Skip to content
Daniel TorresConnect

Case study 07 · Byte-budget scan splitter for eMASS

Nessus Splitter

Big scans in. Upload-ready parts out.

Single file · shipped with a user guide

Film shows a generated 114 MB scan of synthetic hosts on private addresses.

01Program challenge

eMASS rejects uploads over 30 MB. ACAS scan files routinely exceed it, and trimming the number of hosts scanned is hit or miss, because file size is driven by plugin output, not host count.

Scan evidence that cannot be uploaded cannot support the package. Teams were splitting files by hand or rescanning to get under the limit.

02Leadership decision

Requirements
Started from the real constraint, the eMASS upload limit, and from how scan files actually grow.
Stakeholders
ISSOs and analysts uploading continuous monitoring evidence.
Trade-off
Chose exact byte packing with whole hosts over simpler host-count splitting, which produces uneven host counts but parts that always fit.

Key decisions

Split by bytes, not hosts

The ceiling is applied to actual file size, which is what eMASS enforces.

Leave headroom

The default ceiling sits below 30 MB so parts never land on the edge of the limit.

Preserve the schema

Each part keeps the policy block and structure so it opens in Tenable and ingests in eMASS like the original.

Make verification part of the tool

Byte accounting is exact, and the Check button exists so a reviewer confirms one part before committing a set.

03Engineering solution

  • Indexes every host’s byte position in the .nessus file and packs whole hosts into parts under a configurable ceiling.
  • Optionally splits a single oversized host across parts, repeating its host properties so each part stays valid.
  • A manifest CSV and a Check button that confirms each part is well-formed and every host is counted.
  • Streams from disk, so large files are read in place and nothing is uploaded.
  1. Step 1

    Drop the .nessus file

  2. Step 2

    Review hosts, findings and the largest host

  3. Step 3

    Set the ceiling

  4. Step 4

    Check a part, then download the set and manifest

04Operational impact

Upload-ready parts under the limit, with whole hosts intact and a manifest showing where every host went.

Delivered with a two-page user guide and a marking selector so it can be used on government equipment.