Our Nessus tool scans a few subnets covering about 1000 hosts. Post-scan, Nessus generates the report listing various vulnerabilities of ~600 hosts. In the list of that ~600 servers, 9 of them are IP addresses (lacking Reverse DNS). For these 9 hosts, there are no vulnerabilities reported, but only two INFO items - A 'Traceroute Information' showing 1 hop and a 'Nessus Scan Information'. Since Nessus is reporting back with 'something' we are assuming that Nessus is getting some kind of response back from those IP addresses.

Problem: We are unable to find out what these IP addresses are or the devices or service behind these IP addresses. We have ping disabled for most of the servers and network devices. These 9 IP addresses are not responding to SSH or RDP requests either. NMAP shows only the list of 'filtered' standard ports.

My questions are:

1) Is my assumption correct that since the Nessus report includes these IP addresses, it means that the IP addresses are responding and alive somewhere.

2) Could the response be coming from a network device (firewall or a switch) and Nessus could be misreading.

3) What are the chances of these being 'ghost' devices, like some old entries cached somewhere in a network device.

  • 10.x.x.x : Nessus Server
  • 10.y.y.y : Target Server.
Traceroute Information
Makes a traceroute to the remote host.
For your information, here is the traceroute from 10.x.x.x to 10.y.y.y : 

Hop Count: 1
0 / udp   
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer. – Ron Maupin Dec 25 '18 at 8:53

We can't help you with your management tool.

However, you can track down an unknown IP address in your network by examining the ARP tables of connecting devices, routers, ... and looking for the associated MAC address in the switches' CAM tables. Once you've got the port, follow the cable. Alternatively, check your inventory list for the MAC.


This is most likely due to a firewall blocking all Nessus traffic getting through, resulting in phantom hosts popping up. Check the subnet that those IP addresses belong to and see if there is a firewall between them and the Nessus scanner.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.