I have a question about the scanning process, maybe it’s silly, but I’m curious about it
I have a scanner configuration in which I have recently noticed a peculiarity.
There are hosts that take 30–40 minutes to scan, and there are hosts that take 3–4 hours to scan. I’m a little confused about this difference. I decided to test these hosts separately and the results were the same. In addition, on those hosts that the scanner scanned 3–4 hours according to the logs requests from the scanner came only last 30 minutes. What was the scanner doing for 2 hours?
In openvas.log I also see that the vulnerability scanning started much later than I started the task
sd main:MESSAGE:2023-10-18 07h20.45 utc:1624104: Vulnerability scan 8e0ef061-60ad-495a-a23a-d9183df5a18a started: Target has 10 hosts: xxxxx-xxxxx, with max_hosts = 15 and max_checks = 4
libgvm boreas:MESSAGE:2023-10-18 07h20.45 utc:1624104: Alive scan 8e0ef061-60ad-495a-a23a-d9183df5a18a started: Target has 10 hosts
sd main:MESSAGE:2023-10-18 07h20.46 utc:1624121: Vulnerability scan 8e0ef061-60ad-495a-a23a-d9183df5a18a started for host: xxxxx
sd main:MESSAGE:2023-10-18 07h20.46 utc:1624122: Vulnerability scan 8e0ef061-60ad-495a-a23a-d9183df5a18a started for host: xxxxx
sd main:MESSAGE:2023-10-18 07h20.46 utc:1624134: Vulnerability scan 8e0ef061-60ad-495a-a23a-d9183df5a18a started for host: xxxxx
sd main:MESSAGE:2023-10-18 07h20.46 utc:1624141: Vulnerability scan 8e0ef061-60ad-495a-a23a-d9183df5a18a started for host: xxxxx
sd main:MESSAGE:2023-10-18 07h20.46 utc:1624149: Vulnerability scan 8e0ef061-60ad-495a-a23a-d9183df5a18a started for host: xxxxx
sd main:MESSAGE:2023-10-18 07h20.46 utc:1624154: Vulnerability scan 8e0ef061-60ad-495a-a23a-d9183df5a18a started for host: xxxxx
sd main:MESSAGE:2023-10-18 07h20.46 utc:1624164: Vulnerability scan 8e0ef061-60ad-495a-a23a-d9183df5a18a started for host: xxxxx
sd main:MESSAGE:2023-10-18 07h20.46 utc:1624165: Vulnerability scan 8e0ef061-60ad-495a-a23a-d9183df5a18a started for host: xxxxx
sd main:MESSAGE:2023-10-18 07h20.46 utc:1624172: Vulnerability scan 8e0ef061-60ad-495a-a23a-d9183df5a18a started for host: xxxxx
sd main:MESSAGE:2023-10-18 07h20.46 utc:1624179: Vulnerability scan 8e0ef061-60ad-495a-a23a-d9183df5a18a started for host: xxxxx
libgvm boreas:MESSAGE:2023-10-18 07h20.48 utc:1624104: Alive scan 8e0ef061-60ad-495a-a23a-d9183df5a18a finished in 3 seconds: 10 alive hosts of 10.
sd main:MESSAGE:2023-10-18 09h18.31 utc:1624141: Running LSC via Notus for xxxxx
sd main:MESSAGE:2023-10-18 09h18.32 utc:1624141: Vulnerability scan 8e0ef061-60ad-495a-a23a-d9183df5a18a finished for host xxxxx in 7066.04 seconds
sd main:MESSAGE:2023-10-18 09h19.44 utc:1624122: Running LSC via Notus for xxxxx
sd main:MESSAGE:2023-10-18 09h19.44 utc:1624122: Vulnerability scan 8e0ef061-60ad-495a-a23a-d9183df5a18a finished for host xxxxx in 7138.35 seconds
sd main:MESSAGE:2023-10-18 09h19.54 utc:1624164: Running LSC via Notus for xxxxx
sd main:MESSAGE:2023-10-18 09h19.54 utc:1624164: Vulnerability scan 8e0ef061-60ad-495a-a23a-d9183df5a18a finished for host xxxxx in 7148.49 seconds
sd main:MESSAGE:2023-10-18 09h20.57 utc:1624149: Running LSC via Notus for xxxxx
sd main:MESSAGE:2023-10-18 09h20.58 utc:1624149: Vulnerability scan 8e0ef061-60ad-495a-a23a-d9183df5a18a finished for host xxxxx in 7211.89 seconds
sd main:MESSAGE:2023-10-18 09h22.10 utc:1624121: Running LSC via Notus for xxxxx
sd main:MESSAGE:2023-10-18 09h22.10 utc:1624121: Vulnerability scan 8e0ef061-60ad-495a-a23a-d9183df5a18a finished for host xxxxx in 7284.66 seconds
sd main:MESSAGE:2023-10-18 09h22.30 utc:1624179: Running LSC via Notus for xxxxx
sd main:MESSAGE:2023-10-18 09h22.30 utc:1624179: Vulnerability scan 8e0ef061-60ad-495a-a23a-d9183df5a18a finished for host xxxxx in 7304.02 seconds
sd main:MESSAGE:2023-10-18 09h22.30 utc:1624172: Running LSC via Notus for xxxxx
sd main:MESSAGE:2023-10-18 09h22.31 utc:1624172: Vulnerability scan 8e0ef061-60ad-495a-a23a-d9183df5a18a finished for host xxxxx in 7304.91 seconds
sd main:MESSAGE:2023-10-18 09h22.37 utc:1624165: Running LSC via Notus for xxxxx
sd main:MESSAGE:2023-10-18 09h22.37 utc:1624165: Vulnerability scan 8e0ef061-60ad-495a-a23a-d9183df5a18a finished for host xxxxx in 7311.72 seconds
sd main:MESSAGE:2023-10-18 09h31.37 utc:1624134: Running LSC via Notus for xxxxx
sd main:MESSAGE:2023-10-18 09h31.37 utc:1624134: Vulnerability scan 8e0ef061-60ad-495a-a23a-d9183df5a18a finished for host xxxxx in 7851.49 seconds
sd main:MESSAGE:2023-10-18 09h36.01 utc:1624154: Running LSC via Notus for xxxxx
sd main:MESSAGE:2023-10-18 09h36.01 utc:1624154: Vulnerability scan 8e0ef061-60ad-495a-a23a-d9183df5a18a finished for host xxxxx in 8115.35 seconds
sd main:MESSAGE:2023-10-18 09h36.02 utc:1624104: Vulnerability scan 8e0ef061-60ad-495a-a23a-d9183df5a18a finished in 8121 seconds: 10 alive hosts of 10
I wanted to know if this is a normal operation of the scanner, if so, how can such an operation be explained?
Scanner - OpenVAS Default
Scan Config - Full and fast
Order for target hosts - Sequential
Maximum concurrently executed NVTs per host - 20
Maximum concurrently scanned hosts - 4
System Kali Linux
GVM-22.4.1
OpenVAS Scanner 22.4.1
Notus Scanner 22.4.2
ospd-OpenVAS 22.4.5
GVM Manager 22.4.2