Thanks for your response. I assume that it's not trying to join a multicast "group" since this would only work on the local segment (correct?)
What response is it looking for as a "positive"? I will try the sniff, while running that particular check. Thanks again Joe -----Original Message----- From: Michel Arboi [mailto:[EMAIL PROTECTED] Sent: Saturday, March 06, 2004 3:30 PM To: Joe Clifton Cc: [EMAIL PROTECTED] Subject: Re: spank test, false positive? "Joe Clifton" <[EMAIL PROTECTED]> writes: > Can anyone tell me what could cause a false positive? The plugin uses a "quick & dirty" pcap filter, but unless you are very unlucky, this should work. Maybe a problem with libpcap? > tested against a few routers, which are filtering 224.0.0.0/4, yet Nessus > still reports that they respond and are vulnerable. Sniff the data while you run the plugin (it can be launched with the standalone nasl command) _______________________________________________ Nessus mailing list [EMAIL PROTECTED] http://mail.nessus.org/mailman/listinfo/nessus
