TO UNSUBSCRIBE: email "unsubscribe issforum" in the body of your message to
[EMAIL PROTECTED] Contact [EMAIL PROTECTED] for help with any problems!
----------------------------------------------------------------------------
"Hausfeld, Tim S." wrote:
>
> We are trying to scan (using ISS) multiple (less than 50) hosts on our
> customer's network. We initially use PING/TRACERT to verify that we can see
> the boxes and we get good (although sometimes long) responses from them.
> When we enter the IP addresses in to ISS, and kick off the session, we get
> no errors. When we try to actually scan, we get "host unreachable" messages
> from ISS. Has anyone run in to this condition before, and are there any
> work-arounds for it? Thanks for your help.
I've got an incident open now for something similar but its for a much
larger scan population...several hundred to over a thousand. I'm also
letting ISS ping the hosts to scan in the GUI or creating a host file
with the hostping utility in the command line scans. Initial workaround
was to click the "scan if ping fails" in the main configuration. This
seemed to work for a while and then suddenly quit. (Not exactly suddenly,
I didn't use the scanner for large scans for a couple weeks and may have
installed an express update during that time. And come to think of it,
I haven't retried the command line scans although the "scan if ping fails"
configuration options enabled me to perform some large scans through
the GUI earlier. I'll have to double check.) When the problem happens,
a scan will fill the queue but some time after individual scans complete
and others start, all of a sudden all further systems are "unreachable"
even though I can sit on the same system and ping them fine. All local
area network stuff.
I sent some log files off and I've got to try some things that
ISS suggested:
"When you open up Internet Scanner, are all of your exploits
loading properly? In the session.log it does not seem to be the case.
Hence the 0x080004005 error messages. When you installed IS 6.1 did you
install over the top of IS 6.0.1? If so did you remove the old Raw Packet
Driver?
I would recommend first, checking to see if all of your exploits are
loading. This can be found upon starting up scanning in the General box at
the bottom of the screen. If they are not, uninstall your XPUs, re-apply
your key, and then re-install the XPress Updates. "
I've been giving presentations all day and am in a meeting all day tomorrow
so I won't likely get to try this soon.
--
Gary Flynn
Security Engineer - Technical Services
James Madison University
Please R.U.N.S.A.F.E.
http://www.jmu.edu/computing/info-security/engineering/protecting_yourself.shtml
