Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 5 down vote favorite
1

On a large scale (~1500 workstations, ~100 servers, ~50 network routers and switches, etc), what should a vulnerability management system be scanning? Should it scan everything, or just samples?

I know that ideally the VMS have to scan everything, but I'm not sure if that is feasible.

share|improve this question
That doesn't sound like a lot of systems, especially if you're authorized to do it, are on their LAN, and can scan at full speed. – nlovric Feb 15 '12 at 11:38

2 Answers

up vote 5 down vote accepted

Scan everything; all ports and protocols.

Scan of open TCP ports:

  1. Scanner sends TCP SYN to 1650 targets × 65,536 ports = 108,132,750 160-bit IP headers + 108,132,750 160-bit TCP SYN packets = 34,602,480,000 bits @ 1 Gbit/s = 32.23 seconds; of course, you'll have to go at least twice as slow so that responses from below can use the bandwidth.
  2. 1650 targets × 65,535 ports respond with 108,132,750 96-bit ICMP PORT_UNREACH packets or 108,132,750 160-bit IP headers + 160-bit TCP SYN-ACK payload = not more than 34,602,480,000 bits @ 1 Gbit/s = at least 32.23 seconds.
  3. All listening TCP ports on all systems on your network can, theorethically, be discovered in 64.45 seconds if there's no packet loss (OSI layer 2 frame sizes not taken into account).

It's similar for UDP; however, the payload is smaller.

The discovery of all listening TCP and UDP ports on all systems on your network can, theorethically, be completed in 128.90 seconds (OSI layer 2 frame sizes not taken into account).

Other protocols = 1 packet per target in each direction; however, DHCP servers wait on each other, so to discover all of them is a bit more complicated.

I'd say all directly available services on your network can, theorethically, be determined within 180 seconds.

Then you have to scan each directly available service for vulnerabilities. A rough estimate would be that you have 1650 × 5 available servies = 8,250 directly available services. I'd say it would take no more than 10 seconds per directly available service on average. Therefore, all directly avaialble services can, theorethically, be scanned for vulnerabilities within 180 seconds + 8,250 × 10 seconds = 82,680 seconds = 22.97 hours.

Realistically, it will take at least 3 days @ 1 Gbit/s.

Now, just so you know, a hacker could discover all vulnerable standard services on your network within a few hours, if he's a script kiddie, or within an hour, if he's not. That is to say, your entire network can be pwned within 3 hours if there's an entry point and there are vulnerabilities, depending on who's doing it.

That's only IPv4, though; do you have IPv6?

share|improve this answer
On a side note, I am inserting a shameless self-advartisement: packetstormsecurity.org/files/24077/antiroute-1.1.tar.gz.html – nlovric Feb 15 '12 at 12:31
1  
No IPv6. But when I scan locally with Nmap (that is, only UDP/TCP ports/services, with -T5 flag) it takes much much more time than your estimation. – lisa17 Feb 15 '12 at 14:19
Theorethically, you can scan up to 65,535 targets within a timeout period. Copy-paste your entire Nmap command. Also ping the most distant host in hops on your network and paste the rtt min/avg/max/mdev. – nlovric Feb 15 '12 at 14:45
Ping for several minutes. Tell me if the network is currently unused or used as much as it usually is. – nlovric Feb 15 '12 at 14:54
You can scan faster if you scan from multiple IPs. Each IP is, theorethically, limited to 65,535 targets during a timeout period. My scannig astimation does not refer to a single system; it refers to maximum theorethical speed, using the minimum number of IPs required to achieve it. Also, it's not just IPs; every system can handle only so many simultaneous timeouts (this is actually called a "time wait state"). – nlovric Feb 15 '12 at 15:02
show 4 more comments
up vote 3 down vote

There is more to scan than just ports and services. VMS can log into computers to perform checks on the OS configuration, patch level, password strength, even Windows AD settings. Depending on your purposes and intent, you should be doing these types of scans as well. You will get a deeper insight (and control) over what's behind the firewalls and past what the outside attacker might see, which is important to set up a kind of 'defense in depth' at the host/node level.

For a network that large, these types of scans need to be done over multiple scan nodes.

share|improve this answer
Using several nodes would you scan every machine (including workstations) or just samples? – lisa17 Feb 17 '12 at 10:15
1  
It depends on the coverage you need to have to meet the risks you face. If you want to scan a subset over time until the whole network is scanned, that is an idea. Perhaps small subsets until the whole network is covered over a month. But that depends on the exposure you can tolerate. I certainly would not simply scan the same sample over and over again and hope the rest match the sample's results. – schroeder Feb 17 '12 at 23:16

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.