Le Tue, 24 Jun 2008 14:44:56 +0400, "Taras Ivashchenko" <[EMAIL PROTECTED]> a écrit :
> There are a lot of hosts with disabled ICMP. > So how Nessus determine if these hosts alive? With ARP, TCP, or UDP. ARP only works on the local network. TCP works by sending SYN packets on several "common" ports. If it receives an answer (any TCP packet: SYNACK, RST...) the host is supposed to be "up". You may have false positive with transparent web proxies (on port 80) or some firewall rules (rejecting port 139, 445 or 113). This can be fixed by changing the default port set. UDP is slow and works only a couple of protocols (DNS, RPC RIP v1 & v2) > I want to scan these hosts by full port range without any checks of > it's alive state. If you disable all ping options in the plugin Preferences, all hosts will be considered as up. _______________________________________________ Nessus mailing list [email protected] http://mail.nessus.org/mailman/listinfo/nessus
