Sniffing nmap output

[W S N <woodenshoe () gmail com>]

I'm curious if anyone has ever tried to identify nmap query or
response packets promiscuously off a wire? Could one identify other
people running scans, or even identify the results of someone else's
scan? For instance, I might be able to passively learn the ports or
operating system of a system that someone else scanned. Any thoughts?

---------------------------------------------------------------------
For help using this (nmap-dev) mailing list, send a blank email to 
nmap-dev-help () insecure org . List archive: http://seclists.org