This plugin runs a UDP port scan against the target. It is possible to determine which UDP ports are open by sending UDP packets on every port. If the port is open, the application will most often keep quiet.
If the port is closed, the TCP/IP stack may send back an ICMP Host unreachable / bad port packet. However, this is assuming there are no intermediate devices between the scanner and the target. Firewalls often block ICMP, which will prevent responses that identify closed ports. The scanning primarily relies on the absence of a response to identify open ports and in complex environments with many intermediate devices, the detection can often be unreliable.

UDP scanning takes a long time to complete. The scanner must limit the number of concurrent probes because ICMP is often rate limited. Also, since open ports do not respond, the scanner must wait for a timeout period to be reasonably sure that no response will be received.

Given the typical environments being scanned today, the results of this plugin should be thoroughly vetted and be used as weak signals for further investigation. It is likely that a large number of assets will be detected if there are intermediate devices between the scanner and the targets. Consider using the netstat or SNMP port enumeration options instead if possible.

This plugin is a SYN 'half-open' port scanner.  It shall be reasonably quick even against a firewalled target. 

Note that SYN scans are less intrusive than TCP (full connect) scans against broken services, but they might cause problems for less robust firewalls and also leave unclosed connections on the remote target, if the network is loaded.

This plugin is a classical TCP port scanner. It shall be reasonably quick even against a firewalled target.

Once a TCP connection is open, it grabs any available banner for the service identification plugins.

Note that TCP scanners are more intrusive than SYN (half open) scanners.

Using the WMI interface, Nessus was able to run 'netstat' on the remote host to enumerate the open ports.

This plugin runs amap to find open ports and identify applications on the remote host. 

See the section 'plugins options' to configure it.

This plugin runs an SNMP scan against the remote machine to find open ports.

See the section 'plugins options' to configure it.

Nessus was able to run 'netstat' on the remote host to enumerate the open ports. If 'netstat' is not available, the plugin will attempt to use 'ss'.

See the section 'plugins options' about configuring this plugin.

Note: This plugin will run on Windows (using netstat.exe) in the event that the target being scanned is localhost.

Nessus was able to determine if the remote host is alive using one or more of the following ping types :

  - An ARP ping, provided the host is on the local subnet     and Nessus is running over Ethernet.

  - An ICMP ping.

  - A TCP ping, in which the plugin sends to the remote host     a packet with the flag SYN, and the host will reply with     a RST or a SYN/ACK.

  - A UDP ping (e.g., DNS, RPC, and NTP).

ID	Name	Severity
34277	Nessus UDP Scanner	info
11219	Nessus SYN scanner	info
10335	Nessus TCP scanner	info
34220	Netstat Portscanner (WMI)	info
14663	amap (NASL wrapper)	info
14274	Nessus SNMP Scanner	info
14272	Netstat Portscanner (SSH)	info
10180	Ping the remote host	info

Detections

Analytics

Port scanners Family for Nessus

info

info

info

info

info

info

info

info