Re: AFP probe

[David Fifield <david () bamsoftware com>]

On Tue, Jan 12, 2010 at 04:02:50PM -0700, David Fifield wrote:
> On Mon, Jan 04, 2010 at 10:51:02AM +0100, Patrik Karlsson wrote:
> > Hi,
> >
> > The SSLSessionReq probe fails to detect AFP on my Linux boxes (Netatalk) and on Snow Leopard.
> > I'm submitting a patch containing new probe and match lines that detect AFP on these systems.
>
> The SSLSessionReq works for me on Show Leopard:
>
> 548/tcp open  afp     syn-ack Apple AFP (name: mac-mini; protocol 3.3; Mac OS X 10.6; Mac mini)
>
> I don't have a problem with adding the probe if it detects more servers.
> Can you send the full service fingerprint? I want to make the match
> conform more closely to the style of the other AFP matches if possible.

I added the new probe. Patrik sent me his fingerprints and I adapted his
and Matt Selsky's matches. Right now we have matches for Netatalk 1.6.4
and 2.0.3. I wasn't sure how specific to be in the match lines so I put
"Netatalk 1.6" and "Netatalk 2". If anyone else has a Netatalk server,
it would help if you could run a service scan and see which (if either)
of the match lines matches for the version number.

To do this, svn update and make, then run

./nmap --datadir . -PN -p 548 -sV <server>

David Fifield
_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://seclists.org/nmap-dev/