Small Comparison: Nmap, Queso OS Detection

[Hans Zoebelein <hzo () goldfish cube net>]

This is a small comparison between nmap (V.2.08) and queso (V.990922 bug
fixed (1)) concerning OS detection. FTP servers of the .pl domain were
checked for their OS (source Ripe host count http://www/ripe.net).


Nmap-2.08 (done 990315):
nmap -n -O -sS -p21,22,23,25,80,139

aix: count: 74  %: 1.71%
acorn: count: 66  %: 1.53%
bsd: count: 1073  %: 24.81%
cisco: count: 8  %: 0.18%
cray: count: 0  %: 0.00%
DG: count: 6  %: 0.14%
digital: count: 18  %: 0.42%
hp laser: count: 0  %: 0.00%
hp-ux: count: 23  %: 0.53%
IBM AS/400: count: 0  %: 0.00%
ibm lan: count: 0  %: 0.00%
ibm mvs: count: 2  %: 0.05%
IBM OS/2: count: 3  %: 0.07%
IBM VM/MESA: count: 0  %: 0.00%
irix: count: 15  %: 0.35%
lexmark: count: 2  %: 0.05%
linux: count: 2094  %: 48.42%
macos: count: 20  %: 0.46%
netap: count: 4  %: 0.09%
novell netware: count: 1  %: 0.02%
openvms: count: 1  %: 0.02%
qnx: count: 2  %: 0.05%      
router/switch: count: 1  %: 0.02%
sco: count: 208  %: 4.81%
solaris: count: 218  %: 5.04%
ultrix: count: 0  %: 0.00%
unixware: count: 35  %: 0.81%
vax: count: 0  %: 0.00%
vxworks: count: 0  %: 0.00%
windows: count: 675  %: 15.61%

count OS recognized    : 4325
(not uniq.recognized)  :  339
count OS not recognized:  291
-----------------------
count hosts checked    : 4616
percent recognized     :   93.70%


queso-990922 bug fixed(1) (done 990114):
queso is/was available at http://www.apostols.org/projectz/queso.
Host names which stayed  unprocessed after the first time 
("unknown host", "firewalled", "network congestion")
were queried a second time.
(Results available at http://www.leb.net/hzo/ioscount)

  Host OS recognized (grouped, sorted)    count   %recog
  ------------------------------------  -------  -------
                                 Linux     1481     46.2
                            BSD Family      784     24.4
                      Windows 95/98/NT      451     14.1
                         Solaris/SunOS      193      6.0
                              SCO Unix       80      2.5
                                   AIX       49      1.5
                         Novel Netware       37      1.2
                                  IRIX       31      1.0
                                  HPUX       28      0.9
                    Reliant Unix/Sinix       20      0.6
                             Mac/Apple       16      0.5
                          Digital Unix        7      0.2
                           -----------    -----    -----
                           ++checksums     3177     99.1     


                    
                  Query Summary: valid    count   %valid
            --------------------------  -------  -------
                         Answers valid     4484      100
                    Host OS recognized     3207       72
               Hosts OS not recognized     1277       28  


* Nmap seems to be more precise even after a single run.
* Queso runs faster and less memory hungry. This pays
when a lot of parallell child processes are used (I'm running 30
queso childs on a 128mb dual pentium 75 mhz which is loaded as
ftp/mail/web server. When no other load is present, queso load will 
be below 0.5).  
Queso memory per child:  580k  ( 840k total, 260k shared)
Nmap  memory per child: 3220k  (3640k total, 420k shared)


--Hans


(1) queso-990922 bug: hosts running Windows 9*/NT shine up as
runnning" Cisco 11.2(10a), HP/3000 DTC, BayStack Switch"


-- 
blinux == http://www.hzo.cubenet.de/blinux/
ios++  == http://www.leb.net/hzo/ioscount/