Snort mailing list archives

Nmap scan causes X1msgs logs to grow quickly


From: "Jefferson, Shawn" <Shawn.Jefferson () bcferries com>
Date: Tue, 23 Mar 2010 15:32:05 -0600

Sort of off-topic, but related to the attribute table nmap scan for hogger.  We have some Sun Solaris machines with VNC 
installed, set to no authentication (you need to connect in x-windows though).  Running an nmap scan with these 
settings, nmap -sV -T4 -oN scan.nmap 192.168.1.0/24, these servers X1msgs files begin to grow quickly and end up eating 
all space on the drive (even after the scan has been cancelled).  The message filling up the logs is:

XserverDesktop: XserverDesktop::wakeupHandler: unable to accept new
              connection: Invalid argument (22)
 XserverDesktop: XserverDesktop::wakeupHandler: unable to accept new
              connection: Invalid argument (22)
 XserverDesktop: XserverDesktop::wakeupHandler: unable to accept new
              connection: Invalid argument (22)
 XserverDesktop: XserverDesktop::wakeupHandler: unable to accept new
              connection: Invalid argument (22)

I've noticed this in the past doing Nessus scans, and the option that stopped this was happening was "Open port 
recheck" under General plugins.  Has anyone on the list seen something similar and do you know why this occurs, and 
hopefully how to fix it?  I figured this might be a good place to ask...

--
Shawn

------------------------------------------------------------------------------
Download Intel&#174; Parallel Studio Eval
Try the new software tools for yourself. Speed compiling, find bugs
proactively, and fine-tune applications for parallel performance.
See why Intel Parallel Studio got high marks during beta.
http://p.sf.net/sfu/intel-sw-dev
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users

Current thread: