2 Replies Latest reply on Aug 11, 2011 11:03 AM by epo909

    WHAM Checks and SMB bottleneck




      My MVM setup runs monthly vuln scans, full WHAM checks, on groups of 100 windows assets. The batch sizes are set to 32 and the sub-scans to 10. Some of these scans take up to 8 hours to complete.

      We noticed that in the first 10 minutes of the scan, after the discovery phase, the FSL scripts per minute for each batch are ~700, the CPU goes up to 25% (4 cores) and the Network occupation goes no further than 33-35%.

      After the first 10 minutes the FSL per minute drops slowly to 100-200 and the CPU and Network Bandwidth drop to < 5%. (During this time the TCP retransmission level is null).


      The scan engine is a dedicated MVM-3000 (scan engine only).


      How can we avoid the FSL drops and why they happen?


      Thanks in advance