Discovery Scan Settings

Note: If a scan is based on a policy, you cannot configure Discovery settings in the scan. You can only modify these settings in the related policy.

Note: Settings that are required by a particular scan or policy are indicated in the Nessus interface.

The Discovery settings relate to discovery and port scanning, including port ranges and methods.

Certain Tenable-provided scanner templates include preconfigured discovery settings.

If you select the Custom preconfigured setting option, or if you are using a scanner template that does not include preconfigured discovery settings, you can manually configure Discovery settings in the following categories:

Note: The following tables include settings for the Advanced Scan template. Depending on the template you select, certain settings may not be available, and default values may vary.

Host Discovery

By default, some settings in the Host Discovery section are enabled. When you first access the Host Discovery section, the Ping the remote host item appears and is set to On.

The Host Discovery section includes the following groups of settings:

Setting Default Value Description
Ping the remote host On

If set to On, the scanner pings remote hosts on multiple ports to determine if they are alive. Additional options General Settings and Ping Methods appear.

If set to Off, the scanner does not ping remote hosts on multiple ports during the scan.

Note: To scan VMware guest systems, Ping the remote host must be set to Off.

Scan unresponsive hosts

Disabled

Specifies whether the Nessus scanner scans hosts that do not respond to any ping methods. This option is only available for scans using the PCI Quarterly External Scan template.
General Settings
Test the local Nessus host Enabled

When enabled, includes the local Nessus host in the scan. This is used when the Nessus host falls within the target network range for the scan.

Use Fast Network Discovery

 Disabled

When disabled, if a host responds to ping, Nessus attempts to avoid false positives, performing additional tests to verify the response did not come from a proxy or load balancer. These checks can take some time, especially if the remote host is firewalled.

When enabled, Nessus does not perform these checks.
Ping Methods

ARP

 Enabled

Ping a host using its hardware address via Address Resolution Protocol (ARP). This only works on a local network.

TCP

 Enabled

Ping a host using TCP.

Destination ports (TCP)

 built-in

Destination ports can be configured to use specific ports for TCP ping. This specifies the list of ports that are checked via TCP ping.

Type one of the following: built-in, a single port, or a comma-separated list of ports.

For more information about which ports built-in specifies, see the knowledge base article.

ICMP

 Enabled

Ping a host using the Internet Control Message Protocol (ICMP).
Assume ICMP unreachable from the gateway means the host is down Disabled

Assume ICMP unreachable from the gateway means the host is down. When a ping is sent to a host that is down, its gateway may return an ICMP unreachable message. When this option is enabled, when the scanner receives an ICMP Unreachable message, it considers the targeted host dead. This approach helps speed up discovery on some networks.

Note: Some firewalls and packet filters use this same behavior for hosts that are up, but connected to a port or protocol that is filtered. With this option enabled, this leads to the scan considering the host is down when it is indeed up.
Maximum number of retries 2

Specifies the number of attempts to retry pinging the remote host.

UDP

 Disabled

Ping a host using the User Datagram Protocol (UDP). UDP is a stateless protocol, meaning that communication is not performed with handshake dialogues. UDP-based communication is not always reliable, and because of the nature of UDP services and screening devices, they are not always remotely detectable.
Fragile Devices

Scan Network Printers

 Disabled

When enabled, the scanner scans network printers.

Scan Novell Netware hosts

 Disabled

When enabled, the scanner scans Novell NetWare hosts.
Scan Operational Technology devices Disabled

When enabled, the scanner performs a full scan of Operational Technology (OT) devices such as programmable logic controllers (PLCs) and remote terminal units (RTUs) that monitor environmental factors and the activity and state of machinery.

When disabled, the scanner uses ICS/SCADA Smart Scanning to cautiously identify OT devices and stops scanning them once they are discovered.
Wake-on-LAN

List of MAC Addresses

 None

The Wake-on-LAN (WOL) menu controls which hosts to send WOL magic packets to before performing a scan.

Hosts that you want to start prior to scanning are provided by uploading a text file that lists one MAC address per line.

For example:

33:24:4C:03:CC:C7

FF:5C:2C:71:57:79

Boot time wait (in minutes)

 5

The amount of time to wait for hosts to start before performing the scan.

Port Scanning

The Port Scanning section includes settings that define how the port scanner behaves and which ports to scan.

The Port Scanning section includes the following groups of settings:

Setting Default Value Description
Ports
Consider Unscanned Ports as Closed Disabled

When enabled, if a port is not scanned with a selected port scanner (for example, the port falls outside of the specified range), the scanner considers it closed.
Port Scan Range Default

Specifies the range of ports to be scanned.

Supported keyword values are:

  • default instructs the scanner to scan approximately 4,790 commonly used ports. The list of ports can be found in the nessus-services file.
  • all instructs the scanner to scan all 65,536 ports, including port 0.

Additionally, you can indicate a custom list of ports by using a comma-delimited list of ports or port ranges. For example, 21,23,25,80,110 or 1-1024,8080,9000-9200. If you wanted to scan all ports excluding port 0, you would type 1-65535.

The custom range specified for a port scan is applied to the protocols you have selected in the Network Port Scanners group of settings.

If scanning both TCP and UDP, you can specify a split range specific to each protocol. For example, if you want to scan a different range of ports for TCP and UDP in the same policy, you would type T:1-1024,U:300-500.

You can also specify a set of ports to scan for both protocols, as well as individual ranges for each separate protocol. For example, 1-1024,T:1024-65535,U:1025.

You can also include default in a list of custom ports. For example, T:64999,default,U:55550-55555.
Local Port Enumerators
SSH (netstat) Enabled

When enabled, the scanner uses netstat to check for open ports from the local machine. It relies on the netstat command being available via an SSH connection to the target. This scan is intended for Linux-based systems and requires authentication credentials.
WMI (netstat) Enabled

When enabled, the scanner uses netstat to determine open ports while performing a WMI-based scan.

In addition, the scanner:

  • Ignores any custom range specified in the Port Scan Range setting.
  • Continues to treat unscanned ports as closed if the Consider unscanned ports as closed setting is enabled.

If any port enumerator (netstat or SNMP) is successful, the port range becomes all.
SNMP Enabled

When enabled, if the appropriate credentials are provided by the user, the scanner can better test the remote host and produce more detailed audit results. For example, there are many Cisco router checks that determine the vulnerabilities present by examining the version of the returned SNMP string. This information is necessary for these audits.
Only run network port scanners if local port enumeration failed Enabled

When enabled, the scanner relies on local port enumeration first before relying on network port scans.
Verify open TCP ports found by local port enumerators Disabled

When enabled, if a local port enumerator (for example, WMI or netstat) finds a port, the scanner also verifies that the port is open remotely. This approach helps determine if some form of access control is being used (for example, TCP wrappers or a firewall).
Network Port Scanners
TCP Disabled

Use the built-in Nessus TCP scanner to identify open TCP ports on the targets, using a full TCP three-way handshake. TCP scans are only possible if you are using Linux or FreeBSD. On Windows or Mac OS X, the scanner does not do a TCP scan and instead uses the SYN scanner to avoid performance issues native to those operating systems.

If you enable this option, you can also set the Override Automatic Firewall Detection option.
SYN Enabled

Use the built-in Nessus SYN scanner to identify open TCP ports on the target hosts. SYN scans do not initiate a full TCP three-way handshake. The scanner sends a SYN packet to the port, waits for SYN-ACK reply, and determines the port state based on a response or lack of response.

If you enable this option, you can also set the Override Automatic Firewall Detection option.

Override automatic firewall detection Disabled

This setting can be enabled if you enable either the TCP or SYN option.

When enabled, this setting overrides automatic firewall detection.

This setting has three options:

  • Use aggressive detection attempts to run plugins even if the port appears to be closed. It is recommended that this option not be used on a production network.

  • Use soft detection disables the ability to monitor how often resets are set and to determine if there is a limitation configured by a downstream network device.

  • Disable detection disables the firewall detection feature.

This description also applies to the Override automatic firewall detection setting that is available following SYN.
UDP Disabled

This option engages the built-in Nessus UDP scanner to identify open UDP ports on the targets.

Due to the nature of the protocol, it is generally not possible for a port scanner to tell the difference between open and filtered UDP ports. Enabling the UDP port scanner may dramatically increase the scan time and produce unreliable results. Consider using the netstat or SNMP port enumeration options instead if possible.

Service Discovery

The Service Discovery section includes settings that attempt to map each open port with the service that is running on that port.

The Service Discovery section includes the following groups of settings:

Setting

Default Value

 Description
General Settings
Probe all ports to find services Enabled

When enabled, the scanner attempts to map each open port with the service that is running on that port.

Caution: In some rare cases, probing might disrupt some services and cause unforeseen side effects.
Search for SSL based services On

Controls how the scanner tests SSL-based services.

Caution: Testing for SSL capability on all ports may be disruptive for the tested host.
Search for SSL/TLS Services (enabled)
Search for SSL/TLS on Known SSL/TLS ports

Specifies which ports on target hosts the scanner searches for SSL/TLS services.

This setting has two options:

  • Known SSL/TLS ports
  • All TCP ports
Identify certificates expiring within x days 60

When enabled, the scanner identifies SSL and TLS certificates that are within the specified number of days of expiring.
Enumerate all SSL ciphers True

When enabled, the scanner ignores the list of ciphers advertised by SSL/TLS services and enumerates them by attempting to establish connections using all possible ciphers.
Enable CRL checking (connects to internet) False

When enabled, the scanner checks that none of the identified certificates have been revoked.