Re: Nessus reports all ports open

On Sat, 22 Dec 2007 02:31:10 +0200
"Ali Jawad" <alijawad1@gmail.com> wrote:

> I tried the netstat scanner ..

There is no way that netstat can report all ports open, unless you
found a very odd bug (you'd be the first to see it).
However, if you select multiple port scanners, the results are
_merged_. If a portscanner is confused and reports all ports as open,
then the other scanners are useless.

Disable all scanners but nessus_tcp_scanner, and run Nessus against
127.0.0.1 (localhost). That way, we'll see if it is a mysterious bug or
not.

> the nessus tcp scanner and I tried multiple hosts with the same results.

I think there is a Labrea or some facetious IPS on your network.
If the targets are on the same physical network, you can check who
sends the packets by sniffing the network traffic: look at the Ethernet
addresses.

By the way, when you scan a whole network, do you find all IP up or
only some of them?

You did not give any information on your configuration: OS, Nessus
version, etc.

_______________________________________________
Nessus mailing list
Nessus@list.nessus.org
http://mail.nessus.org/mailman/listinfo/nessus