Discovery Settings

The Discovery settings relate to discovery and port scanning, including port ranges and methods.

Tip: When you configure a Tenable-provided scan template, you can modify only the settings included for the template type. When you create a user-defined template, you can modify a custom set of settings for your scan.

Certain Tenable-provided scanner templates include preconfigured discovery settings.

To use a scanner template that does not include preconfigured discovery settings, or to override the preconfigured settings, you can manually configure Discovery settings in the following categories:

Host Discovery

By default, some settings in the Host Discovery section are enabled. When you first access the Host Discovery section, the Ping the remote host item appears and is set to On.

Setting Default Value Description
Ping the Remote Host On

Specifies whether pings remote hosts on multiple ports to determine if the hosts are alive. When set to On, General Settings and Ping Methods appear.

Note: To scan VMware guest systems, Ping the remote host must be set to Off.

Scan Unresponsive Hosts


Specifies whether the Nessus scanner scans hosts that do not respond to any ping methods. This option is only available for scans using the PCI Quarterly External Scan template.

General Settings

Use Fast Network Discovery


If a host responds to ping, attempts to avoid false positives, performing additional tests to verify the response did not come from a proxy or load balancer. Fast network discovery bypasses those additional tests.

Ping Methods



Ping a host using its hardware address via Address Resolution Protocol (ARP). This only works on a local network.



Ping a host using TCP.

Destination Ports (TCP)


Destination ports can be configured to use specific ports for TCP ping. This specifies the list of ports that are checked via TCP ping.



Ping a host using the Internet Control Message Protocol (ICMP).

Assume ICMP Unreachable From the Gateway Means the Host is Down Disabled

Assume ICMP unreachable from the gateway means the host is down When a ping is sent to a host that is down, its gateway may return an ICMP unreachable message. When this option is enabled, when receives an ICMP Unreachable message, it considers the targeted host dead. This is to help speed up discovery on some networks.

Note: Some firewalls and packet filters use this same behavior for hosts that are up, but connected to a port or protocol that is filtered. With this option enabled, this leads to the scan considering the host is down when it is indeed up.



Ping a host using the User Datagram Protocol (UDP).

UDP is a stateless protocol, meaning that communication is not performed with handshake dialogues. UDP-based communication is not always reliable, and because of the nature of UDP services and screening devices, the services and devices are not always remotely detectable.

Maximum Number of Retries 2

Specifies the number of attempts to retry pinging the remote host.

Fragile Devices

Scan Network Printers


Specifies whether scans network printers.

Scan Novell Netware Hosts


Specifies whether scans Novell NetWare hosts.

Scan Operational Technology Devices Disabled

If enabled, performs a full scan of Operational Technology (OT) devices such as programmable logic controllers (PLCs) and remote terminal units (RTUs) that monitor environmental factors and the activity and state of machinery.

If disabled, uses ICS/SCADA Smart Scanning to cautiously identify OT devices and stops scanning them once they are discovered.


List of MAC Addresses


The Wake-on-LAN (WOL) menu controls which hosts to send WOL magic packets to before performing a scan.

Hosts that you want to start prior to scanning are provided by uploading a text file that lists one MAC address per line.

For example:



Boot Time Wait (In Minutes)

5 minutes

The amount of time to wait for hosts to start before performing the scan.

Network Type

Network Type

Mixed (use RFC 1918)

Specifies if you are using publicly routable IPs, private non-Internet routable IPs, or a mix of these.

This setting has three options:

  • Mixed (use RFC 1918)
  • Private LAN
  • Public WAN (Internet)

The default value, Mixed, should be selected if you are using RFC 1918 addresses and have multiple routers within your network.

Port Scanning

The Port Scanning section includes settings that define how the port scanner behaves and which ports to scan.

Setting Default Value Description
Consider Unscanned Ports as Closed Disabled

If a port is not scanned with a selected port scanner (for example, the port falls outside of the specified range), considers it closed.

Port Scan Range Default

Two keywords can be typed into the Port scan range box.

  • default instructs to scan approximately 4,790 commonly used ports. The list of ports can be found in the nessus-services file.
  • all instructs to scan all 65,536 ports, including port 0.

Additionally, you can type a custom range of ports by using a comma-delimited list of ports or port ranges. For example, 21,23,25,80,110 or 1-1024,8080,9000-9200. If you wanted to scan all ports excluding port 0, you would type 1-65535.

The custom range specified for a port scan is applied to the protocols you have selected in the Network Port Scanners group of settings.

If scanning both TCP and UDP, you can specify a split range specific to each protocol. For example, if you want to scan a different range of ports for TCP and UDP, you would type T:1-1024,U:300-500.

You can also specify a set of ports to scan for both protocols, as well as individual ranges for each separate protocol. For example, 1-1024,T:1024-65535,U:1025.

Local Port Enumerators
SSH (netstat) Enabled

This option uses netstat to check for open ports from the local machine. It relies on the netstat command being available via an SSH connection to the target. This scan is intended for Unix-based systems and requires authentication credentials.

WMI (netstat) Enabled

A WMI-based scan uses netstat to determine open ports.

Note: If enabled, any custom range typed in the Port Scan Range box is ignored.

If any port enumerator (netstat or SNMP) is successful, the port range becomes all. still treats unscanned ports as closed if you enable the Consider unscanned ports as closed slider.

SNMP Enabled

When enabled, if the appropriate credentials are provided by the user, can better test the remote host and produce more detailed audit results. For example, there are many Cisco router checks that determine the vulnerabilities present by examining the version of the returned SNMP string. This information is necessary for these audits.

Only Run Network Port Scanners if Local Port Enumeration Failed Enabled

Rely on local port enumeration first before relying on network port scans.

Verify Open TCP Ports Found By Local Port Enumerators Disabled

If a local port enumerator (e.g., WMI or netstat) finds a port, also verifies that it is open remotely. This helps determine if some form of access control is being used (e.g., TCP wrappers, firewall).

Network Port Scanners
TCP Disabled

On some platforms (e.g., Windows and Mac OS X), enabling this scanner causes to use the SYN scanner to avoid serious performance issues native to those operating systems.

Override Automatic Firewall Detection Disabled

When enabled, this setting overrides automatic firewall detection.

This setting has three options:

  • Use aggressive detection attempts to run plugins even if the port appears to be closed. It is recommended that this option not be used on a production network.
  • Use soft detection disables the ability to monitor how often resets are set and to determine if there is a limitation configured by a downstream network device.

  • Disable detection disables the Firewall detection feature.

This description also applies to the Override automatic firewall detection setting that is available following SYN.

SYN Enabled

Use the SYN scanner to identify open TCP ports on the target hosts. SYN scans are generally considered to be less intrusive than TCP scans depending on the security monitoring device, such as a firewall or Intrusion Detection System (IDS). The scanner sends a SYN packet to the port, waits for SYN-ACK reply, and determines the port state based on a reply or lack of reply.

UDP Disabled

This option engages built-in UDP scanner to identify open UDP ports on the targets.

Due to the nature of the protocol, it is generally not possible for a port scanner to tell the difference between open and filtered UDP ports. Enabling the UDP port scanner may dramatically increase the scan time and produce unreliable results. Consider using the netstat or SNMP port enumeration options instead if possible.

Service Discovery

The Service Discovery section includes settings that attempt to map each open port with the service that is running on that port.


Default Value

General Settings
Probe All Ports to Find Services Enabled

Attempts to map each open port with the service that is running on that port.

Caution: In some rare cases, probing might disrupt some services and cause unforeseen side effects.

Search for SSL/TLS Based Services On

Controls how will test SSL-based services.

Caution: Testing for SSL capability on all ports may be disruptive for the tested host.

Search for SSL/TLS Services (enabled)
Search for SSL/TLS On Known SSL/TLS ports

This setting has two options:

  • Known SSL/TLS ports
  • All ports
Identify Certificates Expiring Within x Days 60

Identifies SSL and TLS certificates that are within the specified number of days of expiring.

Enumerate All SSL/TLS Ciphers True

When enabled, ignores the list of ciphers advertised by SSL/TLS services and enumerates them by attempting to establish connections using all possible ciphers.

Enable CRL Checking (Connects to the Internet) False When enabled, checks that none of the identified certificates have been revoked.