Nessus Host Discovery: Unraveling the Mystery

When it comes to vulnerability management, comprehensive and fast host discovery scans are essential components. In our organization's Tenable.sc instance, we recently took a closer look at the discovery scans configured to improve their speed and efficiency. In this article, we'll delve into the intricacies of Nessus host discovery and explore some common misconceptions.

One of the most confusing aspects of Nessus scanning is the 'Ping' portion, which aims to find one piece of evidence that a host is live rather than revealing all the ways it's alive. This is because successful pings may precede subsequent attempts, rendering them unnecessary. For instance, if we specify certain ports to be 'pinged,' they won't actually be targeted.

What's more illuminating is Nessus' ping hierarchy, where it will attempt certain ping methods first and only move on to subsequent methods if the initial ones are unsuccessful. This hierarchy is specified in the built-in config file, which outlines ping methods and port targets.

Another common misconception is why Nessus scans ports that haven't been explicitly targeted. According to Tenable, this can't be avoided due to the nature of scanning. In fact, an engineer from Tenable recently reached out to clarify some of the peculiar behavior described in our original post.

To illustrate this point, let's consider a recent example. I disabled all port scanning and service discovery switches, leaving only ICMP and TCP ping switches on with destination ports 22,80,135,139,443, and 4. The resulting scan policy had only two plugins: the FQDN plugin (12053) and the standard 'Nessus Scan Information' plugin (19506).

By whittling down our scan policy to these essential components, we gained a better understanding of Nessus' host discovery capabilities. We also discovered that the TCP ping port 1337 is included for demonstration purposes only.

In conclusion, while Nessus may not always be forthcoming about its methods, it's clear that there are valid reasons behind its behavior. By understanding the intricacies of Nessus host discovery and taking steps to optimize our scan policies, we can improve the speed and efficiency of our vulnerability management program.