In the Nessus FAQ it says

Microsoft Windows desktop systems have network limitations that may impact the performance of Nessus. The TCP/IP stack limits the number of simultaneous incomplete outbound TCP connection attempts. After the limit is reached, subsequent connection attempts are put in a queue and will be resolved at a fixed rate (10 per second). If too many enter the queue, they may be dropped.

And the recommended settings there does not the options in Nessus 5 and I am confused about what to set in the product.

I wonder what settings you use on a Windows 7-desktop machine to make sure the scan is as reliable as possible?

  • Are you saying that you want to use a Windows 7 desktop as the scanner or are you attempting to scan a Windows 7 machine?
    – Scott Pack
    Mar 10, 2013 at 23:20
  • With Nessus turn everything on, always. Also expect that 95% of the findings are either false posties or totally worthless.
    – rook
    Mar 11, 2013 at 16:42
  • @ScottPack he wants to run the scan from a Win7 machine
    – schroeder
    Mar 12, 2013 at 19:17
  • @schroeder: I was afraid of that. Sounds like a recipe for disaster.
    – Scott Pack
    Mar 12, 2013 at 19:23

2 Answers 2


this is probably referring to the maximum half-open connections limit. This shouldn't be a problem with Windows 7, as the limit was supposedly removed in Vista SP2.

You can however, check, and remove the limit if it exists.

  1. Start regedit and locate


  1. In the right pane, locate the


registry value data entry. If “EnableConnectionRateLimiting” is not found, the half-open TCP connections limit is already removed/disabled, allowing unlimited half-open incomplete outbound connections. If the value is there, delete it - or edit it and set to zero.


If you are running Black-Box scans and using a Win7 machine as the server, you are going to run into the potential problem of half-open connections being dropped. As for the settings in the FAQ, you can find them in: configuration > advanced settings for the server.

You can reduce the impact of this networking limitation by supplying credentials for the target and configuring that only the local port enumerators are used (configured in the policy's preferences > port scanner settings). That way, you are getting a report of the open ports from the target instead of a port scan.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .