Recomended Nessus Windows-7 scan settings?

Question

In the Nessus FAQ it says

Microsoft Windows desktop systems have network limitations that may impact the performance of Nessus. The TCP/IP stack limits the number of simultaneous incomplete outbound TCP connection attempts. After the limit is reached, subsequent connection attempts are put in a queue and will be resolved at a fixed rate (10 per second). If too many enter the queue, they may be dropped.

And the recommended settings there does not the options in Nessus 5 and I am confused about what to set in the product.

I wonder what settings you use on a Windows 7-desktop machine to make sure the scan is as reliable as possible?

Answer 1

this is probably referring to the maximum half-open connections limit. This shouldn't be a problem with Windows 7, as the limit was supposedly removed in Vista SP2.

You can however, check, and remove the limit if it exists.

1. Start regedit and locate

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\

1. In the right pane, locate the

EnableConnectionRateLimiting

registry value data entry. If “EnableConnectionRateLimiting” is not found, the half-open TCP connections limit is already removed/disabled, allowing unlimited half-open incomplete outbound connections. If the value is there, delete it - or edit it and set to zero.

Answer 2

If you are running Black-Box scans and using a Win7 machine as the server, you are going to run into the potential problem of half-open connections being dropped. As for the settings in the FAQ, you can find them in: configuration > advanced settings for the server.

You can reduce the impact of this networking limitation by supplying credentials for the target and configuring that only the local port enumerators are used (configured in the policy's preferences > port scanner settings). That way, you are getting a report of the open ports from the target instead of a port scan.