Security1 publisher2 min readPublished
Rapid7 scan engines now ask credentialed hosts for their own listening port list
On hosts where a credential already matches, the engine reads the listening ports from the operating system instead of inferring them, trading probe timeouts for findings on ports the network blocks it from reaching.
The Watch · Security desk
What happened
- Rapid7 says that from version 8.58 a scan engine holding valid credentials for a host can authenticate and read the host's own list of listening TCP and UDP ports instead of probing a port range.
- Hosts with no matching credential, or where authentication does not succeed, fall back to a conventional network port scan, and that fallback is not logged as an error.
- Rapid7 states the trade-off plainly: pre-port discovery can report ports that a firewall stops the engine from reaching, and those hosts return fewer results and take longer to scan.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- constraint Credential coverage, not scanner capability, now bounds how much of an estate escapes probe-based inference, so the hardened hosts nobody has credentials for keep paying the timeout bill.
- decision Because the control is per template and ships disabled, each scan template becomes a separate decision about which error mode a team would rather live with.
- cost Somebody has to account for a listening port the engine could not confirm from the network, which moves effort out of the scan window and into the triage queue.
The error mode flips direction. A probe that a rate limiter or an intrusion prevention system throttles reads to the engine exactly like a closed port [6], and a host that drops unsolicited traffic rather than refusing it yields a timeout and an ambiguous result [5], so the inventory quietly loses listening services. Credentialed discovery fails the other way: the operating system reports ports that a firewall or other network control stops the engine from reaching, which Rapid7 says produces fewer results and a longer scan on those hosts [8]. One error hides a service. The other hands an analyst a port to account for.
Cost per host is where the change lands. With a working credential the engine tries the Scan Assistant, then SSH, then a direct Windows connection, and uses the first that authenticates [9], on TCP 21047 and TCP 22 unless a credential restriction names another port [10]. That is at most three connection attempts against two default ports, and the count does not grow when the template's port range does [14]. Network scanning is one probe per port in the configured range [4], and every additional port is another possible timeout and more scan time [7].
Rapid7's post carries no scan-duration measurement [16]. So the case for re-planning a scan window rests on the structure of the method, removed timeouts and no inference, rather than on a figure anyone outside the vendor can check. Teams budgeting scan windows against hardened subnets on this basis are estimating.
Credential coverage decides which hosts benefit [18]. Where a credential matches, the returned list is authoritative and covers UDP as well as TCP [2], and the network port scan is skipped entirely [3]. Where no credential matches or authentication does not succeed, the engine falls back to a network port scan automatically and does not log it as an error [11], so the worst case is the failed authentication attempt plus the same scan being run today [15]. The control is a per-template checkbox under Asset Discovery and ships off [12], which means an existing template behaves as it always has until someone edits it.
No attacker capability changes here. What changes, on the hosts where credentials already exist, is whether a listening service that a rate limiter hid from the last scan turns up in the next one [1]. Fingerprinting, vulnerability checks and policy evaluation run afterwards exactly as before [13].
What to watch
- A published scan-duration measurement, from Rapid7 or a customer estate, that converts removed timeouts into a scan-window figure.
- Whether credentialed pre-port discovery moves from an opt-in checkbox into shipped default templates.
- How much triage volume the unreachable-port findings generate on segmented networks once teams enable it broadly.