Re: Probes (TCP, ICMP and UDP)

[Fyodor <fyodor () insecure org>]

On Thu, Feb 19, 2009 at 05:33:53PM -0500, Srikanth Dabbiru wrote:
> Just had to clear out my confusion here:
>
> The article states there are 15 probes sent, but, when I count the number of
> probes they come to 16 including the UDP probe.
> http://nmap.org/book/osdetect-methods.html
>
> Is ICMP dual-probe (IE) considered to be a single probe ?

Hi Srikanth.  Good catch!  There are indeed up to 16 probes:

6 - the TCP seq probes (SEQ, OPS, WIN, TI)
6 - TCP misc. probes (T2 - T7)
2 - ICMP echo probes
1 - ECN
1 - UDP

You are probably right that we forgot to count the 2nd ICMP echo
probe.  I have updated updated the page (might have to reload if it is
still in your cache):

http://nmap.org/book/osdetect-methods.html

Cheers,
-F

_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://SecLists.Org