The remote host is running a Tofu server.  Tofu is a network gaming engine. Make sure this service has been installed in accordance to your security policy.

The remote host is running Ventrilo, a voice over IP (VoIP) software developed by Flagship Industries.

The remote host is running the HP OpenView Network Node Management Alarm Service.  This service is part of the HP OpenView Management suite.

The remote host is running an HP OpenView UI Process Manager daemon on this port.

The remote host runs a Tetrinet game server on this port.  Make sure the use of this software is done in accordance to your security policy.

The remote host is running HP OpenView Topology Manager Daemon for IP discovery and layout. This service is part of the HP OpenView Management suite.

HP Data Protector (formerly HP OpenView Storage Data Protector), a data management solution that automates backup and recovery, is running on the remote host.

The remote host is running EMC Legato Networker backup software or one of these variants :

 - Sun StorEdge Enterprise Backup Software
 - Sun Solstice Backup Software
 - Informix Storage Manager

The BrightStor ARCServe MSSQL Agent is installed on the remote host.

UltraVNC seems to be running on the remote port. 

Upon connection, the remote service on this port always sends the same 12 pseudo-random bytes. 

It is probably UltraVNC with the old DSM encryption plugin.  This plugin tunnels the RFB protocol into a RC4-encrypted stream. 

This old protocol does not use a random IV so the RC4 pseudo random flow is reused from one session to another.  An authenticated user could leverage this issue to decrypt other users' sessions.

This script checks the remote VNC server protocol version and the available 'security types'.

The remote host is running the CA eTrust Intrusion Detection System service.

The reporting console for Dragon, a network intrusion detection system distributed by Enterasys, is running on this port.

The remote host is running FlexCast, an audio/video streaming server.

The Entropy Gathering Daemon is running on the remote host.
EGD is a user space random generator for operating systems that lack /dev/random

The remote ident/authd server returns random tokens instead of leaking real user IDs (this is a good thing).  It may be slidentd or some other fake identd.

The remote host is running Computer Associates eTrust Antivirus, Threat Manager or Anti-Spyware administration server.

The File Alteration Monitor daemon (famd) is running on this port. This service does not need to be reachable from the outside, it is therefore recommended that reconfigure it to disable network access.

The remote host appears to be running Kerio Winroute Firewall Admin service. It is recommended to block incoming traffic to this port.

Also, make sure the use of this software matches your corporate security policy.

The remote host appears to be running the Kerio Admin MailServer Admin Service on this port.

The remote host appears to be running the Kerio Personal Firewall Admin service on this port. It is recommended that this port is not reachable from the outside.

Also, make sure that the use of this software is done in accordance with your corporate security policy.

The remote host is running the BrightStor ARCServe UniversalAgent on this port.

The remote host seems to be running Hydrogen, a backdoor used by penetration testers to gather screen shots, download files or gain control of the remote host.

Make sure that the use of this software on the remote host is done in accordance with your security policy.

It was possible to identify the remote service by its banner or by looking at the error message it sends when it receives an HTTP request.

The remote host appears to run ISS deployment manager. Connections are allowed to the web interface to remote install various SiteProtector components.

Letting attackers know that you are using this software will help them to focus their attack or will make them change their strategy.

In addition to this, an attacker may attempt to set up a brute-force attack to log into the remote interface.

The remote host seems to be running the IDA Pro Disassembler program.

The remote host is running a Sybase SQL server.

The remote device seems to be a Rio Karma MP3 player, running the Rio Kama file upload service.

Make sure the use of such network devices are done in accordance with your corporate security policy.

The remote service is the TCP contact port for Timbuktu, a remote control software application for Windows and Mac OS X.

This script detects if the remote system has a Danware NetOp program enabled and running on UDP.  These programs are used for remote system administration, for telecommuting and for live online training.  They also usually allow authenticated users to access the local system remotely.

This script detects if the remote system has a Danware NetOp program enabled and running on TCP.  These programs are used for remote system administration, for telecommuting and for live online training.  They also usually allow authenticated users to access the local system remotely.

If an attacker can log into the IntruShield Management Console on the remote host, the attacker will have the ability to modify sensor configuration.

The remote host seems to be running Check Point InterSpect, an internet security gateway. 

The Nessus host is likely to have been put in quarantine, its activity will be dropped for 30 minutes by default.

This plugin is a complement of find_service1.nasl.  It attempts to identify services that return 3 ASCII digits codes (ie: FTP, SMTP, NNTP, ...)

This plugin is a complement of find_service1.nasl.  It attempts to identify common services which might have been missed because of a network problem.

Cfengine is a language-based system for testing and configuring Unix systems attached to a TCP/IP network.

The remote host is running distcc, a distributed GCC compiler.  distcc allows a user to use the resources several hosts to compile his programs more quickly. 

As distcc allows anyone to execute arbitrary commands on the remote host, it should be configured to only accept connections from a restricted set of IP addresses, otherwise an attacker can use it to obtain an interactive shell on the remote host with the privileges of the distcc daemon (usually 'distccd').

The remote host is running the Subversion server.  Subversion is a software product which is similar to CVS in that it manages file revisions and can be accessed across a network by multiple clients.

H323 is a protocol used all over the Internet.  It is used for Voice Over IP (VoIP), Microsoft NetMeeting, and countless other applications.  Nessus was able to determine that the remote device supports the H323 protocol. 

Make sure the use of this program is done in accordance with your corporate security policy.

The remote service is the web interface for eMule, an eDonkey2000 compatible peer-to-peer file sharing application.

The remote service understands the Bonjour (also known as ZeroConf or mDNS) protocol, which allows anyone to uncover information from the remote host such as its operating system type and exact version, its hostname, and the list of services it is running. 

This plugin attempts to discover mDNS used by hosts that are not on the network segment on which Nessus resides.

The remote host is running a version of HALO Network Server.  The server is used to host Internet and Local Area Network (LAN) games.

The remote host is running a version of Unreal Tournament Server. The Server is used to host Internet and Local Area Network (LAN) games.

Yahoo Messenger is running on this machine and listening on this port. It allows a user to chat and share files with remote entities.

The remote system is running software that speaks the Session Initiation Protocol (SIP).

SIP is a messaging protocol to initiate communication sessions between systems.  It is a protocol used mostly in IP Telephony networks / systems to setup, control, and teardown sessions between two or more systems.

The remote host seems to be enabled to do Internet Key Exchange (IKE) version 1. This is typically indicative of a VPN server. VPN servers are used to connect remote hosts into internal resources. 

Make sure that the use of this VPN endpoint is done in accordance with your corporate security policy. 

Note that if the remote host is not configured to allow the Nessus host to perform IKE/IPSEC negotiations, Nessus won't be able to detect the IKE service. 

Also note that this plugin does not run over IPv6.

SAP DB or MaxDB, an ERP software, is running on the remote port.

The remote host is running HELLO, an obsolete routing protocol.
If possible, this IP protocol should be disabled.

The remote host is running EGP, an obsolete routing protocol. 

If possible, this IP protocol should be disabled.

The remote host is running BGP, a popular routing protocol.  This indicates that the remote host is probably a network router.

ID	Name	Severity
19758	Tofu Server Detection	info
19717	Ventrilo Server Detection	info
19706	HP OpenView NNM Alarm Service Detection	info
19701	HP OpenView UI Process Manager Daemon Detection	info
19608	Tetrinet server detection	info
19607	HP OpenView Topology Manager Daemon Detection	info
19601	HP Data Protector Detection	info
19557	EMC Legato Networker Detection	info
19376	CA ARCServe MSSQL Agent Detection	info
19289	UltraVNC w/ DSM Plugin Detection	medium
19288	VNC Server Security Type Detection	info
18536	CA eTrust Intrusion Detection System Detection	info
18532	Enterasys Dragon Enterprise Reporting Detection	info
18428	FlexCast Server Detection	info
18393	Entropy Gathering Daemon (EGD) Detection	info
18373	slident / fake identd Detection	info
25200	CA InoWeb Detection	info
18186	File Alteration Monitor daemon (famd) Detection	low
18185	Kerio Winroute Firewall Admin Service Detection	info
18184	Kerio Mailserver Admin Service Detection	info
18183	Kerio Personal Firewall Admin Service Detection	info
18040	CA ARCServe UniversalAgent Detection	info
18039	Hydrogen Detection	info
17975	Service Detection (GET request)	info
17585	ISS Deployment Manager Detection	info
17258	IDA Pro Disassembler Software Detection	info
17161	Sybase TCP/IP Listener Service Detection	info
16462	Rio Karma MP3 Player File Upload Service Detection	info
15891	Timbuktu Detection (TCP)	info
15766	NetOp Products Detection (UDP)	info
15765	NetOp Products Detection (TCP)	info
15615	McAfee IntruShield Management Console Detection	info
15614	Check Point InterSpect Detection	info
14773	Service Detection: 3 ASCII Digit Code Responses	info
14772	Service Detection (2nd Pass)	info
14315	Cfengine Detection	info
12638	DistCC Detection	high
12259	Subversion Server Detection	info
12243	H323 Protocol / VoIP Application Detection	info
12233	eMule Web Server Detection	info
12218	mDNS Detection (Remote Network)	medium
12117	HALO Network Server Detection	info
12115	Unreal Tournament Server Detection	info
11993	Yahoo Messenger Detection	info
21642	Session Initiation Protocol Detection	info
11935	IPSEC Internet Key Exchange (IKE) Version 1 Detection	info
11929	SAP DB / MaxDB Detection	info
11913	DCN HELLO detection	info
11908	EGP Detection	info
11907	BGP Service Detection	info

Detections

Analytics

Service detection Family for Nessus

info

info

info

info

info

info

info

info

info

medium

info

info

info

info

info

info

info

low

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

high

info

info

info

medium

info

info

info

info

info

info

info

info

info