Re: Varying results from scans

--- "Jesper S. Jensen" <jesper.skou.jensen@uni-c.dk> wrote:

> Josh Zlatin-Amishav wrote:
> > On Mon, 20 Feb 2006, Ameet Zaveri wrote:
> > > How do I go about debugging this situation? In looking at
> the
> > > message log on the server side I noticed the following. It
> said
> > > "Not launching openssl_denial.nasl against xx.xx.xx.197
> none of
> > > the required tcp ports are open (this is not an error)" for
> the
> > > host where it did not find the hole. But it said "launching
> > > openssl_denial.nasl against xx.xx.xx.198 [1060]" for the
> similar
> > > host where it found the hole.
> >
> > Which port scanner[s] are you using?
>
> And are you behind a firewall, that might start dropping
> packages while 
> you are portscanning? That way you sometimes get results of a
> open port 
> and other times you don't.
>
> I know firewalls like in Cisco IOS based routers get
> aggressive and 
> start dropping packages, if there are more than xxxx packages
> / second 
> from a given host. Maybe that's the case here?
>
> -- 
>
>    Jesper S. Jensen

Yes, we are behind a firewall. I am going to try a run with
delays between scans for each host to see if that is a
workaround for this issue.

Is aggressive firewalls a known issue? Are there recommended
workarounds for this? 


__________________________________________________
Do You Yahoo!?
Tired of spam?  Yahoo! Mail has the best spam protection around 
http://mail.yahoo.com 
_______________________________________________
Nessus mailing list
Nessus@list.nessus.org
http://mail.nessus.org/mailman/listinfo/nessus