McAfee MTP08EMB3RUA Product Guide - Page 159

Phase 1: Port Scan., rejects, drops, Phase 3: Web Application Scan.

Get McAfee MTP08EMB3RUA - Total Protection - PC PDF manuals and user guides
UPC - 731944568133
View all McAfee MTP08EMB3RUA manuals
Add to My Manuals
Save this manual to your list of manuals

Page 159 highlights

Using Vulnerability Scanning Frequently asked questions 9 Can a domain name resolve to multiple IP addresses? Yes. Domain names can resolve to multiple IP addresses, and each IP address will be scanned as a separate device. How much bandwidth does an audit scan use? On average, an audit scan uses 10 MB of bandwidth at a peak and creates a load equal to between 1 and 5 visitors. The bandwidth usage can vary greatly depending on the number and kind of open services. How long does scanning take? The entire scanning process takes up to 24 hours because scans are put into a queue and performed on a first-come-first-served basis, and because multiple scans are involved. In addition, the duration of each device audit scan can vary greatly based on the characteristics of the scan target. • Phase 1: Port Scan. Port scans discover all ports that are open for communication. The duration of port scan depends mostly on the type of firewall used on the target. A firewall that rejects packets to closed or filtered ports can be scanned quickly. A firewall that drops packets to closed or filtered ports can take much longer. • Typical: Less than 5 minutes • Phase 2: Network Scan. Network scans discover all the open ports and subnets. The duration of the network scan depends mostly on the number of open ports found and the types of services found on those ports. • Typical: Less than 20 minutes • Average: 40 minutes • Maximum: 3 hours • Phase 3: Web Application Scan. Web application scans find all the web pages. The duration of the web application scan depends mostly on the number of web pages on the site. • Typical: Less than 20-40 minutes • Average: 1 hour • Maximum: 4 hours How long does a discovery scan take? The duration of a discovery scan depends primarily on the size of the subnet and the type of firewall the IP addresses in the subnet are using. • A firewall that rejects packets to closed or filtered ports will take less time. • A firewall that drops packets to closed or filtered ports will take more time. • An IP address that is not configured on any device is typically treated like a firewall that drops packets. • A Class C subnet that drops packets on average takes 12 hours. McAfee Total Protection Service 5.1.5 Product Guide 159

  • 1
  • 2
  • 3
  • 4
  • 5
  • 6
  • 7
  • 8
  • 9
  • 10
  • 11
  • 12
  • 13
  • 14
  • 15
  • 16
  • 17
  • 18
  • 19
  • 20
  • 21
  • 22
  • 23
  • 24
  • 25
  • 26
  • 27
  • 28
  • 29
  • 30
  • 31
  • 32
  • 33
  • 34
  • 35
  • 36
  • 37
  • 38
  • 39
  • 40
  • 41
  • 42
  • 43
  • 44
  • 45
  • 46
  • 47
  • 48
  • 49
  • 50
  • 51
  • 52
  • 53
  • 54
  • 55
  • 56
  • 57
  • 58
  • 59
  • 60
  • 61
  • 62
  • 63
  • 64
  • 65
  • 66
  • 67
  • 68
  • 69
  • 70
  • 71
  • 72
  • 73
  • 74
  • 75
  • 76
  • 77
  • 78
  • 79
  • 80
  • 81
  • 82
  • 83
  • 84
  • 85
  • 86
  • 87
  • 88
  • 89
  • 90
  • 91
  • 92
  • 93
  • 94
  • 95
  • 96
  • 97
  • 98
  • 99
  • 100
  • 101
  • 102
  • 103
  • 104
  • 105
  • 106
  • 107
  • 108
  • 109
  • 110
  • 111
  • 112
  • 113
  • 114
  • 115
  • 116
  • 117
  • 118
  • 119
  • 120
  • 121
  • 122
  • 123
  • 124
  • 125
  • 126
  • 127
  • 128
  • 129
  • 130
  • 131
  • 132
  • 133
  • 134
  • 135
  • 136
  • 137
  • 138
  • 139
  • 140
  • 141
  • 142
  • 143
  • 144
  • 145
  • 146
  • 147
  • 148
  • 149
  • 150
  • 151
  • 152
  • 153
  • 154
  • 155
  • 156
  • 157
  • 158
  • 159
  • 160
  • 161
  • 162
  • 163
  • 164
  • 165
  • 166
  • 167
  • 168
  • 169
  • 170
  • 171
  • 172
  • 173
  • 174
  • 175
Can a domain name resolve to multiple IP addresses?
Yes.
Domain names can resolve to multiple IP addresses, and each IP address will be scanned as a
separate device.
How much bandwidth does an audit scan use?
On average, an audit scan uses 10 MB of bandwidth at a peak and creates a load equal to between 1
and 5 visitors.
The bandwidth usage can vary greatly depending on the number and kind of open services.
How long does scanning take?
The entire scanning process takes up to 24 hours because scans are put into a queue and performed
on a first-come-first-served basis, and because multiple scans are involved. In addition, the duration
of each device audit scan can vary greatly based on the characteristics of the scan target.
•
Phase 1: Port Scan.
Port scans discover all ports that are open for communication. The duration
of port scan depends mostly on the type of firewall used on the target. A firewall that
rejects
packets to closed or filtered ports can be scanned quickly. A firewall that
drops
packets to closed
or filtered ports can take much longer.
•
Typical: Less than 5 minutes
•
Phase 2: Network Scan.
Network scans discover all the open ports and subnets. The duration of
the network scan depends mostly on the number of open ports found and the types of services
found on those ports.
•
Typical: Less than 20 minutes
•
Average: 40 minutes
•
Maximum: 3 hours
•
Phase 3: Web Application Scan.
Web application scans find all the web pages. The duration of
the web application scan depends mostly on the number of web pages on the site.
•
Typical: Less than 20-40 minutes
•
Average: 1 hour
•
Maximum: 4 hours
How long does a discovery scan take?
The duration of a discovery scan depends primarily on the size of the subnet and the type of firewall
the IP addresses in the subnet are using.
•
A firewall that
rejects
packets to closed or filtered ports will take less time.
•
A firewall that
drops
packets to closed or filtered ports will take more time.
•
An IP address that is not configured on any device is typically treated like a firewall that drops packets.
•
A Class C subnet that
drops
packets on average takes 12 hours.
Using Vulnerability Scanning
Frequently asked questions
9
McAfee Total Protection Service 5.1.5 Product Guide
159