Re: Problems in OS Detection documentation

[João Paulo de Souza Medeiros <ignotus21 () gmail com>]

Hi again,

    In the following page in section "UDP", the documentation say that 
IP ID is set to 0x1042 if possible, but this number is 0x4210.

    http://insecure.org/nmap/osdetect/osdetect-methods.html

Att, Joao Medeiros.


João Paulo de Souza Medeiros wrote:
> Hi friends,
>
>    I'm writing about some inconsistencies that I found between 2nd 
> generation of Nmap OS detection and your doucumentation. I'm using the 
> Nmap 4.22SOC6, and run it with the following command:
>
>    # nmap -O2 192.168.0.2
>
>    The problems are in this page:
>
>    http://insecure.org/nmap/osdetect/osdetect-methods.html
>
>    First, in the section "Sequence generation" the values of TSval is 
> discriminated as 0xFFFFFF, but it's 0xFFFFFFFF for all packets. And in 
> the Packets #2, #4 and #5 the EOL TCP Option is used, but not 
> discriminated in documentation.
>
>    Second, in the section "ICMP echo" for the first ICMP packet the 
> documentation says that a random character is repeated 120 times, but 
> in many tests I only see occurrancy of 0x00.
>
>    The captured traffic can be downloaded from url bellow, the file 
> format is of libpcap. I'm using Wireshark to do this task.
>
>    http://www.engcomp.ufrn.br/~ignotus/temp/nmap-os2.cap
>
>    Thanks for your attention. Good work with the new Nmap book ;)
>
> Att, ignotus.


_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://SecLists.Org