The HP LeftHand OS (formerly SAN/iQ) console discovery service, used by systems such as the HP Virtual SAN Appliance, is running on the remote host. This service allows management applications to discover storage nodes.

VMware vCenter is running on the remote host. It is an enterprise- grade computer virtualization product from VMware, Inc.

The remote host seems to be enabled to do Internet Key Exchange (IKE).
This is typically indicative of a VPN server. VPN servers are used to connect remote hosts into internal resources.

Make sure that the use of this VPN endpoint is done in accordance with your corporate security policy.

Note that if the remote host is not configured to allow the Nessus host to perform IKE/IPSEC negotiations, Nessus won't be able to detect the IKE service.

Also note that this plugin does not run over IPv6.

The remote host is running Erlang Port Mapper Daemon, which acts as a name server on all hosts involved in distributed Erlang computations.

The remote host is running an AMQP server, which provides messaging and queuing services for other applications.

The remote service is an EMC AutoStart ftAgent, which manages AutoStart defined resources.  ftAgent is a component of the EMC AutoStart, a software product to provide high availability service to enterprise applications.

The remote port is used by Winbox, a remote management tool, to administer devices running MikroTik RouterOS.

A Java Debug Wire Protocol (JDWP) server was detected on the remote host.  This is a network protocol that allows debugging of a remote Java virtual machine.  Authentication is not required to access this service.  A remote, unauthenticated attacker could connect to this service and execute arbitrary Java code.

Depending on the application being debugged, it is possible that this service will stop running after it has been detected by Nessus. As such, this plugin only runs if 'Safe checks' have been disabled.

The remote host is a printer that allows information to be obtained via PJL.

The remote service supports BJNP, a proprietary USB over IP network printing protocol from Canon.

The remote service is an EMC SMARTS application server.  It's used in various EMC Ionix products.  It's also used as the Fault Device Manager broker (brstart.exe) in Cisco Unified Service Monitor, Cisco Unified Operations Manager, and CiscoWorks LAN Management Solution. In addition, Cisco Device Fault Manager server (sm_server.exe) and Voice Health Monitor server (sm_server.exe) are seen to implement this service.

This plugin attempts to collect the banner from services listening on well-known SMTP ports.  It is not expected to report anything.

The remote service is a signon server for an IBM iSeries system.

CmdProcessor.exe is one of the processes spawned by the Trend Micro Control Manager.  It's responsible for sending XML instructions, formed by other processes, to managed products and processing product registration.  It also sends alerts, performs scheduled tasks, and applies Outbreak Prevention Policies. 

By sending a request to CmdProcessor.exe, which is listening on the default port 20101, the process can be detected.

The lockdown service, part of Apple iOS, was detected on the remote host.  This service is used to communicate with iOS devices for several tasks (e.g., Wi-Fi sync). 

Note that this plugin will only work against devices that have ever had Wi-Fi sync enabled (iOS versions 5 and later).

VMware vSphere, an enterprise server virtualization platform, is running on the remote host.

An OpenVAS Scanner daemon is listening on the remote port.  This is the component of OpenVAS that performs security scans and / or audits.

An OpenVAS Manager or OpenVAS Administrator daemon is listening on the remote port.  These are the components of OpenVAS that control the scanner and schedule tasks.

The remote host is running a Nexpose server, which is used for performing security scans.

The remote host is running a Greenbone Security Assistant server, which provides a web-based front-end to OpenVAS and related vulnerability scanning tools.

The remote host is running a SAP DIAG server, which is used to communicate with SAP GUI clients.

Microsoft Host Integration Server (HIS) is hosted on the remote host. HIS provides connectivity between Windows networks and IBM mainframe and mid-range computers.

The remote service is Symantec Veritas Enterprise Administrator, an application that provides features for administering disks, volumes, and file systems on local or remote machines.

The remote service is a Bitcoin node.  Bitcoin is an open source, peer-to-peer digital currency, and a Bitcoin node is used by a client to communicate with other peers.

Solstice Enterprise Agent (SNMP), an agent-management utility from Oracle, was detected on the remote host.

The remote host is running an OpenVPN server. Based on its responses, the remote host appears to be in TLS or preshared key mode.

The remote host is running a Citrix EdgeSight Load Tester (ESLT) server. Citrix ESLT is software used for load testing applications.

The remote service is HP iNode Management Center, a component in HP Intelligent Management Center User Access Manager (UAM) and HP Intelligent Management Center Endpoint Admission Defense (EAD).  Its main functions include unified authentication and Internet access control.

H3C / HP Intelligent Management Center (iMC), a server management application, is running on the remote host. This is a collection point for any H3C / HP Intelligent Management Center clients on the network.

Note that Intelligent Management Center (iMC) is an HPE product;
however, it is branded as H3C.

The remote service is a WINS (Windows Internet Name Service) server, which holds information about any NetBIOS-enabled hosts on the network. 

Note that the service may allow an arbitrary user to download the list, although some versions (eg, in Windows 2008) require an IP address to be specifically trusted to download the list by default.

The remote service is a Sybase M-Business Anywhere (formerly AvantGo) Sync Server, which handles synchronization requests from a mobile device and determines whether to obtain requested pages from the source web server or from a shared cache on the Sync Server itself.

The remote service is a Sybase M-Business Anywhere (formerly AvantGo) SOAP Server, which provides a web-based programming interface to server administration tasks in M-Business, such as configuration, group, user, and web channel management.

The remote device answered to a Link-local Multicast Name Resolution (LLMNR) request.  This protocol provides a name lookup service similar to NetBIOS or DNS.  It is enabled by default on modern Windows versions.

ActiveFax Server is running on this host.

The remote host is running an Eric cooperation server.  Eric is a Python IDE.

The remote host is running an HP StorageWorks File Migration Agent, which migrates rarely used files to external hosts, recalling them as needed.

Trend Micro Message Routing Framework (MRF) is running on the remote host. MRF is a component of the Trend Micro Infrastructure (TMI), which itself is a component of the Trend Micro Control Manager Architecture.

MRF interacts with Control Manager 2.x agents to communicate with managed products.

It is possible to detect Trend Micro products, like Control Manager and ServerProtect, by sending a 'heartbeat' packet to MRF.

The remote host is running a client relay service for Electronic Arts Need For Speed Underground or a clone of that game.

This is a kind of port mapper in that the service provides dynamic port numbers to client software.

The remote host is running an 'Aeonian Dreams' game server.

Microsoft Office Document Conversions Launcher is running on this port.  This service is installed by Microsoft SharePoint Server and allows for Office Documents to be converted into web documents for use in SharePoint server.

Microsoft Office Document Conversions Load Balancer is running on this port.  This service aides in the discovery of the Microsoft Office Document Conversions Launcher service and controls how jobs are routed to Conversions Launcher services.

The remote server is a UniRPC server.  Rocket Software services such as UniData and UniVerse use this RPC service.

The remote service supports the iSCSI (Internet Small Computer Systems Interface) protocol, which encapsulates the SCSI protocol over TCP/IP and allows sharing remote devices, known as 'targets', over a local- or wide-area network.

The remote host is running a DiskPulse Server, a tool that monitors changes to the filesystem and reports them to all authenticated clients.

The remote host is running an instance of Vuze Media Server.  This server is in the form of a plugin for Vuze, a BitTorrent client.

Based on its response to a TLS request with a specially crafted server name extension, it seems that the remote service is using the OpenSSL library to encrypt traffic.

Note that this plugin can only detect OpenSSL implementations that have enabled support for TLS extensions (RFC 4366).

The remote service is a Sybase PowerDesigner Repository Proxy, which allows users to issue SQL statements via an ODBC connection to be executed on the database server.

The remote host is a Novatel MiFi device, a portable access point using 3G/EVDO to connect to the Internet. 

The remote device is using the default password ('admin') for administrative access.  This may allow anyone on this network to log into the device and force it to connect/disconnect from the network.

ID	Name	Severity
64631	HP LeftHand OS Console Discovery Detection	info
63061	VMware vCenter Detect	info
62695	IPSEC Internet Key Exchange (IKE) Version 2 Detection	info
62351	Erlang Port Mapper Daemon Detection	info
62349	Advanced Message Queuing Protocol Detection	info
61489	EMC AutoStart ftAgent Detection	info
59731	MikroTik RouterOS Winbox Detection	info
58400	Java Debug Wire Protocol Detection	high
60030	Apple Profile Manager Detection	info
58184	HP Printer PJL Interface Detection	info
58147	BJNP Detection	info
58003	EMC SMARTS Application Server Detection	info
57914	Service Detection : SMTP Server on a Well-Known Port	info
57847	IBM iSeries Server Detection	info
57764	Trend Micro Control Manager CmdProcessor.exe Detection	info
57461	Apple iOS Lockdown Detection	info
57396	VMware vSphere Detect	info
56823	OpenVAS Scanner Detection	info
56822	OpenVAS Manager / Administrator Detection	info
56821	Nexpose HTTP Server Detection	info
56819	Greenbone Security Assistant detection	info
56981	SAP Dynamic Information and Action Gateway Detection	info
56632	Microsoft Host Integration Server Detection	info
56238	Symantec Veritas Enterprise Administrator Service (vxsvc) Detection	info
56195	Bitcoin Detection	info
56009	Solstice Enterprise Agent SNMP (snmpdx) Detection	info
56022	OpenVPN Server Detection	info
55926	Citrix EdgeSight Load Tester (ESLT) version detection	info
55906	HP iNode Management Center Detection	info
54998	H3C / HP Intelligent Management Center Detection	info
54629	WINS Server Detection	info
54617	Sybase M-Business Anywhere (AvantGo) Sync Server Detection	info
54616	Sybase M-Business Anywhere (AvantGo) SOAP Server Detection	info
53513	Link-Local Multicast Name Resolution (LLMNR) Detection	info
53322	ActiveFax Server Detection	info
52974	Eric Cooperation Server Detection	info
52654	HP StorageWorks File Migration Agent Detection	info
52653	Trend Micro Message Routing Framework Detection	info
52482	EA Need For Speed Underground Detection	info
52481	Aeonian Dreams Detection	info
51835	Microsoft Office Document Conversions Launcher Detection	info
51834	Microsoft Office Document Conversions Load Balancer Detection	info
51574	Rocket Software UniRPC Version Detection	info
29700	iSCSI Target Detection	info
51093	DiskPulse Server Detection	info
51060	Vuze Media Server Detection	info
50845	OpenSSL Detection	info
50704	Sybase PowerDesigner Repository Proxy Detection	info
50577	Ricoh Printer Detection	info
50514	Novatel MiFi Default Credentials	critical

Detections

Analytics

Service detection Family for Nessus

info

info

info

info

info

info

info

high

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

critical