Mailing List Archive: Nessus 3.2.1 Crashing Ubuntu 8.04 x86 host

Nessus 3.2.1 Crashing Ubuntu 8.04 x86 host

Nov 5, 2008, 1:22 PM

Post #1 of 3 (2889 views)

Nessus is hard locking my laptop randomly during scans, it isn't a
kernel panic, it just completely locks up, no console, no ssh access.

It randomly happens, I can't trace it to a specific host that is being
scanned or nasl that is being run. I have looked into nessusd.messages &
nessusd.dump and neither of them have any error messages (besides the norm.)

What steps are suggested to help diagnose what could be causing my problem?

Here is want is in my /var/log/messages right before I had to hard power
off to reboot.Nov 5 13:25:13 battleship kernel: [ 2236.892663] netlink:
4 bytes leftover after parsing attributes.
Nov 5 13:25:13 battleship kernel: [ 2237.397368] netlink: 4 bytes
leftover after parsing attributes.
Nov 5 13:25:15 battleship kernel: [ 2239.378548] netlink: 4 bytes
leftover after parsing attributes.
Nov 5 13:25:15 battleship kernel: [ 2239.685231] netlink: 4 bytes
leftover after parsing attributes.
Nov 5 13:25:16 battleship kernel: [ 2240.693971] netlink: 4 bytes
leftover after parsing attributes.
Nov 5 13:25:21 battleship kernel: [ 2245.471841] netlink: 4 bytes
leftover after parsing attributes.
Nov 5 13:25:22 battleship kernel: [ 2246.069590] netlink: 4 bytes
leftover after parsing attributes.
Nov 5 13:25:23 battleship kernel: [ 2247.200498] netlink: 4 bytes
leftover after parsing attributes.
Nov 5 13:31:35 battleship syslogd 1.5.0#1ubuntu1: restart.

Any suggestions for testing would be much appreciated.

Thanks,
Bismark

Re: Nessus 3.2.1 Crashing Ubuntu 8.04 x86 host [ In reply to ]

rgula at tenablesecurity

Nov 5, 2008, 5:22 PM

Post #2 of 3 (2783 views)

Permalink

Hi Bismark,

Could be Nessus or it could be Ubuntu. If anyone else is having a similar
issue, I would like to know.

Here are random things you could try, as there are many reasons that your
laptop could have a crash of some sort:

- I didn't do extensive research, but the error message in your logs seems
to show up when 64 bit apps are run on 32 systems and vice-versa. Did
you install Nessus 64 bit on a 32 bit system or in anyway have a hardware
compatibility issue there?

- Try a slower scan. If the crash happens less often, you may have some
sort of capacity issue such as limited memory.

- Are you scanning yourself? There could be a daemon (X Windows, VNC,
RPC, print, .etc, .etc) that has some sort of DOS that is un-known.

- Are you sniffing on your laptop? There could be an issue with the
kernel being placed into promiscuous mode along with Nessus. If you
are running ntop, snort, .etc during the scan, you might be exercising
the kernel a certain way.

- Do you have multiple NICs, virtual NICs, or any other type of IP
addressing, routing or tunneling, that could be causing a self-inflicted
DOS attack. Use the netstat and ifconfig commands to look at packet
counts and such.

Ron Gula
Tenable Network Security
_______________________________________________
Nessus mailing list
Nessus@list.nessus.org
http://mail.nessus.org/mailman/listinfo/nessus

Re: Nessus 3.2.1 Crashing Ubuntu 8.04 x86 host [ In reply to ]

bismark at foofus

Nov 7, 2008, 1:25 PM

Post #3 of 3 (2760 views)

Permalink

Ron Gula wrote:
> Hi Bismark,
>
> Could be Nessus or it could be Ubuntu. If anyone else is having a similar
> issue, I would like to know.
>
> Here are random things you could try, as there are many reasons that your
> laptop could have a crash of some sort:
>
> - I didn't do extensive research, but the error message in your logs seems
> to show up when 64 bit apps are run on 32 systems and vice-versa. Did
> you install Nessus 64 bit on a 32 bit system or in anyway have a hardware
> compatibility issue there?

Actually it was not a problem with the OS or Nessus but with the
hardware, had a massive melt down of the memory. I'm on a replacement
system and I am working fine.

However I am curious about the netlink error messages, I have also
looked for more on that message because it comes up every time I scan.
However I have not found anything detailing what it actually means or
what causes it.

--
Bismark

Mailing List Archive

Attached Files:

Attached Files: