mailing list archives
Re: Exp Branch for OpenSSL on Windows
From: Kris Katterjohn <katterjohn () gmail com>
Date: Tue, 20 May 2008 01:25:34 -0500
-----BEGIN PGP SIGNED MESSAGE-----
Brandon Enright wrote:
On Mon, 19 May 2008 20:15:45 -0500 or thereabouts Kris Katterjohn
<katterjohn () gmail com> wrote:
I rebuilt nmap with openssl, but it didn't have any appreciable
effect and I note that in the minute that it took to successfully
complete version detection, one of my dual cores was at full-pelt
for around 45 seconds. I'll look into this more deeply, but I
wonder if anyone else noticed similar?
I haven't noticed anything like this happening, but I'll try against
some more hosts. Have you been able to look into it any more?
For whatever it's worth, I've been scanning millions of hosts the last
few days with -sV on SSL ports like 443, 993, 995, etc. My scans are
not being limited by my bandwidth but my CPU.
SSL is a very CPU intensive task, especially at the initial RSA parts.
I don't think there is a bug here, I think people just don't realize
how expensive quality public-key crypto is.
Yeah, I've since been able to get my CPU >=90% for 30+ seconds with some
hosts. Most of the hosts I test against may cause a spike for a second
or two, but I now agree that it seems to be normal for some hosts to
throttle the CPU due to SSL.
I didn't know it was quite like that :)
Thanks a lot,
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
-----END PGP SIGNATURE-----
Sent through the nmap-dev mailing list
Archived at http://SecLists.Org