HP-PJL softmatch line

[Tom Sellers <nmap () fadedcode net>]

I would like some feedback on following HP-PJL softmatch line:



# We don't want to send a bunch more probes that will be printed
softmatch hp-pjl m|^| i/hp-pjl probe got something back/



In my scanning scenario, scanning all ports and using --version-all,
it is generating numerous hits and changing the service field to
hp-pjl.  There are many cases, for example ports 21 and 80, where
that changes what scripts trigger against a port.

The RegEX matches any traffic returned from a service that has not
already been hard matched, which is pretty much every unidentified
service.  Services that do this are going to kick out a fingerprint
block in any case.

So, can this be commented out without a negative impact or is this
just artifact of my scan environment that I am going to need to
adjust to?  If necessary I comment this line out as part of my
build code, but I would prefer to modify the nmap-service-probes
file as little as possible.

Thanks much,

Tom
_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://seclists.org/nmap-dev/