What type of port scan are you using? I suspect that you may indeed have the problem but not notice it because you're using a CONNECT() port scan. Could you run the attached NASL script on your SuSE box, and capture the packet using "tcpdump -v" ? That will verify the checksum. On my SuSE 9.0 system it is invalid, and this is due to a kernel bug. The only solution is to fix the kernel bug (i.e. use a different kernel) or put a workaround in Nessus. A version of nmap with such a workaround already exists.
I would be very interested to see the results.
Regards,
Paul
Troels Larsen wrote:
Uhm,
I'm running Nessus on SuSE 9.0.... no problems... no special kernel..
The only issue I had was the SuSE RPM's (which punted on pings) I switched to the nessus installer.. no problems
I just installed all the nessesary prerequisites, and I believe I linked gtk-config to /bin
Everything works fine
/Troels
-- Paul Johnston Internet Security Specialist Westpoint Limited Albion Wharf, 19 Albion Street, Manchester, M1 5LN England Tel: +44 (0)161 237 1028 Fax: +44 (0)161 237 1031 email: [EMAIL PROTECTED] web: www.westpoint.ltd.uk
ip = forge_ip_packet( ip_v : 4,
ip_hl : 5,
ip_tos : 0,
ip_len : IP_LEN,
ip_id : 0xABA,
ip_p : IPPROTO_TCP,
ip_ttl : 255,
ip_off : 0,
ip_src : srcaddr);
tcpip = forge_tcp_packet( ip : ip,
th_sport : 1234,
th_dport : 80,
th_flags : TH_SYN,
th_seq : 0xF1C,
th_ack : 0,
th_x2 : 0,
th_off : 5,
th_win : 512,
th_urp : 0);
result = send_packet(tcpip);
_______________________________________________ Nessus mailing list [EMAIL PROTECTED] http://mail.nessus.org/mailman/listinfo/nessus
