I have done some performace testing using up to two /24 subnets (with one
invocation of nessus via commandline). This in preparation for ultimately
(regularly) scanning 50,000+ network devices. I'm using Nessus 1.1.10 in
Linux, with a preconfigured .nessurc. I could repeatedly get hung GUI
sessions, but using the commandline has seemed to have cleared that up.
I'm aiming to automate the scan process, so I want as little involvement
in their taking place as possible.
I had trouble with nmap (not nessus) trying to portscan a host on the
network which would dynamically add a firewall rule to drop packets when
it determined it was being scanned. To get around this I set:
Nmap[radio]:Timing policy : = Insane
in my nessusrc. I haven't yet determined if this is negatively affecting
results.
____________________________________________________________________________
Michael Hornung, University Computing Services, Computing & Communications
Email: [EMAIL PROTECTED] Phone: 206.221.4634 Fax: 206.221.6966
PGP Public Key 0x82B06992 = http://staff.washington.edu/hornung/key.html
On Thu, 27 Dec 2001 at 11:22, Michael Scheidell wrote:
|I am wondering if anyone has run nessus on large networks, where you ran a
|concurrent scan on a network with 500 active hosts
|(one scan, not multiple scans)
|
|Can you tell me if it completed? in /var/log/messages, how many times did
|nmap core dump?
|
|The reason I ask, is on FREEBSD 4.3, on nessus 1.09, I got lots of core
|dumps on plugins, nmap and nessusd.
|Also, it seems to 'go to sleep' and not finish (I suspect the broken
|libpcap, which is fixed in 1.11)
|
|On 1.11, less (almost no) core dumps, but it will panic and crash FBSD
|4.3-RELEASE and 4.4 Release.
|kernel dumps seems to indicate something in the vm section.
|
|So, anyone run ONE scan on 500+ ACTIVE hosts?
|
|-
|Michael Scheidell
|Secnap Network Security, LLC
|[EMAIL PROTECTED] 1+(561) 368-9561
|See updated IT Security News at http://www.fdma.com/
|
|
|
