Re: Vulnerability Scanning Problem

[Michael Hornung <hornung () CAC WASHINGTON EDU>]

On Tue, 12 Dec 2006 at 08:40, Wyman Miles wrote:

|Coupling your scanner to ARP table mining only goes so far.  The host might
|be up, but if the firewall ropes in the scanner and won't let it go, you'll
|still get nothing.  And persuading the scanner to rattle off SYNs at all
|possible open ports is just a recipe for boredom and dissatisfaction.

On the contrary, firing off SYNs and getting no answer in this case is
better than nothing; it strongly suggests that the target host (or a
firewall between scanner and target) is on the network but not responding
to, or actively blocking, your SYN packets.

_____________________________________________________
 Michael Hornung          Computing & Communications
 hornung () washington edu   University of Washington