----- Original Message ----- From: "Hugh Brown" <[EMAIL PROTECTED]> To: "'Michael Scheidell'" <[EMAIL PROTECTED]>; <[EMAIL PROTECTED]> Sent: Thursday, December 27, 2001 12:36 PM Subject: RE: Anyone run nessus on a large (500 host) network?
> Michael, > > I have never been able to get a large scan like that to complete. I > always get the core dump/hung process routine so I haven't tried in a > while, but I get the same results you do. I run it on an Ultra 10 > Solaris 8 box so hardware shouldn't be an issue. I've taken to limiting > my scans to 1 subnet at a time and running them with cron or by hand. I > use nmap to generate a list of "active" hosts, chop it up with VI and > feed that into nessus. > What version of nessus? the 'hung' processes (where it looks like a run/select/run/select/ MIGHT be a broken libpcap (which nmap 1.11 fixes) My scans on 1.09 'hung' (top shows 100% idle, almost) 1.11 would panic the kernel I seriously doubt that nessus is totally at fault (1.11 exercises the kernel/ram/drivers a lot) But, I am starting to suspect both copies of libpcap: the one distributed on os, and the fixed one in the nessusd 1.11 distribution. Either that, or some nex plugin is doing enough strange stuff to the raw socket that the world ends. If running nessus 1.11, have you tried ./configure (whatever) /usr/solaris/libpcap? intead of the default to use the fixed libpcap? Also, on that 500+ scan, do you have a lot of nt/win2k systems? is the smb_browse_list big? (like > 165 hosts)? -- Michael Scheidell Secnap Network Security, LLC [EMAIL PROTECTED] 1+(561) 368-9561 See updated IT Security News at http://www.fdma.com/
