This page concerns running scans and managing scan engines.
InsightVM is sending out hundreds of e-mails during a scan. Why is it doing this, and what can I do to stop it?
The Web spider performs a number of tests, such as SQL injection tests, which involve constantly submitting Web application forms. After InsightVM submits a form, it no longer can get information about what is happening on the target server or database. Without that feedback, InsightVM simply continues its testing process. If a target application does have not mechanisms for limiting excessive submissions or for scrubbing submissions with inappropriate characters, such as special characters or symbols, it will simply keep posting the submissions. If the posting method is e-mail, these tests can trigger a high volume of e-mails in a short period.
An excessive number of postings can result in a denial of service. You can configure the Web spider to avoid pages that are susceptible to this problem. Specify these pages in the robots.txt file or modify the scan template to exclude certain paths. See Configuring Web spidering.
Note also that allowing a user to submit a form approximately 100 times within a short time span is a vulnerability in and of itself.
You should also contact your Web administrator to set up controls for scrubbing form data and limiting submissions.
How does InsightVM perform discovery scans?
Discovery scans occur in two sequential phases: device discovery and service discovery.
Device, or asset discovery
During this initial phase, InsightVM sends connection requests to target assets to verify that they are alive and available for scanning. InsightVM uses any of three methods to contact these assets:
Service discovery
InsightVM also uses different methods for performing TCP service discovery. It can send packets with the SYN flag, or SYN+RST, or SYN+FIN, or SYN+ECE. If it receives a SYN response, the port is open. If it receives an RST response, InsightVM considers the port closed.
You can configure which methods InsightVM uses for discovery scan phases. See
Configuring asset discovery and Configuring service discovery.
What are the network and port requirements for InsightVM to function properly?
The InsightVM Security Console communicates over the network to perform four major activities:
| Activity | Type of communication |
|---|---|
| manage scan activity on InsightVM Scan Engines and pull scan data from them | outbound; scan engines listen on 40814 |
| download vulnerability checks and feature updates from a server at updates.rapid7.com | outbound; server listens on port 80 |
| upload PGP-encrypted diagnostic information to a server at support.rapid7.com | outbound; server listens on port 443 |
| provide Web interface access to InsightVM users | inbound; console accepts HTTPS requests over port 3780 |
InsightVM Scan Engines contact target assets using TCP, UDP, and ICMP to perform scans. Scan engines do not initiate outbound communication with the InsightVM Security Console.
Ideally there should be no firewalls or similar devices between a scan engine and its target assets. See the following topic.
Scanning may also require some flexibility in security policies. For more information, see the administrator's guide. You can download this document from the Support page.
What changes do I need to make on my Windows firewall to allow InsightVM to scan accurately?
In a domain-joined environment, you must enable two group policy settings :
In a standalone environment, you must start Remote Registry to allow InsightVM to fingerprint remote scan targets accurately.
You must also enable two standard profile settings:
Windows Vista requires additional steps:
For detailed instructions on how to perform these steps, consult appropriate Microsoft documentation.
When I run the Linux top command, why does it appear that InsightVM using all available memory even after the scan is complete?
The host that is running InsightVM uses all memory allocated to the Java Virtual Machine (JVM) for scanning and for any InsightVM system functions. This is important to keep in mind when using RAM to optimize scan performance. The allocated memory is not released unless InsightVM restarts. The top command is not a reliable way to monitor memory use in InsightVM.
How do I create a scan template that checks for only one vulnerability?*
When you are creating or modifying a scan template, go the Vulnerabilities page of the configuration wizard, and enable the vulnerability that you want InsightVM to check. When you enable a specific vulnerability check, you are disabling all other checks.
What does it mean when I see the messages "Paused by System" and "Not enough memory to complete scan" during a scan?*
InsightVM pauses scans and stops report generation when the memory on the Security Console host server is dangerously low. This reduces the possibility of the server failing. However, it may cause the Security Console to stop scans or reporting activities before they are complete. If you are seeing these messages, then your host system is running low on memory.
To lower the likelihood of scans being paused for this reason, try running fewer simultaneous scans or lowering the number of scan threads allocated by your scan template.
If these changes do not help you complete your scans, contact Rapid7 Technical Support.
Why are my scans hanging or causing printers to crash during vulnerability checks on printers?*
Printers are known to have HTTP services that may freeze scans or cause other unwanted results during scans. You can mitigate this problem with two steps:
Why can't I see incremental scan data for a current scan job?
By default, InsightVM only retrieves incremental results from a local scan engine, which runs on the same host as the InsightVM Security Console; and it displays the full set of scan results from a remote engine after the scan has been completed. You can configure InsightVM to retrieve incremental scan results from remote scan engines
Why are my scan results showing all devices as "Alive" or all devices as "Dead"?
In security-conscious environments, it's not uncommon to have a firewall that provides SYN flood protection to prevent devices like InsightVM from performing accurate port scanning and host discovery. One way to mitigate this problem is to reduce port scanning speed in the scan template to avoid triggering the SYN flood protection. The drawback is that scanning will take much longer. If this works, then scanning will become much slower than expected. A better solution is to configure the firewall to "whitelist" InsightVM. This makes it possible for InsightVM to scan reliably at normal speeds.
Note: This topic involves features that are only available in the Enterprise version of InsightVM.