I want to know when scanning using NESSUS, though it is said its non-intrusive by default But what I want to know is how the use / definition or the testing conditions mentioned in the plugin-id effect the outcome of the scan. Does these conditions or tests or checks make the scan more intrusive in some way. I.e sending crafted packets. For e.g When the plugin-id checks for default password does this change its definition of scanning/ enumerating ports alone.
I have a recent example, where the gmond service 8649 was crashed as a results of scanning. It came to knowledge, that the service / port received non service traffic / data as a result its cpu consumption went to 100%. So, if its just non-intrusive port scanner how it resulted into crashing the service of remote host? It certainly is able to generate packets/ data as well.
Actually, is it fair to say that nessus uses NMAP scans / ports scanning results for services, and version of different application to give verdict on its vulnerable state or it make use of plugin-id and others information to conclude, give confidence marks on how vulnerable the particular service may be? (More checks > same results-> higher degree of confidence).
I appreciate if someone can help me understand what actually goes inside nessus core logic when it comes to make judgements / call on such matters. (vulnerable vs not vulnerable)