Our Nessus tool scans a few subnets covering about 1000 hosts. Post-scan, Nessus generates the report listing various vulnerabilities of ~600 hosts. In the list of that ~600 servers, 9 of them are IP addresses (lacking Reverse DNS). For these 9 hosts, there are no vulnerabilities reported, but only two INFO items - A 'Traceroute Information' showing 1 hop and a 'Nessus Scan Information'. Since Nessus is reporting back with 'something' we are assuming that Nessus is getting some kind of response back from those IP addresses.
Problem: We are unable to find out what these IP addresses are or the devices or service behind these IP addresses. We have ping disabled for most of the servers and network devices. These 9 IP addresses are not responding to SSH or RDP requests either. NMAP shows only the list of 'filtered' standard ports.
My questions are:
1) Is my assumption correct that since the Nessus report includes these IP addresses, it means that the IP addresses are responding and alive somewhere.
2) Could the response be coming from a network device (firewall or a switch) and Nessus could be misreading.
3) What are the chances of these being 'ghost' devices, like some old entries cached somewhere in a network device.
- 10.x.x.x : Nessus Server
- 10.y.y.y : Target Server.
INFO Traceroute Information Description Makes a traceroute to the remote host. Output For your information, here is the traceroute from 10.x.x.x to 10.y.y.y : 10.x.x.x 10.y.y.y Hop Count: 1 Hosts 0 / udp 10.y.y.y