Nmap Usage Stats by OS/Platform

[Fyodor <fyodor () insecure org>]

Nearly 3 years ago (February '03), I posted some Nmap usage data here
that I collected from OS submissions and downlaods
(http://seclists.org/lists/nmap-dev/2003/Jan-Mar/0023.html).  I
decided to revisit that and see what has changed.

Let's start with the OS and service submission data, as I consider
that to be the most useful.  This measures people who actually
contribute back to Nmap (by their submissions) rather than users as a
whole, but I consider that a good thing.  These users are more
valuable anyway.  One big disadvantage is that this may undercount
Windows users, as cutting and pasting fingerprints from a command
window can actually be quite difficult.  Microsoft's contempt
command-line users can be stunning sometimes!  Anyway, here is the
data from the last 1,997 submissions.  I have included a column for
the 2003 percentages since it is interesting to see how things change:

Total 2005%   2003% OS
1278  63.996% 65.1% Linux
295   14.772% 19.5% Windows
196    9.815%  1.5% Mac OS X
155    7.762%  9%   FreeBSD
30     1.502%  2.9% Solaris
27     1.352%  1.7% OpenBSD
13     0.651%   X   NetBSD
2      0.1%    0.2% HP-UX
1      0.05%    X   Other (i486-pc-none)

Linux is completely dominant, with 64%.  It did lose a percentile
point since last time though.  Windows come next.  It lost about 5%
for some reason.  This surprised me, considering all of the work that
has gone into improving the Windows version since 2003.  Maybe they
are using something else instead?  Maybe many more Windows users than
Linux users defected to OS X.  Mac OS X was certainly the big winner.
They grew from 1.5% to about 10%!  Everyone else lost a bit.  While
Nmap may work on a very wide variety of platforms, it is interesting
that Linux, Windows, OS X, and FreeBSD account for more than 96% of
the total.  Then Solaris, OpenBSD, and NetBSD split up pretty much
everything else.  There were no submissions from IRIX, AIX, or Amiga.
Anyone here run Nmap on those?  I'm glad SCO Openserver/UNIXWare d\
on't show up -- Nmap users apparently know they are evil now :).  The
relative rankings below FreeBSD aren't too meaningful, as they have so
few submissions that a single user can significantly skew the results.

Now let's look at download stats and see how the different packages
compare.  The last 9,143 downloads of Nmap 3.95 are distributed as so:

4901 53.6038% nmap-3.95-win32.zip
1839 20.1137% nmap-3.95.tar.bz2
1152 12.5998% nmap-3.95.tgz
679   7.42645% nmap-3.95-1.i386.rpm
318   3.47807% nmap-frontend-3.95-1.i386.rpm
138   1.50935% nmap-3.95-1.src.rpm
71    0.77655% nmap-frontend-3.95-1.x86_64.rpm
45    0.49218% nmap-3.95-1.x86_64.rpm

This is a very different picture.  Windows downloads are the majority
here.  That isn't too surprising, as Nmap comes with most Linux
distributions and FreeBSD, and those systems also have good updating
systems for staying current.  Many Mac OS X users may rely on Fink or
Darwinports.  For Windows users, the Nmap page is about the only way
to get the latest goods.

Maybe I'm wasting my time distributing X86_64 RPMs.  The fact that the
x86_64 nmap-frontend RPM has more than 50% more downloads than the
x86_64 RPM it depends on shows that a bunch of people are downloading
them accidently.  On the other hand, I use and like the platform.
Insecure.Org runs on a 64-bit Linux system with dual Opteron
processors.  Maybe the platform will grow into a solid download
contender.  I'll probably continue with it for a bit longer, just in
case.

How many of those 9,143 downloads checked the GPG signatures or at
least the cryptographic hashes (MD5, SHA1, etc.)?

35 sigs/nmap-3.95.tar.bz2.gpg.txt
28 sigs/nmap-frontend-3.95-1.x86_64.rpm.gpg.txt
27 sigs/nmap-3.95.tar.bz2.digest.txt
22 sigs/nmap-3.95-win32.zip.gpg.txt
22 sigs/nmap-3.95-win32.zip.digest.txt
19 sigs/nmap-3.95.tgz.gpg.txt
16 sigs/nmap-frontend-3.95-1.i386.rpm.gpg.txt

Not very many.  And I have no idea why the X86_64 nmap-frontend
signature is so popular.

And finally, here is a sick command-line that give more detailed
platform stats from those 1,997 OS/service submissions.  The string
can include version numbers, Linux distributions, etc.  1,860 of the
submissions fell into the top 26 platform strings.  Here they are:

syn> grep P= submissions | perl -ne 'if (/P=([-._\w]+)%/) { print "$1\n"; }' | sort | uniq -c | sort -rn | head -26 | 
awk '{  print $1, $1 / 18.60 "%", $2}' 
768 41.2903% i686-pc-linux-gnu
294 15.8065% i686-pc-windows-windows
231 12.4194% i386-redhat-linux-gnu
59 3.17204% i586-suse-linux
58 3.11828% i486-slackware-linux-gnu
48 2.58065% powerpc-apple-darwin8.1.0
46 2.47312% i386-portbld-freebsd5.4
41 2.2043% powerpc-apple-darwin8.2.0
31 1.66667% powerpc-apple-darwin7.5.0
30 1.6129% i586-mandrake-linux-gnu
29 1.55914% i686-redhat-linux-gnu
27 1.45161% i586-pc-linux-gnu
24 1.29032% i386-portbld-freebsd6.0
20 1.07527% i386-portbld-freebsd5.3
16 0.860215% sparc-sun-solaris2.9
15 0.806452% x86_64-pc-linux-gnu
15 0.806452% i386-pc-linux-gnu
14 0.752688% powerpc-apple-darwin7.9.0
13 0.698925% powerpc-apple-darwin7.6.0
13 0.698925% i386-unknown-openbsd3.7
13 0.698925% i386-portbld-freebsd4.11
13 0.698925% i386-portbld-freebsd4.10
12 0.645161% x86_64-unknown-linux-gnu
10 0.537634% powerpc-apple-darwin8.3.0
10 0.537634% powerpc-apple-darwin8.0.0
10 0.537634% i386--netbsdelf

Cheers,
Fyodor


_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev