quake3 opportunistic portrule

[Toni Ruottu <toni.ruottu () iki fi>]

On another thread, I was discussing precise scanning of publicly
advertised quake3 servers. The other part of the story involves
detecting and scanning quake3 servers upon stumbling on an open port
during a regular port scan. It seems there is no ultimate default port
for running a quake3 server. However, some ports are more common,
presumably some of them are default configurations of some server
software. Below are some statistics I gathered today regarding the
amount of servers using a specific port number. Now the open question
is, which port numbers should I include in the port rule? The options
might include 1) all of the ports 2) anything used more than once 3)
anything used more than, say 10 times 4) top-3 5) only 14445 6) none

  what do you think?, --Toni

14445: 270
14701: 48
14957: 33
0: 24
15213: 15
15725: 14
17005: 13
15469: 12
19565: 8
17517: 8
15981: 8
17261: 7
34665: 6
16749: 6
16493: 6
16237: 6
24685: 5
36965: 4
17773: 4
56425: 3
42090: 3
30825: 3
22125: 3
18285: 3
18029: 3
16490: 3
12405: 3
11885: 3
53360: 2
50538: 2
33385: 2
28845: 2
19821: 2
18541: 2
14451: 2
13165: 2
9325: 2
8305: 2
2155: 2
2130: 2
65377: 1
64620: 1
62060: 1
61525: 1
61376: 1
61214: 1
60360: 1
59497: 1
58985: 1
58217: 1
58011: 1
57574: 1
57280: 1
57232: 1
56462: 1
55771: 1
55410: 1
55385: 1
54380: 1
53738: 1
53649: 1
53589: 1
53355: 1
53078: 1
52940: 1
52855: 1
52821: 1
52800: 1
51824: 1
51568: 1
51312: 1
49245: 1
49132: 1
49008: 1
48842: 1
48752: 1
48053: 1
47240: 1
45134: 1
45039: 1
44253: 1
44015: 1
43968: 1
43630: 1
43598: 1
43105: 1
42991: 1
41587: 1
41143: 1
41075: 1
40805: 1
40010: 1
39987: 1
39790: 1
39426: 1
39020: 1
38879: 1
38552: 1
38383: 1
37748: 1
35689: 1
35177: 1
33645: 1
33475: 1
33387: 1
33131: 1
32617: 1
31978: 1
31405: 1
31081: 1
30704: 1
29101: 1
27755: 1
27619: 1
27158: 1
27002: 1
26737: 1
26480: 1
26411: 1
25965: 1
24941: 1
24862: 1
24635: 1
24429: 1
23405: 1
23149: 1
22637: 1
22496: 1
21001: 1
20943: 1
20845: 1
20585: 1
19932: 1
18797: 1
18545: 1
18510: 1
16415: 1
15050: 1
14738: 1
14597: 1
14207: 1
14189: 1
13777: 1
13698: 1
13421: 1
13420: 1
12672: 1
12141: 1
11928: 1
10383: 1
9872: 1
8430: 1
8053: 1
7797: 1
7285: 1
6765: 1
6337: 1
5537: 1
4716: 1
4213: 1
4205: 1
3180: 1
3070: 1
1645: 1
1510: 1
1396: 1
1220: 1
1140: 1
961: 1
555: 1
4: 1
_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://seclists.org/nmap-dev/