diff --git a/CHANGELOG b/CHANGELOG index a52957d45..b87e18bfd 100644 --- a/CHANGELOG +++ b/CHANGELOG @@ -218,6 +218,10 @@ o In the interest of forward compatibility, the xmloutputversion o Zenmap no longer leaves any temporary files lying around. [David] +o Nmap only prints an uptime guess in verbose mode now, because in some + situations it can be very inaccurate. See the discussion at + http://seclists.org/nmap-dev/2008/q3/0392.html. + Nmap 4.68 [2008-6-28] o Doug integrated all of your version detection submissions and diff --git a/docs/refguide.xml b/docs/refguide.xml index 6bc274ae2..c68570f5b 100644 --- a/docs/refguide.xml +++ b/docs/refguide.xml @@ -108,7 +108,6 @@ PORT STATE SERVICE VERSION Device type: general purpose Running: Linux 2.4.X|2.5.X|2.6.X OS details: Linux 2.4.7 - 2.6.11, Linux 2.6.0 - 2.6.11 -Uptime 33.908 days (since Thu Jul 21 03:38:03 2005) Interesting ports on playground.nmap.org (192.168.0.40): (The 1659 ports scanned but not shown below are in state: closed) @@ -1872,10 +1871,9 @@ way. contribute to the pool of operating systems known to Nmap and thus it will be more accurate for everyone. - OS detection enables several other tests which make use - of information that is gathered during the process anyway. One of these - is uptime measurement, which uses the TCP timestamp option (RFC 1323) to guess when a machine was last rebooted. This is only - reported for machines which provide this information. Another is + OS detection enables some other tests which make use + of information that is gathered during the process anyway. + One of these is TCP Sequence Predictability Classification. This measures approximately how hard it is to establish a forged TCP connection against the remote host. It is useful for @@ -1894,6 +1892,15 @@ way. vulnerable to several advanced information gathering and spoofing attacks. + uptime guess + + Another bit of extra information enabled by OS detection is a guess + at a target's uptime. This uses the TCP timestamp option (RFC 1323) to guess when a machine was last rebooted. + The guess can be inaccurate due to the timestamp counter not being + initialized to zero or the counter overflowing and wrapping around, + so it is printed only in verbose mode. + + A paper documenting the workings, usage, and customization of OS diff --git a/output.cc b/output.cc index e85e987b7..12fe9191f 100644 --- a/output.cc +++ b/output.cc @@ -1738,7 +1738,8 @@ void printosscanoutput(Target *currenths) { gettimeofday(&tv, NULL); strncpy(tmbuf, ctime(&(currenths->seq.lastboot)), sizeof(tmbuf)); chomp(tmbuf); - log_write(LOG_PLAIN,"Uptime: %.3f days (since %s)\n", (double) (tv.tv_sec - currenths->seq.lastboot) / 86400, tmbuf); + if (o.verbose) + log_write(LOG_PLAIN,"Uptime guess: %.3f days (since %s)\n", (double) (tv.tv_sec - currenths->seq.lastboot) / 86400, tmbuf); log_write(LOG_XML, "\n", tv.tv_sec - currenths->seq.lastboot, tmbuf); }