McAfee MTP08EMB3RUA - Total Protection - PC Product Manual page 159

Can a domain name resolve to multiple IP addresses?
Yes. Domain names can resolve to multiple IP addresses, and each IP address will be scanned as a
separate device.
How much bandwidth does an audit scan use?
On average, an audit scan uses 10 MB of bandwidth at a peak and creates a load equal to between 1
and 5 visitors.
The bandwidth usage can vary greatly depending on the number and kind of open services.
How long does scanning take?
The entire scanning process takes up to 24 hours because scans are put into a queue and performed
on a first-come-first-served basis, and because multiple scans are involved. In addition, the duration
of each device audit scan can vary greatly based on the characteristics of the scan target.
• Phase 1: Port Scan. Port scans discover all ports that are open for communication. The duration
of port scan depends mostly on the type of firewall used on the target. A firewall that rejects
packets to closed or filtered ports can be scanned quickly. A firewall that drops packets to closed
or filtered ports can take much longer.
• Typical: Less than 5 minutes
• Phase 2: Network Scan. Network scans discover all the open ports and subnets. The duration of
the network scan depends mostly on the number of open ports found and the types of services
found on those ports.
• Typical: Less than 20 minutes
• Average: 40 minutes
• Maximum: 3 hours
• Phase 3: Web Application Scan. Web application scans find all the web pages. The duration of
the web application scan depends mostly on the number of web pages on the site.
• Typical: Less than 20-40 minutes
• Average: 1 hour
• Maximum: 4 hours
How long does a discovery scan take?
The duration of a discovery scan depends primarily on the size of the subnet and the type of firewall
the IP addresses in the subnet are using.
• A firewall that rejects packets to closed or filtered ports will take less time.
• A firewall that drops packets to closed or filtered ports will take more time.
• An IP address that is not configured on any device is typically treated like a firewall that drops packets.
• A Class C subnet that drops packets on average takes 12 hours.
Using Vulnerability Scanning
Frequently asked questions
McAfee Total Protection Service 5.1.5 Product Guide
9
159