Does anyone else get this and does anyone know what to do about it? I can nmap a host: nmap 172.17.173.160
Starting Nmap 4.20 Interesting ports on 172.17.173.160: PORT STATE SERVICE 22/tcp open ssh 25/tcp open smtp 67/tcp filtered dhcps 68/tcp filtered dhcpc 80/tcp open http 137/tcp filtered netbios-ns 138/tcp filtered netbios-dgm 161/tcp filtered snmp 162/tcp filtered snmptrap 199/tcp open smux 443/tcp open https 1080/tcp open socks 1443/tcp open ies-lm 5308/tcp open cfengine So clearly I can route to the host and nothing is blocking me, for port scans at least. Then I run nessus against it and it goes for about 10 seconds and comes back with empty results, doesn¹t even detect the host. I¹m running the Mac OS X client 3.0.6, with my local firewall disabled. I happen to be doing this thru a Cisco VPN, but I have had this similar problem not thru the VPN. The traffic flow is OSX>VPN>thru an Imperva Application Firewall > Target. This is the tcpdump of the interface on the Imperva Application Firewall of the ENTIRE nessus scan session. Clearly the nessus scan starts a port scan, reaches the target, and gets responses back. Then it starts doing ICMP echo requests, which after 6 tries, is when the session is ended. 05:54:03.705729 172.17.175.5.50620 > 172.17.173.160.snmp: GetNextRequest(18) .iso.org 05:54:05.714483 172.17.175.5.41951 > 172.17.173.160.netbios-ssn: S 1245282867:1245282867(0) win 2048 05:54:05.715285 172.17.173.160.netbios-ssn > 172.17.175.5.41951: R 0:0(0) ack 1 win 0 (DF) 05:54:05.817301 172.17.175.5.43081 > 172.17.173.160.135: S 1127167241:1127167241(0) win 2048 05:54:05.818852 172.17.173.160.135 > 172.17.175.5.43081: R 0:0(0) ack 1 win 0 (DF) 05:54:05.913872 172.17.175.5.64381 > 172.17.173.160.microsoft-ds: S 599522922:599522922(0) win 2048 05:54:05.915173 172.17.173.160.microsoft-ds > 172.17.175.5.64381: R 0:0(0) ack 1 win 0 (DF) 05:54:06.017438 172.17.175.5.221 > 172.17.173.160.http: S 2097449245:2097449245(0) win 2048 05:54:06.018245 172.17.173.160.http > 172.17.175.5.221: S 1703343200:1703343200(0) ack 2097449246 win 5840 <mss 1460> (DF) 05:54:06.076780 172.17.175.5.221 > 172.17.173.160.http: R 2097449246:2097449246(0) win 0 (DF) 05:54:06.119632 172.17.175.5.58193 > 172.17.173.160.ssh: S 3910820461:3910820461(0) win 2048 05:54:06.120311 172.17.173.160.ssh > 172.17.175.5.58193: S 1706212515:1706212515(0) ack 3910820462 win 5840 <mss 1460> (DF) 05:54:06.176100 172.17.175.5.58193 > 172.17.173.160.ssh: R 3910820462:3910820462(0) win 0 (DF) 05:54:06.217953 172.17.175.5.1023 > 172.17.173.160.printer: S 427138384:427138384(0) win 2048 05:54:06.218380 172.17.173.160.printer > 172.17.175.5.1023: R 0:0(0) ack 1 win 0 (DF) 05:54:06.323392 172.17.175.5.38775 > 172.17.173.160.telnet: S 2340504334:2340504334(0) win 2048 05:54:06.324569 172.17.173.160.telnet > 172.17.175.5.38775: R 0:0(0) ack 1 win 0 (DF) 05:54:06.427460 172.17.175.5.39746 > 172.17.173.160.ftp: S 2059532340:2059532340(0) win 2048 05:54:06.429885 172.17.173.160.ftp > 172.17.175.5.39746: R 0:0(0) ack 1 win 0 (DF) 05:54:06.527904 172.17.175.5.9816 > 172.17.173.160.x11: S 1367930652:1367930652(0) win 2048 05:54:06.528955 172.17.173.160.x11 > 172.17.175.5.9816: R 0:0(0) ack 1 win 0 (DF) 05:54:06.627473 172.17.175.5.53392 > 172.17.173.160.1025: S 2031775585:2031775585(0) win 2048 05:54:06.628150 172.17.173.160.1025 > 172.17.175.5.53392: R 0:0(0) ack 1 win 0 (DF) 05:54:06.725169 172.17.175.5.52962 > 172.17.173.160.smtp: S 3595275811:3595275811(0) win 2048 05:54:06.726222 172.17.173.160.smtp > 172.17.175.5.52962: S 1706084459:1706084459(0) ack 3595275812 win 5840 <mss 1460> (DF) 05:54:06.785885 172.17.175.5.52962 > 172.17.173.160.smtp: R 3595275812:3595275812(0) win 0 (DF) 05:54:06.835857 172.17.175.5.3096 > 172.17.173.160.sunrpc: S 908899711:908899711(0) win 2048 05:54:06.836783 172.17.173.160.sunrpc > 172.17.175.5.3096: R 0:0(0) ack 1 win 0 (DF) 05:54:06.933303 172.17.175.5.31461 > 172.17.173.160.1028: S 289309483:289309483(0) win 2048 05:54:06.933979 172.17.173.160.1028 > 172.17.175.5.31461: R 0:0(0) ack 1 win 0 (DF) 05:54:07.035495 172.17.175.5.59973 > 172.17.173.160.jetdirect: S 948145194:948145194(0) win 2048 05:54:07.036296 172.17.173.160.jetdirect > 172.17.175.5.59973: R 0:0(0) ack 1 win 0 (DF) 05:54:07.139062 172.17.175.5.3078 > 172.17.173.160.1029: S 2734582298:2734582298(0) win 2048 05:54:07.140238 172.17.173.160.1029 > 172.17.175.5.3078: R 0:0(0) ack 1 win 0 (DF) 05:54:07.244254 172.17.175.5.54036 > 172.17.173.160.finger: S 1644253211:1644253211(0) win 2048 05:54:07.245430 172.17.173.160.finger > 172.17.175.5.54036: R 0:0(0) ack 1 win 0 (DF) 05:54:07.347197 172.17.175.5.26134 > 172.17.173.160.497: S 3291948322:3291948322(0) win 2048 05:54:07.348497 172.17.173.160.497 > 172.17.175.5.26134: R 0:0(0) ack 1 win 0 (DF) 05:54:07.452639 172.17.175.5.46520 > 172.17.173.160.afpovertcp: S 1857290614:1857290614(0) win 2048 05:54:07.453815 172.17.173.160.afpovertcp > 172.17.175.5.46520: R 0:0(0) ack 1 win 0 (DF) 05:54:07.545836 172.17.175.5.24658 > 172.17.173.160.5000: S 1283454269:1283454269(0) win 2048 05:54:07.546887 172.17.173.160.5000 > 172.17.175.5.24658: R 0:0(0) ack 1 win 0 (DF) 05:54:07.642407 172.17.175.5.15864 > 172.17.173.160.1917: S 1852940836:1852940836(0) win 2048 05:54:07.642958 172.17.173.160.1917 > 172.17.175.5.15864: R 0:0(0) ack 1 win 0 (DF) 05:54:07.740101 172.17.175.5.domain > 172.17.173.160.domain: S 810771713:810771713(0) win 2048 05:54:07.741028 172.17.173.160.domain > 172.17.175.5.domain: R 0:0(0) ack 1 win 0 (DF) 05:54:07.838923 172.17.175.5.26210 > 172.17.173.160.snmp: S 2704313167:2704313167(0) win 2048 05:54:07.938367 172.17.175.5.19150 > 172.17.173.160.9001: S 4224194860:4224194860(0) win 2048 05:54:07.939793 172.17.173.160.9001 > 172.17.175.5.19150: R 0:0(0) ack 1 win 0 (DF) 05:54:08.042810 172.17.175.5.ftp-data > 172.17.173.160.65535: S 3575279123:3575279123(0) win 2048 05:54:08.043234 172.17.173.160.65535 > 172.17.175.5.ftp-data: R 0:0(0) ack 1 win 0 (DF) 05:54:08.145251 172.17.175.5.13599 > 172.17.173.160.https: S 3872151421:3872151421(0) win 2048 05:54:08.145680 172.17.173.160.https > 172.17.175.5.13599: S 1699664049:1699664049(0) ack 3872151422 win 5840 <mss 1460> (DF) 05:54:08.190350 172.17.175.5.13599 > 172.17.173.160.https: R 3872151422:3872151422(0) win 0 (DF) 05:54:08.248943 172.17.175.5.37639 > 172.17.173.160.imaps: S 2781008924:2781008924(0) win 2048 05:54:08.249744 172.17.173.160.imaps > 172.17.175.5.37639: R 0:0(0) ack 1 win 0 (DF) 05:54:08.355884 172.17.175.5.55946 > 172.17.173.160.webcache: S 2776112482:2776112482(0) win 2048 05:54:08.357059 172.17.173.160.webcache > 172.17.175.5.55946: R 0:0(0) ack 1 win 0 (DF) 05:54:08.455828 172.17.175.5.15054 > 172.17.173.160.2869: S 3722111297:3722111297(0) win 2048 05:54:08.457129 172.17.173.160.2869 > 172.17.175.5.15054: R 0:0(0) ack 1 win 0 (DF) 05:54:08.561518 172.17.175.5.41951 > 172.17.173.160.netbios-ssn: S 3165136470:3165136470(0) win 2048 05:54:08.562319 172.17.173.160.netbios-ssn > 172.17.175.5.41951: R 0:0(0) ack 1919853604 win 0 (DF) 05:54:08.665460 172.17.175.5 > 172.17.173.160: icmp: echo request 05:54:08.665761 172.17.173.160 > 172.17.175.5: icmp: echo reply [tos 0xc0] 05:54:09.670274 172.17.175.5 > 172.17.173.160: icmp: echo request 05:54:09.670575 172.17.173.160 > 172.17.175.5: icmp: echo reply [tos 0xc0] 05:54:10.672591 172.17.175.5 > 172.17.173.160: icmp: echo request 05:54:10.672892 172.17.173.160 > 172.17.175.5: icmp: echo reply [tos 0xc0] 05:54:11.681903 172.17.175.5 > 172.17.173.160: icmp: echo request 05:54:11.682203 172.17.173.160 > 172.17.175.5: icmp: echo reply [tos 0xc0] 05:54:12.684842 172.17.175.5 > 172.17.173.160: icmp: echo request 05:54:12.685268 172.17.173.160 > 172.17.175.5: icmp: echo reply [tos 0xc0] 05:54:13.683036 172.17.175.5 > 172.17.173.160: icmp: echo request 05:54:13.683336 172.17.173.160 > 172.17.175.5: icmp: echo reply [tos 0xc0] The only thing I don¹t have access to is the Cisco VPN and I don¹t recall any features that would give me the results I am seeing. For it to be the Cisco VPN, the Cisco would have to be allowing my initial scans but not allowing the return replies. Unfortunately, being that I am using a client VPN, I cannot sniff my own local interface to see if those replies get back but I do see plenty of encapsulated packets returning when I do a scan. Any thoughts?
_______________________________________________ Nessus mailing list [email protected] http://mail.nessus.org/mailman/listinfo/nessus
