I've been using only stable versions on my scans. 1.0.9 is the current one I'm using. I haven't monkeyed with the libpcap...only set my library path to /usr/local/lib. It's been one of those thing's I've always meant to do, but never seem to get to it. I have > 200 windows hosts on my network, mostly nt or 2k. When I first started using nessus, I would punch in all of the 14 or so subnets I wanted to scan and run it. It would hang exactly as you describe roughly 3/4 of the way through the scan. My top would look exactly the same as yours, and there'd be some nessus processes just sitting there.
One other thing that I've noticed is that the scans in general seem to take longer under Solaris than they do under Linux. I also had a problem with ip's that were not active...Nessus will actually try to run all the selected plugin's against the ip. It will not recognize that there is no machine there and skip the ip. This combined with the attempts to complete 1 scan on all my subnets prompted me to chop up my network into smaller scans and use the nmap approach. If there's anything you'd like me to try, I'd be happy to do so. Hugh Hugh Brown Computer Support Group National High Magnetic Field Laboratory 1800 East Paul Dirac Drive Tallahassee, Florida 32310 850-644-3980 [EMAIL PROTECTED] -----Original Message----- From: Michael Scheidell [mailto:[EMAIL PROTECTED]] Sent: Thursday, December 27, 2001 12:44 PM To: Hugh Brown; [EMAIL PROTECTED] Subject: Re: Anyone run nessus on a large (500 host) network? ----- Original Message ----- From: "Hugh Brown" <[EMAIL PROTECTED]> To: "'Michael Scheidell'" <[EMAIL PROTECTED]>; <[EMAIL PROTECTED]> Sent: Thursday, December 27, 2001 12:36 PM Subject: RE: Anyone run nessus on a large (500 host) network? > Michael, > > I have never been able to get a large scan like that to complete. I > always get the core dump/hung process routine so I haven't tried in a > while, but I get the same results you do. I run it on an Ultra 10 > Solaris 8 box so hardware shouldn't be an issue. I've taken to > limiting my scans to 1 subnet at a time and running them with cron or > by hand. I use nmap to generate a list of "active" hosts, chop it up > with VI and feed that into nessus. > What version of nessus? the 'hung' processes (where it looks like a run/select/run/select/ MIGHT be a broken libpcap (which nmap 1.11 fixes) My scans on 1.09 'hung' (top shows 100% idle, almost) 1.11 would panic the kernel I seriously doubt that nessus is totally at fault (1.11 exercises the kernel/ram/drivers a lot) But, I am starting to suspect both copies of libpcap: the one distributed on os, and the fixed one in the nessusd 1.11 distribution. Either that, or some nex plugin is doing enough strange stuff to the raw socket that the world ends. If running nessus 1.11, have you tried ./configure (whatever) /usr/solaris/libpcap? intead of the default to use the fixed libpcap? Also, on that 500+ scan, do you have a lot of nt/win2k systems? is the smb_browse_list big? (like > 165 hosts)? -- Michael Scheidell Secnap Network Security, LLC [EMAIL PROTECTED] 1+(561) 368-9561 See updated IT Security News at http://www.fdma.com/
