Re: Major SIPOptions probe reorganisation

[Matt Selsky <selsky () columbia edu>]

Fyodor wrote:

> Is SIP ever found on ports 5060?  In other words, is it a service like
> SMTP which is almost always found on the same port for the protocol to
> work properly, or more like http which you find all over the place?
> If it is almost always on 5060 (or a discrete set of ports we can
> list), then boosting the rarity sounds like a reasonable option.  I
> think it is an important and growing protocol though, so we shouldn't
> boost the rarity if it will cause a lot of misses.

5060 is the IANA-registered SIP port.  Shouldn't we always look for SIP 
first on that port and then other protocols?


-- 
Matt

_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://SecLists.Org