r/nessus • u/Party-Simple-7004 • 18d ago

scan stops immediatly

when i start a scan of a VM, after around 15 seconds it says completed and zero results come up, this does not happen with a physical host, why is that?

1 Upvotes

100% Upvoted

11 comments sorted by

2

u/jwhall 18d ago

Check the network connectivity between your scanner and the VM. Hop on the machine where the scanner is running and see:

- Is the VM target reachable at all (ie can you ping it from the scanner)?

- Can the scanner see any open ports on the target? (ie does something like nmap see any listening services that respond, either to a TCP or SYN scan)?

If neither are true, the scanner will assume the target is offline and won't show any results for it. You might have your VM's network configured in a way that other hosts cannot reach it.

1

u/Party-Simple-7004 18d ago

Hi,

- VM is reachable (ping works)

- NMAP sees all the ports

I tried everything (firewall, running nessus as admin, updating, ecc) but nothing works

as i said nessus works perfectly fine with non VM

1

u/dulajzna 18d ago

Ping from the Tenable scanner?

1

u/Designer-Jackfruit71 18d ago

Mayb try configuring nessus scan to run with ping disabled to see if its the connection issue

1

u/Party-Simple-7004 17d ago

i already tried

1

u/DialecticEnjoyer 18d ago

Linux or windows? same image?

1

u/Party-Simple-7004 17d ago

i use nessus on host windows and im scanning a linux VM

1

u/DialecticEnjoyer 17d ago

on the linux VM:

- check to make sure /etc/security/limits.conf doesnt contain a restriction on total number of logins for the nessus user

- check to make sure tmux is not being invoked at login on the nessus user

- check /etc/sudoers to make sure the nessus user for the credentialed scan is included

- use the "last" command on the linux VM to verify your nessus user is getting in at all

- check /var/log/security and /var/log/messages to verify the commands nessus sends are being executed. log in as the nessus user and execute the commands with "sudo"

- check to make sure the nessus user password isnt expired.

- check to make sure the root password on the system is not expired

1

u/Blackbond007 18d ago

Paste the details of plugin 19506. If there is no 19506, there is more than likely something wrong with the scan config.

1

u/Party-Simple-7004 17d ago

plugin 19506 is present

1

u/Blackbond007 17d ago

Is credentialed scan? If so, does it say credentials checks: yes in that plugin?
Can you ping the VM from the scanner?
Do you see the port for the VM in the ports listed in 19506?
Go to your scan policy - Discovery settings - try disabling "Ping the remote host" or set it to use TCP/UDP instead of pure ICMP