[Snort-users] Nmap scan causes X1msgs logs to grow quickly

Jefferson, Shawn Shawn.Jefferson at ...14448...
Tue Mar 23 17:32:05 EDT 2010


Sort of off-topic, but related to the attribute table nmap scan for hogger.  We have some Sun Solaris machines with VNC installed, set to no authentication (you need to connect in x-windows though).  Running an nmap scan with these settings, nmap -sV -T4 -oN scan.nmap 192.168.1.0/24, these servers X1msgs files begin to grow quickly and end up eating all space on the drive (even after the scan has been cancelled).  The message filling up the logs is:

XserverDesktop: XserverDesktop::wakeupHandler: unable to accept new
              connection: Invalid argument (22)
 XserverDesktop: XserverDesktop::wakeupHandler: unable to accept new
              connection: Invalid argument (22)
 XserverDesktop: XserverDesktop::wakeupHandler: unable to accept new
              connection: Invalid argument (22)
 XserverDesktop: XserverDesktop::wakeupHandler: unable to accept new
              connection: Invalid argument (22)

I've noticed this in the past doing Nessus scans, and the option that stopped this was happening was "Open port recheck" under General plugins.  Has anyone on the list seen something similar and do you know why this occurs, and hopefully how to fix it?  I figured this might be a good place to ask...

--
Shawn

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20100323/f39f3399/attachment.html>


More information about the Snort-users mailing list