This section collects frequently asked questions with answers.
A scan slave is controlled by a scan master for doing vulnerability scans. Scans for scan slaves are configure on the scan master by each user as needed and permitted. GSM’s from midrange upward can act as a master and control one or many scan slaves. Any GSM can act as a scan slave. Any scan slave has to take care on its own to update the feed and release.
A scan sensor is a GSM that solely works as scan slave but is also fully managed by the master unit. This management includes automatic feed and release updates. Essentially, a sensor does not require any other connection than to its master and, once installed, does not require any administrative works.
The performance of a scan depends on various aspects.
Several port scanners were activated concurrently.
If your are using a individual Scan Config please take care to select only a single port scanner in the family “Port Scanner”. Of course “Ping Host” can still be activated.
Unused IP addresses are scanned very time-consuming.
In a first phase for each IP address it is detected whether a active system is present. In case it is not, this IP will not be scanned. Firewalls and other systems can prevent a successful detection. The NVT “Ping Host” (220.127.116.11.4.1.25618.104.22.168315) offers to fine-tune detection.
For many vulnerability tests the behaviour of real attacks is applied. Even though a real attack does not happen, some security tools will issue an alarm.
Known examples are:
When testing port 5900 or configured VNC port, a window appears on scanned target system that asks the user whether to allow the connection. This was observed for UltraVNC Version 1.0.2.
Solution: Exclude port 5900 or other configured VNC port from target specification. Alternatively upgrade to a newer version of UltraVNC would help (UltraVNC 22.214.171.124.1 only uses balloons to inform users).
(This is not relevant for virtual appliances where no factory reset is integrated anyway)
A Factory Reset deletes the whole system including the subscription key. The key is mandatory for Feed-Update and System-Upgrade.
Reactivate subscription key:
A backup key is delivered with each GSM appliance, usually stored on a USB Stick and labelled with the key ID. Use this key to reactivate the GSM. The activation is described in the SetUp Guide of the respective GSM type.
Update system to current version:
Depending on the age of the factors emergency system you now need to execute the respective upgrade procedure.