Tell me more ×  On a large scale (~1500 workstations, ~100
servers, ~50 network routers and switches, etc), what should a
vulnerability management system be scanning? Should it scan
everything, or just samples?  I know that ideally the VMS have
to scan everything, but I'm not sure if that is feasible.
share|improve this question That doesn't sound like a lot of
systems, especially if you're authorized to do it, are on their
LAN, and can scan at full speed. –  nlovric Feb 15 '12 at 11:38
add comment  2 Answers  up vote 5 down vote accepted  Scan
everything; all ports and protocols.  Scan of open TCP ports:
1. Scanner sends TCP SYN to 1650 targets × 65,536 ports =
108,132,750 160-bit IP headers + 108,132,750 160-bit TCP SYN
packets = 34,602,480,000 bits @ 1 Gbit/s = 32.23 seconds; of
course, you'll have to go at least twice as slow so that
responses from below can use the bandwidth.   2. 1650 targets ×
65,535 ports respond with 108,132,750 96-bit ICMP PORT_UNREACH
packets or 108,132,750 160-bit IP headers +