Re: Restore Sessions vs. Manage Reports on Server

On Thu, Nov 04, 2004 at 10:07:48AM +0100, Jan-Oliver Wagner wrote:
> But as far as I read the code of the client, all the current paramters
> are send to the server for this "restoring".
> Unfortunately there is no guarantee that these are the same parameters
> used to initially start the scan.
> So, I get the feeling that the design of this feature is somehow broken.
> 
> I really need some discussion about this feature to improve the client!

Session saving was some kind of attempt to protect the user against a
connection loss and to change parameters "on the fly". Ie: you start to
scan 10.0.0.0/16, and after 50mn of scanning you realize that things
would be faster if you had not enabled three port scanners but one.
Instead of stopping the scan, disabling two port scanners, and
restarting from scratch, you can restore the session with the new
parameters.

So in that regard, the design is not really broken, but it does not
prevent you from shooting yourself in the foot.


That being said, I'm considering getting rid of session saving
altogether. Not many people use them, it's an under-tested feature,
session restoration is quite slow, and I'd like to simplify the source
code of nessusd as much as possible. 

So I'd advise you to leave that part alone for the moment. At worse,
I'll re-implement it "correctly" in the future, but at this time it
just gets in the way.



				-- Renaud
_______________________________________________
Nessus-devel mailing list
[email protected]
http://mail.nessus.org/mailman/listinfo/nessus-devel