- play_arrow What's New for Users in JSA Vulnerability Manager 7.4.0
- play_arrow Installations and Deployments
- Installations and Deployments
- Vulnerability Backup and Recovery
- Ports Used for Communication Between JSA and JSA Vulnerability Manager Managed Hosts
- Options for Moving the Vulnerability Processor in Your JSA Vulnerability Manager Deployment
- Options for Adding Scanners to Your JSA Vulnerability Manager Deployment
- JSA Vulnerability Manager High-availability Scans
- Extending the JSA Vulnerability Manager Temporary License Period
- JSA Vulnerability Manager High-availability Scans
- play_arrow Overview Of JSA Vulnerability Manager
- play_arrow Scan Configuration
- play_arrow False Positives Management
- play_arrow Authenticated Patch Scans
- play_arrow Scanning on Windows-based Assets
- Scanning on Windows-based Assets
- Configuring an Authenticated Scan Of the Windows Operating System
- Remote Registry
- Enabling Remote Registry Access to Assets on the Windows Operating System
- Assigning Minimum Remote Registry Permissions
- Configuring WMI
- Setting Minimum DCOM Permissions
- Setting DCOM Remote Access Permissions
- Administrative Shares
- Enabling Administrative Shares
- Disabling Administrative Shares
- Manually Configuring NTLMv2 Authentication to Prevent Scan Failures
- play_arrow Vulnerability Exception Rules
- play_arrow Scan Investigations
- Scan Investigations
- Searching Scan Results
- Including Column Headings in Asset Searches
- Managing Scan Results
- Republishing Scan Results
- Asset Risk Levels and Vulnerability Categories
- Asset, Vulnerability, and Open Services Data
- Viewing the Status Of Asset Patch Downloads
- Vulnerability Risk and PCI Severity
- Troubleshooting Scan Issues
- Emailing Asset Owners When Vulnerability Scans Start and Stop
- play_arrow Management Of Your Vulnerabilities
- Management Of Your Vulnerabilities
- Common Vulnerability Scoring System (CVSS)
- Investigating Vulnerability Risk Scores
- Custom Risk Classification
- Searching Vulnerability Data
- Vulnerability Instances
- Network Vulnerabilities
- Asset Vulnerabilities
- Open Service Vulnerabilities
- Investigating the History Of a Vulnerability
- Reducing the Number Of False Positive Vulnerabilities
- Investigating High Risk Assets and Vulnerabilities
- Prioritizing High Risk Vulnerabilities by Applying Risk Policies
- Configuring Custom Display Colors for Risk Scores
- Identifying the Patch Status Of Your Vulnerabilities
- Removing Unwanted Vulnerability Data
- Configuring Vulnerability Data Retention Periods
- play_arrow Vulnerability Remediation
- play_arrow Vulnerability Reports
- play_arrow Scanning New Assets That Communicate with the Internet
- Scanning New Assets That Communicate with the Internet
- Creating an Asset Saved Search for New Assets
- Creating an On-demand Scan Profile
- Creating a Policy Monitor Question to Test for Internet Communication
- Monitoring Communication Between New Assets and the Internet
- Configuring an Offense Rule to Trigger a Scan
- play_arrow Security Software Integrations
- play_arrow IBM Security SiteProtector Integration
- play_arrow Vulnerability Research, News, and Advisories
- play_arrow JSA Vulnerability Manager Engine for OpenVAS Vulnerability Tests
ON THIS PAGE
Scan Duration and Ports Scanning
How you manage your network scanning configuration is influenced by the number of assets in your network, your network infrastructure, and the scan completion times.
You must have the correct license capabilities to perform the following scanning operations. If you need assistance to obtain a new or updated license key, contact your Juniper Customer Support.
It can take a long time to scan large network, so you need a scanning strategy that optimizes your scanning resources.
It is always good practice to use operational windows to perform scans at times that don't overlap with nightly backups or automatic updates.
Port Scanning Strategy
Your scanning strategy is influenced by the number of hosts that you want to scan, whether it's a class C network of 256 hosts, or a class B network of 65,536 hosts. Your overall scan time can be significantly impacted by increasing the number of hosts that you want to scan. To get the overall scan time to an acceptable range, and you can reduce the scan time per host.
For example, if you do a network discovery scan on a class B network and it takes 1 second for TCP port discovery, the following statements are true:
Scanning one port on 65536 hosts at 1 second per host takes 18 hours.
If you scan one extra port on each of the 65536 hosts and allow 1 second per host, it takes an extra 18 hours to scan that extra port.
From the example, you can see the impact of adding one extra scanning port on a large network. If you're scanning a large number of hosts, understand what services are important and are prone to high-risk vulnerabilities so that you can configure your scan policies appropriately at the discovery scan stage. Before you implement your scan policies, run test scans by using different scan polices, and estimate the timing and the resources that are required to complete these scans.
The default JSA discovery-scan policy runs a Nmap fast scan of TCP and UDP ports, and you can use it to scan a smaller number of hosts.
UDP port scanning takes longer that TCP port scanning because it's a connectionless protocol. Scanning all UDP ports can take a long time and is resource-intensive. Consider whether you need to scan all UDP ports or whether you scan these ports less frequently than TCP ports.
The following ports are some of the highest priority UDP ports that you need to consider scanning regularly:
Authentication services such as RADIUS and Kerberos
Back doors and remote access applications
Backup applications
Database servers
DNS (Domain Name System)
NetBIOS and Common Internet File System (CIFS)
NFS (Network File System)
NTP (Network Time Protocol)
P2P (peer-to-peer) and chat applications
Routing protocols, including RIP (Routing Information Protocol)
RPC (Remote Procedure Call) and RPC endpoint mapping
SNMP (Simple Network Management Protocol) and SNMP trap
Syslog
TFTP (Trivial File Transfer Protocol)
VPNs, including Internet Security Association and Key Management Protocol (ISAKMP), Layer Two Tunneling Protocol (L2TP), and (NAT Traversal) NAT-T.
Ports that are known to be associated with malicious activity.
Typical Scan Times
The following table gives information about scanning times.
JSA appliance | Scan times |
|---|---|
JSA All-in-One | A default full scan of 2000-4000 assets takes 2-3 days. |
JSA Vulnerability Manager on the following managed hosts | A default full scan of 2000-4000 assets takes 2-3 days. An offboard JSA Vulnerability Manager processor on a managed host (600) is required when more than 50,000 assets are being scanned regularly or when scans are running for long periods of time on the JSA console. |
