Re: [ISSForum] Internet Scanner on a Xeon processor

[Chuck Jackson]

Michael,
        Just because you may be running a large number of hosts does not mean you have to scan most of them simultaneously. You may want to try going into the TOOLS/OPTIONS menu and lowering the "Threads" and "Connections" amounts to a reasonable number. This MAY help. It is worth a try.

chuck



At 09:17 AM 2/6/03 -0600, Wisniewski, Michael wrote:

Hi!
 
    We recently upgraded our scanning machine to an Intel Xeon 2.6 Ghz processor with 2 gigs of DDR Memory and an Intel Pro/1000 Gigabit Server Network Adapter.  The problems that we seem to have is that when during a somewhat larger scan (over 255 hosts), ISS_WINNT will crash with an exception error.  I've tried to uninstall and re-install but no luck.  I even re-installed the operating system (Win2k Professional), but I still get the messages.  Here is part of the log file from "isstrace.log" in the ISS directory.  I contacted ISS tech support but it wasn't really much help.  If anybody has any ideas, I would appreciate it!  Thank You!
 
 
Mike
 
 
----...isstrace.log...---
 
16:36:16.93 T:0968 builtineng_3 The vulnerability check ID "8192" executed by the built-in engine raised a system exception.
 ******************** Exception Information ********************
 Exception code = 0xc0000005, Address = 0x60234233, Thread ID = 0x968
Register Contents:
 
EAX = 07da5ca7   EBX = 00000044   ECX = 1188eb48   EDX   = da5ca807
EDI = 07da5ca7   ESI = 0e455e44   EBP = 1188eb3c   ESP   = 1188eb2c
DS  = 00000023   ES  = 00000023   FS  = 0000003b   GS    = 00000000
CS  = 0000001b   SS  = 00000023   EIP = 60234233   Flags = 00010297
 
Address    Frame     Return    Arg 1     Arg 2     Arg 3     Arg 4     Module
60234233  1188eb3c  60233aee  1188eb54  07da5ca7  07da5ca8  0e455dd8  HackedUsersFree+2f66c
60233aee  1188eb70  60234ea7  1188ee40  602342c9  00000001  1188f5b8  HackedUsersFree+2ef27
60234ea7  1188eb9c  6020db44  77e8ed1a  0e3ed228  00000000  00000003  HackedUsersFree+302e0
6020db44  1188ee6c  60209d36  77e8ed1a  00001000  000a4fb5  602b4a28  HackedUsersFree+8f7d
60209d36  118>>>
16:36:16.93 T:06a8 App Host "<ip>" has been terminated by exception.
 A vulnerability check being run against this host has failed due to an operating system exception.
 Try to run this policy again. If unsuccessful, send your log files to [EMAIL PROTECTED] for further assistance.
 
---------------------------------------------------------------
Michael Wisniewski
Cyber Security Analyst
Argonne National Laboratory
 

Chuck Jackson

Information Technology Security

NASA Langley Research Center

(757) 864-7410

[EMAIL PROTECTED]

[EMAIL PROTECTED]

(757) 864-4200