Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

In the Nessus FAQ it says

Microsoft Windows desktop systems have network limitations that may impact the performance of Nessus. The TCP/IP stack limits the number of simultaneous incomplete outbound TCP connection attempts. After the limit is reached, subsequent connection attempts are put in a queue and will be resolved at a fixed rate (10 per second). If too many enter the queue, they may be dropped.

And the recommended settings there does not the options in Nessus 5 and I am confused about what to set in the product.

I wonder what settings you use on a Windows 7-desktop machine to make sure the scan is as reliable as possible?

share|improve this question
    
Are you saying that you want to use a Windows 7 desktop as the scanner or are you attempting to scan a Windows 7 machine? –  Scott Pack Mar 10 '13 at 23:20
    
With Nessus turn everything on, always. Also expect that 95% of the findings are either false posties or totally worthless. –  Rook Mar 11 '13 at 16:42
    
@ScottPack he wants to run the scan from a Win7 machine –  schroeder Mar 12 '13 at 19:17
    
@schroeder: I was afraid of that. Sounds like a recipe for disaster. –  Scott Pack Mar 12 '13 at 19:23
add comment

2 Answers

If you are running Black-Box scans and using a Win7 machine as the server, you are going to run into the potential problem of half-open connections being dropped. As for the settings in the FAQ, you can find them in: configuration > advanced settings for the server.

You can reduce the impact of this networking limitation by supplying credentials for the target and configuring that only the local port enumerators are used (configured in the policy's preferences > port scanner settings). That way, you are getting a report of the open ports from the target instead of a port scan.

share|improve this answer
add comment

this is probably referring to the maximum half-open connections limit. This shouldn't be a problem with Windows 7, as the limit was supposedly removed in Vista SP2.

You can however, check, and remove the limit if it exists.

  1. Start regedit and locate

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\

  1. In the right pane, locate the

EnableConnectionRateLimiting

registry value data entry. If “EnableConnectionRateLimiting” is not found, the half-open TCP connections limit is already removed/disabled, allowing unlimited half-open incomplete outbound connections. If the value is there, delete it - or edit it and set to zero.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.