But presumably suffers from the disadvantage that if a machine is compromised
and netstat is replaced in order to hide trojan ports then that will not be
detected...
-----Original Message-----
From: Michel Arboi [mailto:mikhail@nessus.org]
Sent: 17 August 2004 11:47
To: nessus@list.nessus.org
Subject: netstat scanner
Those who are running the CVS version of Nessus should be able to test
netstat_portscan.nasl
This plugin uses netstat to get the list of open ports. Either by
connecting on the netstat port (15) or by using SSH.
- this is quicker than anything else, even snmpwalk
- this is the lest dangerous scanner:
- TCP scanners (e.g. nmap -sT) may crash broken services,
- nmap -sN or -sX may crash broken IP stacks,
- SYN scanners (nmap -sS) may overload the machine? and may crash
broken IP stacks?
- snmpwalk crashes buggy versions of IBM HACMP cluster.
- but just like snmpwalk, it may report open ports that are protected
by an IP filter.
--
arboi@alussinan.org http://arboi.da.ru
FAQNOPI de fr.comp.securite http://faqnopi.da.ru/
NASL2 reference manual http://michel.arboi.free.fr/nasl2ref/
_______________________________________________
Nessus mailing list
Nessus@list.nessus.org
http://mail.nessus.org/mailman/listinfo/nessus
__________________________________________________________________________
This e-mail and the documents attached are confidential and intended
solely for the addressee; it may also be privileged. If you receive this
e-mail in error, please notify the sender immediately and destroy it.
As its integrity cannot be secured on the Internet, the Atos Origin group
liability cannot be triggered for the message content. Although the
sender endeavours to maintain a computer virus-free network, the sender
does not warrant that this transmission is virus-free and will not be
liable for any damages resulting from any virus transmitted.
__________________________________________________________________________
_______________________________________________
Nessus mailing list
Nessus@list.nessus.org
http://mail.nessus.org/mailman/listinfo/nessus
