I know this has been gone over a few different ways before, but I don't
think I've seen anyone approach this from the named pipes angle.
I have several sparsely populated class B networks that I need to scan for
some critical vulnerabilities. Test scans against class C's show scan times
of 2 to 4 minutes. To scan the entire class B, that would result in scan
times of 8.5 hours (not acceptable) to 17 hours (much longer than a work
day). I don't want to split up the scan because it's fairly important to me
to be able to say "on this day, there were this many vulnerable systems".
Scans of individual hosts seem to take no more than 1 minute each. I do 64
in parallel so in theory, scanning 3000 systems in a class B should take
only 3000hosts/64(hosts/minute) = 47 minutes.
So, I thought of named pipes and nmap. I scan the class B with nmap and
pipe the results to a named pipe:
mknod ping.pipe p
nmap -n -sP -oG - 10.10.0.0/16 | awk '/Status: Up/ { print $2 }' >
ping.pipe &
Then I want to start nessus to scan just those hosts that are up:
nessus -c nessusrc -q localhost 1241 batch pw ping.pipe output.nbe
Unfortunately, the nessus command exits immediately:
[Tue Nov 11 16:31:19 2003][14135] connection from 127.0.0.1
[Tue Nov 11 16:31:19 2003][30871] Client requested protocol version 12.
[Tue Nov 11 16:31:19 2003][30871] successful login of batch from 127.0.0.1
[Tue Nov 11 16:31:29 2003][30871] Redirecting debugging output to
/usr/local/var/nessus/logs/nessusd.dump
[Tue Nov 11 16:31:30 2003][30871] user batch : session will be saved as
/usr/localvar/nessus/users/batch/sessions/20031111-163130-index
[Tue Nov 11 16:31:31 2003][30871] user batch starts a new scan. Target(s) :
, with max_hosts = 64 and max_checks = 10
[Tue Nov 11 16:31:31 2003][30871] user batch : Nothing interesting found -
deleting the session
[Tue Nov 11 16:31:31 2003][30871] user batch : Kept alive connection
[Tue Nov 11 16:31:31 2003][30871] Communication closed by client
It looks to me like the nessus command is not compatible with named pipes.
Could it be made so in the next version or is it important for it to have
all targets at the beginning of the scan?
Yes, I can save the output in an intermediate file which will result in only
slightly stale targets for nessus (a test nmap run takes 53 minutes), but
I'm sure that I'll loose accuracy especially for the DHCP ranges.
Thanks,
Owen
