Summary

Tenable is updating the Service Detection plugin (Plugin ID 22964) to stop reporting an informational finding on ports that accept a connection but close it without sending any data. These are typically triggered by scanning network infrastructure devices which will give the appearance of having thousands of ports open even though they are not actively listening.  With this change, we will still have the available data for downstream plugins to do fingerprinting where there is an active service but we will reduce noise in reporting on ports that do not have an active listening service.

Customer Impact

Most customers do not need to take any action. You may notice fewer informational findings from Plugin 22964 in your scan results. Plugin 22964 will continue to report on services that it positively identifies.  Existing findings of this type are no longer reported, so they will be marked as fixed after your next scan, which may cause a one-time change in your informational finding counts.

Customers who have built filters, queries or integrations that specifically reference Plugin 22964 and its "service closed the connection without sending any data" message should review them. These items will no longer return results for these ports.

Target Release Date

November 9, 2026