David, What OS are you running your Nessusd on? On Linux the scans are saved in /opt/nessus/var/nessus/tmp. If I recall correctly, on Windows they're saved in: C:\Program Files\Tenable\Nessus\tmp (if not there, they're pretty easy to find because they're named something like: scan-trace-<ip>...
You can definitely open them in Wireshark for examination. Check out this blog entry for more info: http://blog.tenablesecurity.com/2007/09/creating-packet.html Paul Jones, David H wrote: > There's an option on the Nessus client to "save a packet capture of the > scan"... I'm wondering where the heck that gets saved to. I can't seem > to find anything in the documentation. > > Also, is it stored in a standard .cap format, so I can read it with > something like Wireshark? > > Thanks! > > > > David Jones > Principal Financial Group > I/S Information Security > 711 High Street > Des Moines, IA 50392-0257 > > Email: [EMAIL PROTECTED] > Phone: 515.362.2224 > > > > -----Message Disclaimer----- > > This e-mail message is intended only for the use of the individual or > entity to which it is addressed, and may contain information that is > privileged, confidential and exempt from disclosure under applicable law. > If you are not the intended recipient, any dissemination, distribution or > copying of this communication is strictly prohibited. If you have > received this communication in error, please notify us immediately by > reply email to [EMAIL PROTECTED] and delete or destroy all copies of > the original message and attachments thereto. Email sent to or from the > Principal Financial Group or any of its member companies may be retained > as required by law or regulation. > > Nothing in this message is intended to constitute an Electronic signature > for purposes of the Uniform Electronic Transactions Act (UETA) or the > Electronic Signatures in Global and National Commerce Act ("E-Sign") > unless a specific statement to the contrary is included in this message. > > While this communication may be used to promote or market a transaction > or an idea that is discussed in the publication, it is intended to provide > general information about the subject matter covered and is provided with > the understanding that The Principal is not rendering legal, accounting, > or tax advice. It is not a marketed opinion and may not be used to avoid > penalties under the Internal Revenue Code. You should consult with > appropriate counsel or other advisors on all matters pertaining to legal, > tax, or accounting obligations and requirements. > > _______________________________________________ > Nessus mailing list > [email protected] > http://mail.nessus.org/mailman/listinfo/nessus > -- Best Regards, Paul Davis Research Engineer Tenable Network Security Inc Phone: 410.872.0555 x245 www.tenablesecurity.com Is your network TENABLE? _______________________________________________ Nessus mailing list [email protected] http://mail.nessus.org/mailman/listinfo/nessus
