Re: better timeout values for WAN-based scans?
Jason Haar <[email protected]>
| Newsgroups | gmane.comp.security.nessus.general |
|---|---|
| Organization | Trimble Navigation Ltd. |
| Message-ID | <[email protected]> |
Renaud Deraison wrote: > > use_kernel_congestion_detection = yes > reduce_connections_on_congestion = yes > > Sorry - I forgot to mention I don't think this is a congestion problem. This is a "lite" scan - just hitting the NetBIOS ports and doing Registry and WMI checks. So I don't think it's generating a lot of traffic (?but what would I know). But I am getting this issue where a given remote LAN now produces a report containing a mixture of "untrustworthy" host data and "good" host data - even though all the hosts are in the same domain,etc. I've just checked the nessus.messages file again - and I am actually getting "killing" errors (some webpage on Google told me to look for "killed" - but I should have been looking for "killing"). They are all against smb_hotfixes.nasl e.g. [Thu Aug 21 20:34:49 2008][19296] user apache : launching smb_hotfixes.nasl against 10.1.82.45 [73] [Thu Aug 21 20:41:50 2008][19296] smb_hotfixes.nasl (pid 73) is slow to finish - killing it [Thu Aug 21 20:41:50 2008][19296] user apache : launching smb_nt_ms04-008.nasl against 10.1.82.45 [74] That's a seven minute timeout - that's quite long. Hmmm, the remote site this scan is to do with is a T1 low-latency (US to US) link - this can't be congestion or WAN delays...? Any other ideas? Now I'm thinking this isn't a network problem, but rather that some machines are in "a weird state"? I have just successfully (under Windows) used "Manage Computer" and a WMI tool against this box - so as far as Windows is concerned, it is "perfectly fine". This is now sounding like Nessus isn't doing the same tricks Windows can do - and is basically failing against some boxes? -- Cheers Jason Haar Information Security Manager, Trimble Navigation Ltd. Phone: +64 3 9635 377 Fax: +64 3 9635 417 PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1 -- Cheers Jason Haar Information Security Manager, Trimble Navigation Ltd. Phone: +64 3 9635 377 Fax: +64 3 9635 417 PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1 _______________________________________________ Nessus mailing list [email protected] http://mail.nessus.org/mailman/listinfo/nessus