Thanks for your response.  I assume that it's not trying to join a multicast
"group" since this would only work on the local segment (correct?)

What response is it looking for as a "positive"?

I will try the sniff, while running that particular check.  


Thanks again

Joe
-----Original Message-----
From: Michel Arboi [mailto:[EMAIL PROTECTED] 
Sent: Saturday, March 06, 2004 3:30 PM
To: Joe Clifton
Cc: [EMAIL PROTECTED]
Subject: Re: spank test, false positive?

"Joe Clifton" <[EMAIL PROTECTED]> writes:

> Can anyone tell me what could cause a false positive? 

The plugin uses a "quick & dirty" pcap filter, but unless you are very
unlucky, this should work.
Maybe a problem with libpcap?

> tested against a few routers, which are filtering 224.0.0.0/4, yet Nessus
> still reports that they respond and are vulnerable.

Sniff the data while you run the plugin (it can be launched with the
standalone nasl command) 


_______________________________________________
Nessus mailing list
[EMAIL PROTECTED]
http://mail.nessus.org/mailman/listinfo/nessus

Reply via email to