FP_NOVELTY_THRESHOLD used in IPv6 OS detection

[Alexandru Geana <alex () alegen net>]

Hello nmap devs,

I am currently in the process of exploring how nmap does OS probing and
detection over IPv6. I have a pretty good understanding of the
underlying concepts, but there is still one thing I don`t get.

The novelty detection feature has a threshold which is set to 15 as
explained in [1] and also visible in FPEngine.h [2]. How was this value
calculated/chosen?

Thank you for your time.

[1] http://nmap.org/book/osdetect-guess.html#osdetect-guess-ipv6
[2] https://svn.nmap.org/nmap/FPEngine.h

Best regards,
Alexandru Geana
alegen.net

Attachment: signature.asc
Description: Digital signature

_______________________________________________
Sent through the dev mailing list
https://nmap.org/mailman/listinfo/dev
Archived at http://seclists.org/nmap-dev/