Hello.
I have an interesting issue with Nessus running on a Sun box. It's behind a firewall on the same network as another Nessus server installed on Linux which appears to work ok. Both boxes have the same iptables firewalling rules. The Sun box seems to give up trying to scan something very quickly, although to be fair the host in the log extract below cannot be pinged. I can still do this: jbaker@moo:~ > ping www.argos.co.uk no answer from www.argos.co.uk jbaker@moo:~ > telnet www.argos.co.uk 80 Trying 129.35.77.19... Connected to www.argos.co.uk. Escape character is '^]'. So surely nmap should have picked something up? Anyway, if someone could give me some pointers then I'd be most grateful. Oh, I'm running this from the client: jbaker@moo:/tmp > nessus -T xml -q localhost 1241 UsEr password source reslts.xml [Tue Jan 21 08:58:34 2003][3083] Communication closed by client [Tue Jan 21 09:02:12 2003][539] connection from 127.0.0.1 [Tue Jan 21 09:02:12 2003][3108] Client requested protocol version 12. [Tue Jan 21 09:02:12 2003][3108] successful login of UsEr from 127.0.0.1 [Tue Jan 21 09:02:23 2003][3108] Redirecting debugging output to /usr/local/var/nessus/logs/nessusd.dump [Tue Jan 21 09:02:25 2003][3108] user UsEr starts a new attack. Target(s) : www.argos.co.uk, with max_hosts = 30 [Tue Jan 21 09:02:25 2003][3108] user UsEr : testing www.argos.co.uk [3109] [Tue Jan 21 09:02:25 2003][3109] user UsEr : new KB will be saved as /usr/local/var/nessus/users/UsEr/kbs/www.argos.co.uk [Tue Jan 21 09:02:25 2003][3109] user UsEr : will launch 10 plugins at the same time against each host [Tue Jan 21 09:02:25 2003][3109] user UsEr : launching ping_host.nasl against www.argos.co.uk [3110] [Tue Jan 21 09:02:39 2003][3109] ping_host.nasl (process 3110) finished its job in 14.283 seconds [Tue Jan 21 09:02:39 2003][3109] user UsEr : launching nmap_wrapper.nes against www.argos.co.uk [3111] [Tue Jan 21 09:02:39 2003][3109] user UsEr : The remote host (www.argos.co.uk) is dead [Tue Jan 21 09:02:39 2003][3109] Finished testing www.argos.co.uk. Time : 14.67 secs [Tue Jan 21 09:02:39 2003][3108] user UsEr : test complete [Tue Jan 21 09:02:39 2003][3108] user UsEr : Kept alive connection [Tue Jan 21 09:02:40 2003][3108] Communication closed by client I haven't altered my .nessusrc file. Should I be? Please note I've only used argos.co.uk as an example, I'm not trying to do anything nasty to it :-) John -- John Baker, BSc CS. Java Developer, TEAM EAA.. http://www.teamenergy.com Views expressed in this mail are my own.
