Ethical Hacking

Learn to find vulnerabilities before the bad guys do! Gain real world hands on hacking experience in our state of the art hacking lab. Course designed and taught by expert instructors with years of penetration testing experience. 12 student maximum in every class. Certification attempt included in every package.
Computer Forensics Training at InfoSec Institute

Gain the in-demand skills of a certified computer examiner, learn to recover trace data left behind by fraud, theft, and cybercrime perpetrators. Discover the source of computer crime and abuse at your organization so that it never happens again. All of our class sizes are guaranteed to be 12 students or less to facilitate one-on-one interaction with one of our expert instructors.




Network Security Nessus-Users
[Top] [All Lists]

Re: Port scan

Subject: Re: Port scan
Date: Tue, 23 Jan 2007 23:39:54 +0100
If this target IP really _drops_ all packets, definitely not. I'll
double check and keep you in touch anyway.

I scanned an IP with only 2 open ports on my LAN and all the other
ports _dropped_: it takes 1min20s for 65k ports.

But if I scan an IP that sends back ICMP from time to time, the scanner
slow down dramatically. It took nearly 4 min for 111 ports, i.e. one
day and half for a full scan. *However* my 2nd test was a worst case
situation: the target was an unexisting IP, and a Linux gateway sent
back ICMP "unreachable network". Normally, Nessus tries to estimate the
RTT (ping time) to optimize the speed.
Anyway, when the scanner receives ICMP, it seems that it computes a
wrong RTT. I suspect that somehow, the Linux gateway bufferizes the ICMP
packets.

When the scanner receives scarce ICMP (or RST, if that could happen),
it slows down and reruns passes (because this could be the symptom of
an overloaded link). It gives up after 16 passes.
There is no clean way to handle this case. 

_______________________________________________
Nessus mailing list
Nessus@list.nessus.org
http://mail.nessus.org/mailman/listinfo/nessus

<Prev in Thread] Current Thread [Next in Thread>