Hi John,
On Jan 14, 2006, at 17:22, John Scherff wrote:
Three Nessus 3.0.1 Questions, 1 Remark:
Question 1:
- nessusd.conf has max_hosts = 40
- nessusrc has max_hosts = 40
I submit multiple scan "jobs" to the scanning server
simultaneously. Does the 40-host limit apply to each job, or to
nessusd overall? That is, if I submit 10 jobs, each with 50
targets, will the server scan a maximum of 40 targets
simultaneously, or 400?
It's 400. 'max_hosts' really is max hosts per scan job.
Question 2:
What are the optimum max_hosts and max_checks values? The scanning
servers are all HP BL25p blades with 4 Gig RAM and dual processors,
each processor is a 2600Mhz AMD with 64K L1 cache and 1024K L2
cache. Hard drives are mirrored 172G 15,000 RPM SCSI. OS is 32-bit
RHEL4. The network is robust and the scans occur on weekends when
traffic is minimal. I'm currently using the defaults, max_hosts=40
and max_checks=5.
As a rule of thumb, you want to keep max_checks quite low - 5 or 4 is
fine. If max_checks is set too high, your scan will be very
disruptive for the remote devices.
Given your amount of memory, you can safely set max_hosts to 100 (or
even to 200). However at this point your network connectivity might
be a bottleneck - if the hosts are on the local lan, you can set
max_hosts to this value, while if they are on a remote network with a
medium/low connectivity, keep max_hosts to 40.
Question 3:
How does a simple iptable ruleset affect nessus' performance (if at
all)? When I run scans with iptables running, I occasionally see
"dropped packet" messages.
Depending on what the ruleset is exactly, it may induce some
(minimal) load in the kernel (because of the sessions being kept
track of). More importantly, you should have rules which do not
prevent Nessus from emitting or receiving packets, otherwise your
scan may yeld incomplete results.
Also, note that some DoS plugins may cause a 'dropped packet' message
because they forge malformed packets that some kernels won't even let
out. If you're scanning a production network, make sure that
safe_checks are set.
Thanks,
-- Renaud
_______________________________________________
Nessus mailing list
[email protected]
http://mail.nessus.org/mailman/listinfo/nessus
