Ethical Hacking Learn to find vulnerabilities before the bad guys do! Gain real world hands on hacking experience in our state of the art hacking lab. Course designed and taught by expert instructors with years of penetration testing experience. 12 student maximum in every class. Certification attempt included in every package. | Computer Forensics Training at InfoSec Institute Gain the in-demand skills of a certified computer examiner, learn to recover trace data left behind by fraud, theft, and cybercrime perpetrators. Discover the source of computer crime and abuse at your organization so that it never happens again. All of our class sizes are guaranteed to be 12 students or less to facilitate one-on-one interaction with one of our expert instructors. |

| Subject: | Re: Port scan |
|---|---|
| Date: | Tue, 23 Jan 2007 23:39:54 +0100 |
If this target IP really _drops_ all packets, definitely not. I'll double check and keep you in touch anyway.
I scanned an IP with only 2 open ports on my LAN and all the other ports _dropped_: it takes 1min20s for 65k ports. But if I scan an IP that sends back ICMP from time to time, the scanner slow down dramatically. It took nearly 4 min for 111 ports, i.e. one day and half for a full scan. *However* my 2nd test was a worst case situation: the target was an unexisting IP, and a Linux gateway sent back ICMP "unreachable network". Normally, Nessus tries to estimate the RTT (ping time) to optimize the speed. Anyway, when the scanner receives ICMP, it seems that it computes a wrong RTT. I suspect that somehow, the Linux gateway bufferizes the ICMP packets. When the scanner receives scarce ICMP (or RST, if that could happen), it slows down and reruns passes (because this could be the symptom of an overloaded link). It gives up after 16 passes. There is no clean way to handle this case. _______________________________________________ Nessus mailing list Nessus@list.nessus.org http://mail.nessus.org/mailman/listinfo/nessus
| <Prev in Thread] | Current Thread | [Next in Thread> |
|---|---|---|
| ||
| Previous by Date: | Re: Port scan, Michel Arboi |
|---|---|
| Next by Date: | selecting custom nessus plugins, Shingari, Nitin V. |
| Previous by Thread: | Re: Port scan, Michel Arboi |
| Next by Thread: | Re: Port scan, Renaud Deraison |
| Indexes: | [Date] [Thread] [Top] [All Lists] |