Rapid7 Adds Credentialed Pre-Port Discovery to InsightVM Scans
Summary
InsightVM 8.58 can use existing host credentials to retrieve listening TCP and UDP ports instead of probing them. The feature may improve discovery on hardened hosts, but can report ports blocked from the scan engine and does not honor template port limits.
Key points
- Available from InsightVM version 8.58, pre-port discovery uses existing credentials to ask a host for its listening TCP and UDP ports.
- When authentication succeeds, the engine skips network port probing; hosts without a matching credential or successful login fall back to a standard port scan.
- The feature may improve discovery on hardened or rate-limited hosts and reduce time spent probing wide port ranges.
- The host-reported list can include ports blocked by firewalls or other network controls, leading to unreachable-port timeouts and incomplete service coverage.
- Pre-port discovery does not apply the scan template's port ranges, additional ports, or exclusions; keep it off when results must stay within a fixed port set.
- The option is off by default and configured per scan template; Rapid7 recommends testing it on a representative group of hosts first.
Article Details
- Event Type
- Rapid7 introduced credentialed pre-port discovery in version 8.58, allowing the scan engine to retrieve listening-port information directly from hosts where it can authenticate.
- Impact
- The feature can improve port discovery on hardened, rate-limited, or wide-range scans by avoiding network probing. It may also report ports blocked between the host and scan engine, increasing scan time and leaving services on unreachable ports unidentified. Hosts without a matching credential or successful authentication fall back to a network port scan.