other ports for no reason.  Why is this?
Probably because ping.nasl is enabled anyways due to the dependencies.
To disable ping, you should disable ICMP and TCP pings from Prefs- 
>Advanced->Ping Options
> Issue 2: Even if the host is dead and/or no ports are open Nessus  
> still
> runs the same vulnerability checks on it.  Why is this and can we  
> disable
> this?
This is happening because nessusd only knows about the status of port  
8888 -- maybe port 445 is wide open, maybe it's not. We can't tell  
because you chose not to scan it.
So what nessusd does is that it attempts to connect to that port, and  
when the attempt eventually times out, it marks it as being a port  
not to connect to in the future. Since there are plenty of plugins,  
it still takes some time.
To avoid this, enable the option 'Consider unscanned ports as closed'  
and try again. Some UDP checks will still take place, though.
                                        -- Renaud
_______________________________________________
Nessus mailing list
Nessus@list.nessus.org
http://mail.nessus.org/mailman/listinfo/nessus