Re: Uptime estimates and TCP timestamp offsets

[David Fifield <david () bamsoftware com>]

On Mon, Aug 18, 2008 at 09:21:36PM -0300, Arturo 'Buanzo' Busleiman wrote:
> David Fifield wrote:
> > OSs out there. Maybe just label it "Uptime guess"?
>
> I'd rather get two or three uptime values than one potentially
> inaccurate one. Let the person doing the scan decide.

That's the thing though, if you scan the host two or three times you're
going to get uptimes that are consistent with each other. All the
uptimes will be equally inaccurate, so there's no way to tell how
inaccurate they are.

If I take your point correctly, I agree with you that if we call it a
"guess" then Nmap shouldn't ever omit printing the guess, so it doesn't
appear like it's making a judgement as to how good the guess is.

David Fifield

_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://SecLists.Org