Discussion:
don't ping...
Jack Harvey
2014-07-29 15:34:17 UTC
Permalink
Sorry for the ignorant question. I am looking for the right scan config setting so that all hosts are treated as live.
Direction appreciated.

Jack Harvey CISSP
Synnex Corporation
864-349-4939
Jack Harvey
2014-07-29 16:55:41 UTC
Permalink
By way of further explanation of my issue:
I have a linux-based computer with a firewall. This computer does not respond to "pings". If I run a scan with the "Full and very deep" config, the scan takes seconds and
returns no results. If I do a port scan with nmap (from my OpenVAS computer) and the -Pn parameter (treat all hosts as online), it finds several ports open...verified by the system owner.
I have cloned the "Full and very deep" config and tried to modify the port scanner section "launch nmap for network scanning" and enable "treat all hosts as online", but still have no success
scanning and getting some results.
Help appreciated!


From: Jack Harvey
Sent: Tuesday, July 29, 2014 11:34 AM
To: openvas-***@wald.intevation.org
Subject: don't ping...

Sorry for the ignorant question. I am looking for the right scan config setting so that all hosts are treated as live.
Direction appreciated.

Jack Harvey CISSP
Synnex Corporation
864-349-4939
Brandon Perry
2014-07-29 17:00:04 UTC
Permalink
Not sure exactly how you are configuring the scan config, but someone
Post by Jack Harvey
I have a linux-based computer with a firewall. This computer does not
respond to “pings”. If I run a scan with the “Full and very deep” config,
the scan takes seconds and
returns no results. If I do a port scan with nmap (from my OpenVAS
computer) and the –Pn parameter (treat all hosts as online), it finds
several ports open
verified by the system owner.
I have cloned the “Full and very deep” config and tried to modify the port
scanner section “launch nmap for network scanning” and enable “treat all
hosts as online”, but still have no success
scanning and getting some results.
Help appreciated!
*From:* Jack Harvey
*Sent:* Tuesday, July 29, 2014 11:34 AM
*Subject:* don't ping...
Sorry for the ignorant question. I am looking for the right scan config
setting so that all hosts are treated as live.
Direction appreciated.
Jack Harvey CISSP
Synnex Corporation
864-349-4939
_______________________________________________
Openvas-discuss mailing list
https://lists.wald.intevation.org/cgi-bin/mailman/listinfo/openvas-discuss
--
http://volatile-minds.blogspot.com -- blog
http://www.volatileminds.net -- website
Jack Harvey
2014-07-29 17:18:27 UTC
Permalink
I think that’s what I’m trying to do/ask how to do. Apologies for being slow
but where do I configure this “Consider Alive” parameter for the host?

Jack Harvey CISSP
Synnex Corporation
864-349-4939

From: Brandon Perry [mailto:***@gmail.com]
Sent: Tuesday, July 29, 2014 1:00 PM
To: Jack Harvey
Cc: openvas-***@wald.intevation.org
Subject: Re: [Openvas-discuss] don't ping...

Not sure exactly how you are configuring the scan config, but someone recently had this same issue:

https://www.mail-archive.com/openvas-***@wald.intevation.org/msg06133.html

On Tue, Jul 29, 2014 at 11:55 AM, Jack Harvey <***@synnex.com<mailto:***@synnex.com>> wrote:
By way of further explanation of my issue:
I have a linux-based computer with a firewall. This computer does not respond to “pings”. If I run a scan with the “Full and very deep” config, the scan takes seconds and
returns no results. If I do a port scan with nmap (from my OpenVAS computer) and the –Pn parameter (treat all hosts as online), it finds several ports open
verified by the system owner.
I have cloned the “Full and very deep” config and tried to modify the port scanner section “launch nmap for network scanning” and enable “treat all hosts as online”, but still have no success
scanning and getting some results.
Help appreciated!


From: Jack Harvey
Sent: Tuesday, July 29, 2014 11:34 AM
To: openvas-***@wald.intevation.org<mailto:openvas-***@wald.intevation.org>
Subject: don't ping...

Sorry for the ignorant question. I am looking for the right scan config setting so that all hosts are treated as live.
Direction appreciated.

Jack Harvey CISSP
Synnex Corporation
864-349-4939<tel:864-349-4939>


_______________________________________________
Openvas-discuss mailing list
Openvas-***@wald.intevation.org<mailto:Openvas-***@wald.intevation.org>
https://lists.wald.intevation.org/cgi-bin/mailman/listinfo/openvas-discuss
--
http://volatile-minds.blogspot.com -- blog
http://www.volatileminds.net -- website
Brandon Perry
2014-07-29 17:20:49 UTC
Permalink
I believe they were using GSA to do it, and it is at the host level, not
the config level IIRC.
Post by Jack Harvey
I think that’s what I’m trying to do/ask how to do. Apologies for being
slow
but where do I configure this “Consider Alive” parameter for the host?
Jack Harvey CISSP
Synnex Corporation
864-349-4939
*Sent:* Tuesday, July 29, 2014 1:00 PM
*To:* Jack Harvey
*Subject:* Re: [Openvas-discuss] don't ping...
Not sure exactly how you are configuring the scan config, but someone
I have a linux-based computer with a firewall. This computer does not
respond to “pings”. If I run a scan with the “Full and very deep” config,
the scan takes seconds and
returns no results. If I do a port scan with nmap (from my OpenVAS
computer) and the –Pn parameter (treat all hosts as online), it finds
several ports open
verified by the system owner.
I have cloned the “Full and very deep” config and tried to modify the port
scanner section “launch nmap for network scanning” and enable “treat all
hosts as online”, but still have no success
scanning and getting some results.
Help appreciated!
*From:* Jack Harvey
*Sent:* Tuesday, July 29, 2014 11:34 AM
*Subject:* don't ping...
Sorry for the ignorant question. I am looking for the right scan config
setting so that all hosts are treated as live.
Direction appreciated.
Jack Harvey CISSP
Synnex Corporation
864-349-4939
_______________________________________________
Openvas-discuss mailing list
https://lists.wald.intevation.org/cgi-bin/mailman/listinfo/openvas-discuss
--
http://volatile-minds.blogspot.com -- blog
http://www.volatileminds.net -- website
--
http://volatile-minds.blogspot.com -- blog
http://www.volatileminds.net -- website
Eero Volotinen
2014-07-29 17:49:37 UTC
Permalink
Hi Jack.
"The default configurations include the "Ping Host" NVT from the "Port
scanners" family. By default, it *marks unreachable hosts as dead *and does
not continue scanning. As discussed on the mailing list
<http://comments.gmane.org/gmane.comp.security.openvas.users/4376>,
"unreachable" implies not only no response to ICMP ping, but no response to
any of the most common ports either, so some of our hosts would be scanned
even if ICMP ping does not go through. In any case, it is necessary to
create a configuration of our own that may otherwise be the same as one of
the predefined configurations but does not have *Mark unrechable Hosts as
dead (not scanning)* enabled in order to ensure that all hosts will be
scanned."

--
Eero
Post by Jack Harvey
I think that’s what I’m trying to do/ask how to do. Apologies for being
slow
but where do I configure this “Consider Alive” parameter for the host?
Jack Harvey CISSP
Synnex Corporation
864-349-4939
*Sent:* Tuesday, July 29, 2014 1:00 PM
*To:* Jack Harvey
*Subject:* Re: [Openvas-discuss] don't ping...
Not sure exactly how you are configuring the scan config, but someone
I have a linux-based computer with a firewall. This computer does not
respond to “pings”. If I run a scan with the “Full and very deep” config,
the scan takes seconds and
returns no results. If I do a port scan with nmap (from my OpenVAS
computer) and the –Pn parameter (treat all hosts as online), it finds
several ports open
verified by the system owner.
I have cloned the “Full and very deep” config and tried to modify the port
scanner section “launch nmap for network scanning” and enable “treat all
hosts as online”, but still have no success
scanning and getting some results.
Help appreciated!
*From:* Jack Harvey
*Sent:* Tuesday, July 29, 2014 11:34 AM
*Subject:* don't ping...
Sorry for the ignorant question. I am looking for the right scan config
setting so that all hosts are treated as live.
Direction appreciated.
Jack Harvey CISSP
Synnex Corporation
864-349-4939
_______________________________________________
Openvas-discuss mailing list
https://lists.wald.intevation.org/cgi-bin/mailman/listinfo/openvas-discuss
--
http://volatile-minds.blogspot.com -- blog
http://www.volatileminds.net -- website
_______________________________________________
Openvas-discuss mailing list
https://lists.wald.intevation.org/cgi-bin/mailman/listinfo/openvas-discuss
Jack Harvey
2014-07-29 17:54:47 UTC
Permalink
Ok, so I was moving in the right direction, just did not choose the “Mark unreachable as dead”. I will go back and try again setting that. Thanks!

Jack Harvey CISSP
Synnex Corporation
864-349-4939

From: ***@gmail.com [mailto:***@gmail.com] On Behalf Of Eero Volotinen
Sent: Tuesday, July 29, 2014 1:50 PM
To: Jack Harvey
Cc: Brandon Perry; openvas-***@wald.intevation.org
Subject: Re: [Openvas-discuss] don't ping...

Hi Jack.

From my internal notes:

"The default configurations include the "Ping Host" NVT from the "Port scanners" family. By default, it marks unreachable hosts as dead and does not continue scanning. As discussed on the mailing list<http://comments.gmane.org/gmane.comp.security.openvas.users/4376>, "unreachable" implies not only no response to ICMP ping, but no response to any of the most common ports either, so some of our hosts would be scanned even if ICMP ping does not go through. In any case, it is necessary to create a configuration of our own that may otherwise be the same as one of the predefined configurations but does not have Mark unrechable Hosts as dead (not scanning) enabled in order to ensure that all hosts will be scanned."
--
Eero

2014-07-29 20:18 GMT+03:00 Jack Harvey <***@synnex.com<mailto:***@synnex.com>>:
I think that’s what I’m trying to do/ask how to do. Apologies for being slow
but where do I configure this “Consider Alive” parameter for the host?

Jack Harvey CISSP
Synnex Corporation
864-349-4939

From: Brandon Perry [mailto:***@gmail.com<mailto:***@gmail.com>]
Sent: Tuesday, July 29, 2014 1:00 PM
To: Jack Harvey
Cc: openvas-***@wald.intevation.org<mailto:openvas-***@wald.intevation.org>
Subject: Re: [Openvas-discuss] don't ping...

Not sure exactly how you are configuring the scan config, but someone recently had this same issue:

https://www.mail-archive.com/openvas-***@wald.intevation.org/msg06133.html

On Tue, Jul 29, 2014 at 11:55 AM, Jack Harvey <***@synnex.com<mailto:***@synnex.com>> wrote:
By way of further explanation of my issue:
I have a linux-based computer with a firewall. This computer does not respond to “pings”. If I run a scan with the “Full and very deep” config, the scan takes seconds and
returns no results. If I do a port scan with nmap (from my OpenVAS computer) and the –Pn parameter (treat all hosts as online), it finds several ports open
verified by the system owner.
I have cloned the “Full and very deep” config and tried to modify the port scanner section “launch nmap for network scanning” and enable “treat all hosts as online”, but still have no success
scanning and getting some results.
Help appreciated!


From: Jack Harvey
Sent: Tuesday, July 29, 2014 11:34 AM
To: openvas-***@wald.intevation.org<mailto:openvas-***@wald.intevation.org>
Subject: don't ping...

Sorry for the ignorant question. I am looking for the right scan config setting so that all hosts are treated as live.
Direction appreciated.

Jack Harvey CISSP
Synnex Corporation
864-349-4939<tel:864-349-4939>


_______________________________________________
Openvas-discuss mailing list
Openvas-***@wald.intevation.org<mailto:Openvas-***@wald.intevation.org>
https://lists.wald.intevation.org/cgi-bin/mailman/listinfo/openvas-discuss
--
http://volatile-minds.blogspot.com -- blog
http://www.volatileminds.net -- website

_______________________________________________
Openvas-discuss mailing list
Openvas-***@wald.intevation.org<mailto:Openvas-***@wald.intevation.org>
https://lists.wald.intevation.org/cgi-bin/mailman/listinfo/openvas-discuss
Loading...