Re: quake3 opportunistic portrule

[David Fifield <david () bamsoftware com>]

On Mon, Jan 10, 2011 at 10:17:18AM +0200, Toni Ruottu wrote:
> Here is another probe that detects the getserversExt support. Presence
> of the command implies that the server is Dpmaster 2.0 or later. I put
> the v/2.0/ as I could not figure out a convention for stating "or
> later". Feel free to change that as you see fit. You can use
> nmap -sV -p 27950 -sU -Pn master.urbanterror.net master.quake3arena.com
> to test the probe. master.quake3arena.com does not support the
> feature, but master.urbanterror.net does. Also master.urbanterror.net
> did not know about the game I am using in the probe while I was
> testing it, so it is a good test candidate.

Hmm, I'm not sure that this is an important enough protocol to have two
different version probes. Especially as the second probe is only to
distinguish one particular implementation that is already matched
(generically) by the first probe.

One one hand, this only affects a couple of ports by default, but on the
other, it will slow down everybody's --version-all.

I know I'm the one who suggested dpmaster detection, but I'm inclined
not to include this probe unless someone thinks differently.

David Fifield
_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://seclists.org/nmap-dev/