Nicolas Pouvesle wrote: >> Anyway, smb_enum_services.nasl - and I assume related scripts too - >> doesn't always report correctly for all the hosts it should. Sometimes >> the report is empty. >> >> The hosts where it doesn't work are definitely weird. They are XP, and >> yet port 445 is down (and 139 is up, and they are not firewalled). > > I have seen that too. It seems to only happen against XP. But I was > not able to find what was causing that (I don't even think it is > related to Nessus). >
I think I may be onto something. It appears all the hosts I can see that have port 445 down have one thing in common - multiple network adapters. Typically Ethernet plus Wireless. I can see two different IP addresses on the two different MAC/adapters. Some have both port 139 and 445 reachable on one adapter - and only port 139 available on the other... Some have port 445 down, and the Wireless adapter auto-disabled (we have some HP laptops where the BIOS is configured to disable Wireless whenever the Ethernet card comes up - good idea). So it looks like Windows gets a bit confused when there are multiple adapters. -- Cheers Jason Haar Information Security Manager, Trimble Navigation Ltd. Phone: +64 3 9635 377 Fax: +64 3 9635 417 PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1 _______________________________________________ Nessus mailing list [email protected] http://mail.nessus.org/mailman/listinfo/nessus
