On Fri, Jan 24, 2003 at 04:31:10PM +0100, Lukas Sosnovec wrote: > I tried George Theall's update-nessusrc script
It might be better to take this off-list as this isn't necessarily
nessus-specific.
> On my nessus server box I started packet sniffer. Server and
> client send aprox. 20 packets and after it server sent FIN to client,
> client responened ACK and connection freezed in FIN_WAIT_2 state.
Let me ask:
- What versions of nessus (client and server) and perl are you running?
Which unix (vendor / version) are you running on the client?
- What happens if you run "nessus -c <your_rcfile> -qp <your_server>
<your_port> <your_username> <your_password>" from the client box?
- What do you see if you run update-nessusrc with the debug option
(ie, "-d") in addition to any other arguments you might be
using?
> There's a state firewall between my client and nessus server. All
> traffic initialized outside (where is also the nessus server) to my
> client is prohibited.
I don't believe this should be a problem since the client is initializing
the connection.
> Well, the last: when i terminated fozen update-nessusrc, on the output
> of sniffer on nessus box appeared this:
...
> 67.123.198.109 -> a.b.c.d NBT NS Query Request for *..............[0], Success
> 200.217.240.218 -> a.b.c.d NBT NS Query Request for *..............[0], Success
> 62.94.68.155 -> a.b.c.d NBT NS Query Request for *..............[0], Success
>
> (a.b.c.d in my client's IP)
>
> What's the problem with update-nessusrc and what doea the NBT NS Query means?
"NBT NS Query *" indicates the client issued a Netbios wildcard name
query (over port 137); what you have above are other hosts responding to
the broadcast.
The thing is, Netbios is associated generally with Windows and provides
for resource sharing, authentication, and (Netbios) name resolution and
browsing. It's not something that update-nessusrc uses. If you're
running Samba on a unix box, you've simply captured extraneous traffic;
if you're instead running a Windows box, note that update-nessusrc
requires some flavour of unix.
George
--
[EMAIL PROTECTED]
msg03336/pgp00000.pgp
Description: PGP signature
