On Wednesday 02 January 2002 09:22 am, Nathan Valentine wrote:
> It is not clear to me what, if anyting, the nessus-devel list is being
> used for so please feel free to cluebat me if this email should have
> been sent to nessus-devel.
> filter = string("ip and src host ", get_host_ip());
> Is it not possible that the ICMP pkt that is received could be a Host
> Unreachable or Network Unreachable and thus the script could get a false
> positive on whether or not the host is up because it checks only for the
> presence of a 'reply' packet and not whether:
>
> 1) The pkt is an ICMP packet.
> 2) The pkt is an Echo Reply?
The pcap filter will only match packets coming from the target host,
unreachable messages normally originate from a router upstream of the target,
so they would not be caught by the filter. However, the pcap filter matches
_any_ packet coming back from the target system, so traffic caused by another
plugin running parallel (or just other traffic on shared media) would cause
this to trigger falsely. None of that seems to matter in this case because
the ping plugin is only trying to determine if the host is online, so the
occurance of any packet coming in from that host would signify that it was
up, although not guarantee that it answers to icmp echo requests ;)
-HD
