Version fingerprinting: UDP port numbers

[Slarty <slarty () vectrex org uk>]

Dear All,

        When version fingerprinting UDP services, does nmap rely on the fact that 
the response will come from the same port number as it sent the request to?

I can see that at least in one implementation of TFTP, it does not. And 
indeed, it need not in the general case.

Slarty

---------------------------------------------------------------------
For help using this (nmap-dev) mailing list, send a blank email to 
nmap-dev-help () insecure org . List run by ezmlm-idx (www.ezmlm.org).