Re: OS fingerprint extraction quality when scanning a large number of machines

[David Fifield <david () bamsoftware com>]

On Thu, Dec 18, 2008 at 11:06:11AM -0000, Rob Nicholls wrote:
> I gave this a try from a Vista host using r11421. My original command was:
>
> > nmap xxx.xxx.xx.1-127 -P0 -O -vv
>
> The last couple of hosts had open (and one also had closed) ports but had
> fingerprinting problems, returning:

Thanks for your testing. A couple of hosts out of 127 is not so bad
considering what we had been seeing: only one out of 20 or 30 hosts
returning useful results. I assume most of the other addresses were live
hosts and had OS fingerprints? What were the total numbers of good
fingerprints to bad fingerprints. (A bad fingerprint for our purposes is
one that had an open or a closed TCP port but has no R=Y.)

Can you repeat the test with r11420 ("svn update -r 11420") and see if
the numbers change?

David Fifield

_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://SecLists.Org