Re: Where are packet captures saved?

David,

What OS are you running your Nessusd on?  On Linux the scans are saved in /opt/nessus/var/nessus/tmp. If I recall correctly, on Windows they're 
saved in: C:\Program Files\Tenable\Nessus\tmp (if not there, they're pretty easy to find because they're named something like: scan-trace-<ip>...

You can definitely open them in Wireshark for examination. Check out this blog entry for more info:

http://blog.tenablesecurity.com/2007/09/creating-packet.html

Paul

Jones, David H wrote:
> There's an option on the Nessus client to "save a packet capture of the
> scan"... I'm wondering where the heck that gets saved to.  I can't seem
> to find anything in the documentation.
> 
> Also, is it stored in a standard .cap format, so I can read it with
> something like Wireshark?
> 
> Thanks!
> 
> 
> 
> David Jones
> Principal Financial Group
> I/S Information Security
> 711 High Street
> Des Moines, IA 50392-0257
> 
> Email:  [email protected]
> Phone:  515.362.2224 
>  
> 
> 
> -----Message Disclaimer-----
> 
> This e-mail message is intended only for the use of the individual or
> entity to which it is addressed, and may contain information that is
> privileged, confidential and exempt from disclosure under applicable law.
> If you are not the intended recipient, any dissemination, distribution or
> copying of this communication is strictly prohibited. If you have
> received this communication in error, please notify us immediately by
> reply email to [email protected] and delete or destroy all copies of
> the original message and attachments thereto. Email sent to or from the
> Principal Financial Group or any of its member companies may be retained
> as required by law or regulation.
> 
> Nothing in this message is intended to constitute an Electronic signature
> for purposes of the Uniform Electronic Transactions Act (UETA) or the
> Electronic Signatures in Global and National Commerce Act ("E-Sign")
> unless a specific statement to the contrary is included in this message.
> 
> While this communication may be used to promote or market a transaction
> or an idea that is discussed in the publication, it is intended to provide
> general information about the subject matter covered and is provided with
> the understanding that The Principal is not rendering legal, accounting,
> or tax advice. It is not a marketed opinion and may not be used to avoid
> penalties under the Internal Revenue Code. You should consult with
> appropriate counsel or other advisors on all matters pertaining to legal,
> tax, or accounting obligations and requirements.
> 
> _______________________________________________
> Nessus mailing list
> [email protected]
> http://mail.nessus.org/mailman/listinfo/nessus
> 

-- 
Best Regards,

Paul Davis
Research Engineer
Tenable Network Security Inc
Phone: 410.872.0555 x245
www.tenablesecurity.com

Is your network TENABLE?
_______________________________________________
Nessus mailing list
[email protected]
http://mail.nessus.org/mailman/listinfo/nessus