Re: Question about scan outputs

[David Fifield <david () bamsoftware com>]

On Mon, Jul 29, 2013 at 03:58:37AM +0000, David Maynor wrote:
> Has anyone seen this happen before?
>
> Host is up (0.20s latency).
> Not shown: 97 filtered ports
> PORT   STATE SERVICE VERSION
> 21/tcp open  ftp?
> 23/tcp open  telnet  Netgear broadband router or ZyXel VoIP adapter telnetd
> 80/tcp open  http    Allegro RomPag
> er 4.07 UPnP/1.0 (ZyXEL ZyWALL 2)
>
> But when I rerun the scan I getL
> PORT   STATE SERVICE VERSION
> 80/tcp open  http    Allegro RomPager 4.07 UPnP/1.0 (ZyXEL ZyWALL 2)
>
> I looked in wireshark at the caps of the scan and couldn't not find a
> reason a banner would be broken up like that. Has anybody see or heard
> of this? If not could you point me to the code responsible for the
> banner handling/storage/display?

I haven't seen anything like this. Even if there were a newline in the
information returned by the service, it would be escaped before being
written to the screen like this.

Were you running in a terminal or in Zenmap?

The code for this part of the output is in NmapOutputTable.cc and
output.cc.

David Fifield
_______________________________________________
Sent through the dev mailing list
http://nmap.org/mailman/listinfo/dev
Archived at http://seclists.org/nmap-dev/