Passive listening uses the Tenable Nessus Network Monitor (NNM) to detect new devices using plugin 12 (Host TTL Discovered). The discovered IP addresses must be part of the Internal Host setting and any logs must indicate that a connection is established. For each TCP communication event discovered that is not related to a TASL event, the IP address from the event is recorded with plugin 800000 (Host Discovered). Host data is gathered by the Tenable Log Correlation Engine (LCE) to monitor different data sources such as NetFlow, firewall logs, host logs and other log types of TCP communications. Tenable's Tenable.sc Continuous View (Tenable.sc CV) supports active scan data collected using Nessus, but data can also be collected using host data or passive listening. To accurately detect systems discovered using active plugins, ensure both 1016 are selected.

In many cases both plugins 1016 will be present, but in some cases 10180 may not be present due to environmental variables. A second method uses Plugin ID 19506 (Nessus Scan Information), which contains a summary of the scan parameters, time to complete scan and other useful information. The process uses Plugin ID 10180 (Ping the remote host) to discover hosts on the network. The content of the echo reply varies based on OS implementation, but the exact same payload must be returned to the host that sent the echo request. The remote host sends an “Echo Reply” for each request received. One of the types of messages that is sent is a Packet Internet Gopher (PING), which uses Internet Control Message Protocol (ICMP) to send an “Echo Request” to a host. Both active scanning and agent scanning use the Tenable Nessus vulnerability scanner to craft packets and send said packets to remote hosts. Tenable.sc uses active scanning and agent scanning to interactively communicate with targets on the network. This dashboard provides an easy method of tracking host counts and detection methods. There are several methods to identify hosts, such as port scans, monitoring logs and passively monitoring TCP communications. The first step in many security practice guidelines is to identify all the systems on the network. Tenable One Exposure Management Platform.Tenable is named a leading force in vulnerability management and top ranked among 13 vendors in both the Growth and Innovation indexes. Frost & Sullivan: Frost Radar, Vulnerability Management, 2023

Nessus host discovery