Re: [NSE] ASN

[David Fifield <david () bamsoftware com>]

On Fri, Sep 05, 2008 at 09:54:41PM -0600, David Fifield wrote:
> On Sat, Sep 06, 2008 at 01:29:18AM +0100, jah wrote:
> > On 04/09/2008 05:27, Michael Pattrick wrote:
> > > Responding with amazing speed, Team Cymru says:
> > >
> > > These should really be in separate zones... I went ahead and put the peer
> > > data in peer-nmap instead.
> >
> > Aye!  Attached is an updated ASN.nse which takes full advantage of those
> > changes.
> >
> > It uses the nmap and peer-nmap zones and combines the answers into
> > unique BGPs to reduce unnecessary output.
> > It uses the nmap6 zone for IPv6 queries - I've included functions from
> > ipOps [1] and a patched [2] dns.reverse() to make IPv6 queries (which
> > are cool) possible.
> > Answers are displayed ordered by ascending BGP size which looks better
> > than the jumble they were before and you get the most specific info first.
> > The excellent dns library is used to send queries and decode the result
> > and which also means that supplying a dns server as a script-arg is not
> > usually necessary (unless you happen to be -6 scanning from a windows XP
> > box).
> > It performs an ASN to AS Description lookup for all origin AS numbers as
> > suggested by David.  This, remember, requires extra queries using
> > "asn.cymru.com" and not one of the zones set aside for nmap, but I can't
> > see a problem doing so and the information is worth the trouble.
>
> This looks really good. I have checked in the new ipOps.lua and ASN.nse,
> and the patch to dns.lua.

One other thing. The DNS queries in ASN.nse don't work with the caching
DNS server in my DSL modem. If I use a script arg and use the DNS server
the modem is using it works fine. But without it there's a timeout of 40
seconds (4 times 10 seconds I guess) per host. Maybe the script could
bail out if the first query times out, and mark that it has done so in
the registry so other instances of the script don't waste their time?

David Fifield

_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://SecLists.Org