Nessus
[Top] [All Lists]

multiple port scans

To: nessus@list.nessus.org
Subject: multiple port scans
From: Tim Rupp <tarupp@fnal.gov>
Date: Tue, 03 Apr 2007 08:12:25 -0500
Delivered-to: sp-com-lists@consult.net
Delivered-to: nessus-list1@securepoint.com
Delivered-to: nessus@list.nessus.org
List-archive: <http://mail.nessus.org/pipermail/nessus>
List-help: <mailto:nessus-request@list.nessus.org?subject=help>
List-id: Discussion of Nessus software <nessus.list.nessus.org>
List-post: <mailto:nessus@list.nessus.org>
List-subscribe: <http://mail.nessus.org/mailman/listinfo/nessus>, <mailto:nessus-request@list.nessus.org?subject=subscribe>
List-unsubscribe: <http://mail.nessus.org/mailman/listinfo/nessus>, <mailto:nessus-request@list.nessus.org?subject=unsubscribe>
Sender: nessus-bounces@list.nessus.org
User-agent: Thunderbird 2.0b2 (X11/20070116)
Using Nessus 3.0.4 to scan 5 machines, in the scan output that is sent back while the scan is running, I see 4 blocks of portscans scanning the same ports, so port 1234 here...wait a bit, then port 1234 again...wait a bit, etc. Is this expected behavior? Here's my scanner set.

begin(SCANNER_SET)
 10180 = no
 10278 = no
 10331 = no
 10335 = yes
 10841 = no
 10336 = no
 10796 = no
 11219 = no
 14259 = no
 14272 = no
 14274 = no
 14663 = no
 11840 = no
end(SCANNER_SET)


Do those plugins also need to be set to "no" in the plugin set? And why are some of those plugins, like 10278, even included in the scanner set? Searching on nessus.org shows that plugin to be Sendmail 8.6.9 ident overflow check.

Thanks in advance,
Tim
_______________________________________________
Nessus mailing list
Nessus@list.nessus.org
http://mail.nessus.org/mailman/listinfo/nessus

<Prev in Thread] Current Thread [Next in Thread>
  • multiple port scans, Tim Rupp <=