Re: dns_fingerprint.nasl - silent exit after 3 timeouts, why?

On Wed, Jul 21, 2004 at 10:57:55PM +0200, Pavel Kankovsky wrote:
> On Tue, 20 Jul 2004, Martin Ma?ok wrote:
> 
> > I have come across some DNS server (probably LAN Suite 602 on Windows
> > server, but who knows...) that was not fingerprinted by Nessus, nor it
> > was a message in the report that it couldn't be fingerprinted etc.
> 
> I think the most annoying part of this was the fact the plugin exited
> silently (and this is a "feature" of many other plugins). I think all
> those occurences of exit(0) should be replaced with
> exit("unable to open connection") or exit("too many timeouts") etc.
> and Nessus should write those messages to its log (and perhaps,
> optionally, include them in the report).

We are heading this way thanks to global_settings.inc. I receive too
many complaints already of "useless output" (like the service banners),
so adding a message per failing plugin is not an option.

Besides, in that particular case we _know_ that not everything can be
fingerprinted reliably. Adding an extra message to emphasize this fact
is not a good idea.

> On Wed, 21 Jul 2004, Renaud Deraison wrote:
> 
> > Not really. If you consider it acceptable for every plugin to take over
> > two minutes, then a scan can basically take several days per host.
> 
> This depends on the level of parallelism. In fact, the plugin in question
> itself is highly parallelizable because it makes no sense to wait several
> seconds until one query times out before you send another query.

Yes and no. The plugin you are talking about is a real special case
because it's UDP and stateless. If you start to highly parallelize TCP
plugins (80% of the network-based checks), you end up crashing embedded
devices and old Solaris boxes.


				-- Renaud
_______________________________________________
Nessus-devel mailing list
[email protected]
http://mail.nessus.org/mailman/listinfo/nessus-devel