diff --git a/CHANGELOG b/CHANGELOG index 08806a2b6..46aa9d3f1 100644 --- a/CHANGELOG +++ b/CHANGELOG @@ -1,5 +1,8 @@ # Nmap Changelog ($Id$); -*-text-*- +o Performed a bunch of OS fingerprint text canonicalization thanks to + reports of dozens of capitalization inconsistencies from Suicidal Bob. + 4.22SOC2 o NSE compilation fixes by Stoiko and Kris diff --git a/nmap-os-db b/nmap-os-db index 9f5a3f48d..8d2930256 100644 --- a/nmap-os-db +++ b/nmap-os-db @@ -372,8 +372,8 @@ T7(R=Y%DF=Y%T=3F%TG=3F%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=) U1(DF=N%T=3F%TG=3F%TOS=C0%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUL=G%RUD=G) IE(DFI=N%T=3F%TG=3F%TOSI=S%CD=S%SI=S%DLI=S) -# Alcatel Speed-Touch Pro ADSL Modem (Firmware: Khdsaa3.270 (1003194)) -Fingerprint Alcatel Speed-Touch Pro ADSL Modem +# Alcatel SpeedTouch Pro ADSL Modem (Firmware: Khdsaa3.270 (1003194)) +Fingerprint Alcatel SpeedTouch Pro ADSL Modem Class Alcatel | embedded || broadband router SEQ(SP=B-15%GCD=FA00|1F400|2EE00|3E800|4E200%ISR=96-A0%TI=I%II=I%SS=S%TS=1) OPS(O1=M200NW0NNT11%O2=M200NW0NNT11%O3=M200NW0NNT11%O4=M200NW0NNT11%O5=M200NW0NNT11%O6=M200NNT11) @@ -718,7 +718,7 @@ T7(R=Y%DF=N%T=40%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=) U1(DF=N%T=40%TG=40%TOS=0%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=0%RUL=G%RUD=G) IE(DFI=S%T=40%TG=40%TOSI=S%CD=S%SI=S%DLI=S) -# Apple Mac OS X 10.4.8 (Tiger) on X86 Core Duo (first-gen Intel iMac 17"/1.83): Darwin 8.8.1 Darwin Kernel Version 8.8.1: Mon Sep 25 19:42:00 PDT 2006 root:xnu-792.13.8.obj~1/RELEASE_I386 i386 i386) +# Apple Mac OS X 10.4.8 (Tiger) on x86 Core Duo (first-gen Intel iMac 17"/1.83): Darwin 8.8.1 Darwin Kernel Version 8.8.1: Mon Sep 25 19:42:00 PDT 2006 root:xnu-792.13.8.obj~1/RELEASE_I386 i386 i386) # Darwin 8.8.0 Darwin Kernel Version 8.8.0: Fri Sep 8 17:18:57 PDT 2006; root:xnu-792.12.6.obj~1/RELEASE_PPC Power Macintosh powerpc # Mac OS X Server 10.4.9 PowerPC Darwin 8.9.0 # Darwin 8.9.1 Darwin Kernel Version 8.9.1: Thu Feb 22 20:58:18 PST 2007; root:xnu-792.18.15~1/RELEASE_PPC Power Macintosh powerpc (MacOS 10.4.9 Server [PPC]) @@ -741,7 +741,7 @@ IE(DFI=S%T=40%TG=40%TOSI=S%CD=S%SI=S%DLI=S) # Apple Mac OS 10.4.8/ppc (Darwin tetralyre 8.8.0 Darwin Kernel Version 8.8.0: Fri Sep 8 17:18:57 PDT # Darwin 8.8.1 Darwin Kernel Version 8.8.1: Mon Sep 25 19:42:00 PDT 2006; root:xnu-792.13.8.obj~1/RELEASE_I386 i386 i386 -# Apple Mac OS X 10.4.8 (Tiger) on X86 Core Duo +# Apple Mac OS X 10.4.8 (Tiger) on x86 Core Duo # Apple Mac OS X 10.4.9, Darwin Kernel Version 8.9.1: Thu Feb 22 20:55:00 PST 2007; root:xnu-792.18.15~1/RELEASE_I386 i386 i386 Fingerprint Apple Mac OS X 10.4.8 - 10.4.9 (Tiger) Class Apple | Mac OS X | 10.4.X | general purpose @@ -3795,7 +3795,7 @@ U1(DF=N%T=40%TG=40%TOS=0%IPL=38%UN=0%RIPL=G%RID=1042%RIPCK=Z%RUCK=0%RUL=G%RUD=G) IE(DFI=S%T=40%TG=40%TOSI=S%CD=S%SI=S%DLI=S) # HP laserjet 4100n -Fingerprint HP LaserJet 4100n printer +Fingerprint HP LaserJet 4100N printer Class HP | embedded || printer SEQ(SP=13-1D%GCD=FA00|1F400|2EE00|3E800|4E200%ISR=98-A2%TI=I%II=I%SS=S%TS=U) OPS(O1=M5B4NW0%O2=M5B4NW0%O3=M5B4NW0%O4=M5B4NW0%O5=M5B4NW0%O6=M5B4) @@ -6698,7 +6698,7 @@ U1(DF=N%T=40%TG=40%TOS=C0%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUL=G%RUD=G) IE(DFI=N%T=40%TG=40%TOSI=S%CD=S%SI=S%DLI=S) # Centos 4.3 Linux 2.6.17.11-grsec #1 Sat Sep 16 06:39:06 EDT 2006 i686 athlon i386 GNU/Linux -# CentOS 4.4 Linux 2.6.17.11 (CentOS 4.4, X86, custom compiled kernel) +# CentOS 4.4 Linux 2.6.17.11 (CentOS 4.4, x86, custom compiled kernel) Fingerprint Linux 2.6.17.11 (CentOS 4.3 or 4.4, x86) Class Linux | Linux | 2.6.X | general purpose SEQ(SP=BD-D5%GCD=<7%ISR=C3-D7%TI=Z%II=I%TS=U) @@ -7952,7 +7952,7 @@ T7(R=Y%DF=N%T=80|81%TG=81%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=) U1(DF=N%T=80|81%TG=81%TOS=0%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUL=G%RUD=G) IE(DFI=S%T=80|81%TG=81%TOSI=Z%CD=Z%SI=S%DLI=S) -# Taken on an X86 SMP machine +# Taken on an x86 SMP machine Fingerprint Microsoft Windows 2000 SP4 Class Microsoft | Windows | 2000 | general purpose SEQ(SP=7D-8A%GCD=<7%ISR=99-9D%TI=I%II=I%SS=S) @@ -9179,7 +9179,7 @@ IE(DFI=N%T=80%TG=80%TOSI=S%CD=Z%SI=S%DLI=S) # W2003 Server Standard Edition v 5.2 build3790.srv003_rtm.030324-2048 , no sp, MUI RU terminal server started app mode # Microsoft Windows XP Home SP2 (German) [Winver: Version 5.1 (build 2600.xpsp_sp2_gdr.050301-1519: Service Pack 2)] -# Microsoft Windows 2003 (Swedish) X86 version 5.2 (Build 3790.srv03_rtm.030324-2048) +# Microsoft Windows 2003 (Swedish) x86 version 5.2 (Build 3790.srv03_rtm.030324-2048) # Microsoft Windows Server 2003 Enterprise Edition 64-Bit with SP1 # Microsoft Windows Server 2003 standard edition # Microsoft Windows 2003 Standard Edition (English) [Winver: Version 5.2 (build 3790.srv03_gdr.050225-1827 @@ -11665,7 +11665,7 @@ IE(DFI=N%T=41%TG=41%TOSI=Z%CD=S%SI=S%DLI=S) # Symbol WS5000 Wireless Switch # Software 1.4.3.0-012R, firmware 2.2 (7/9/02) -Fingerprint Symbol WS5000 Wireless Switch +Fingerprint Symbol WS5000 wireless switch Class Symbol | embedded || WAP SEQ(SP=5-15%GCD=FA00|1F400|2EE00|3E800|4E200|5DC00%ISR=96-A0%TI=I%II=I%SS=S%TS=U) OPS(O1=M5B4%O2=M5B4%O3=M5B4%O4=M5B4%O5=M5B4%O6=M5B4) @@ -12352,7 +12352,7 @@ U1(DF=N%T=FE%TG=FE%TOS=0%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUL=G%RUD=G) IE(DFI=N%T=FE%TG=FE%TOSI=S%CD=S%SI=S%DLI=S) # ZyNOS Firmware Version: V3.62(WK.16) ZyWALL 2 -Fingerprint ZyXEL ZyWall 2 +Fingerprint ZyXEL ZyWALL 2 Class ZyXEL | ZyNOS || firewall SEQ(SP=0-29%GCD=1000|2000|3000|4000|5000|6000|64000|C8000|12C000|190000|1F4000|258000%ISR=AB-B5%TI=I%II=I%SS=S%TS=U) OPS(O1=|M200%O2=|M200%O3=|M200%O4=|M200%O5=|M200%O6=|M200) diff --git a/nmap-os-fingerprints b/nmap-os-fingerprints index 1d18fc85e..113cbf68a 100644 --- a/nmap-os-fingerprints +++ b/nmap-os-fingerprints @@ -55,7 +55,7 @@ T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) # 3Com 812 OfficeConnect ADSL Router Firmware version: 2.0.0 -Fingerprint 3Com OfficeConnect 812 aDSL router +Fingerprint 3Com OfficeConnect 812 ADSL router Class 3Com | embedded || broadband router TSeq(Class=TD%gcd=48B5D%IPID=I%TS=U) T1(DF=N%W=111C%ACK=S++%Flags=AS%Ops=ME) @@ -3019,7 +3019,7 @@ T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) -Fingerprint Chase IOLan Terminal Server +Fingerprint Chase/Perle IOLAN terminal server Class Chase | embedded || terminal server T1(Resp=Y%DF=N%W=860%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) @@ -3031,7 +3031,7 @@ T7(Resp=Y%DF=N%W=0%ACK=S|O%Flags=AR%Ops=) PU(Resp=N) # Chase/Perle IOLAN Terminal Server v3.5.02 CDi -Fingerprint Chase/Perle IOLAN Terminal Server +Fingerprint Chase/Perle IOLAN terminal server Class Chase | embedded || terminal server TSeq(Class=TD%gcd=<84%SI=<1E) T1(DF=N%W=600%ACK=S++%Flags=AS%Ops=) @@ -3402,7 +3402,7 @@ PU(Resp=N) # The "True Random" is bogus, it is because of sequences # from servers behind the LB like: 4B028A43 E016F844 4B05F5D2 4DB8B4C E402869 # Cisco Localdirector 430, running OS 2.1 -Fingerprint Cisco Localdirector load balancer +Fingerprint Cisco LocalDirector load balancer Class Cisco | embedded || load balancer TSeq(Class=TR|C) T1(DF=N%W=C00|400|1000%ACK=S++%Flags=AR%Ops=WNMETL) @@ -7284,7 +7284,7 @@ PU(DF=N%TOS=30%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) # FreeBSD 4.3-RC # FreeBSD 4.2-RELEASE i386 -Fingerprint FreeBSD 4.2 - 4.3-RC (X86) +Fingerprint FreeBSD 4.2 - 4.3-RC (x86) Class FreeBSD | FreeBSD | 4.X | general purpose TSeq(Class=RI%gcd=<6%SI=CD3%IPID=I%TS=100HZ) T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) @@ -8021,8 +8021,8 @@ T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # GrandStream 486 Voice over IP adapter -Fingerprint GrandStream 486 VoIP adapter -Class GrandStream | embedded || VoIP adapter +Fingerprint Grandstream 486 VoIP adapter +Class Grandstream | embedded || VoIP adapter TSeq(Class=C%Val=3883537A%IPID=I%TS=U) T1(DF=Y%W=109%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=Y%W=C00|1000%ACK=S++%Flags=AR%Ops=) @@ -8034,7 +8034,7 @@ T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) Fingerprint Grandstream HT-286 POTS<->VoIP phone gateway device -Class GrandStream | embedded || VoIP adapter +Class Grandstream | embedded || VoIP adapter TSeq(Class=C%Val=66559055%IPID=I%TS=U) T1(Resp=N) T2(Resp=Y%DF=Y%W=1000|800%ACK=S++%Flags=AR%Ops=) @@ -8046,7 +8046,7 @@ T7(DF=Y%W=400%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Grandstream BT-100 IP Phone -Class GrandStream | embedded || VoIP phone +Class Grandstream | embedded || VoIP phone TSeq(Class=C%Val=FBD5528A%IPID=I%TS=U) T1(DF=Y%W=109%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=Y%W=400|1000|800%ACK=S++%Flags=AR%Ops=) @@ -8057,8 +8057,8 @@ T6(DF=Y%W=400%ACK=S++%Flags=AR%Ops=) T7(DF=Y%W=1000|400|C00%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) -Fingerprint GrandStream BT-100 IP Phone -Class GrandStream | embedded || VoIP phone +Fingerprint Grandstream BT-100 IP Phone +Class Grandstream | embedded || VoIP phone T1(DF=Y%W=109%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=Y%W=400|800%ACK=S++%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=109%ACK=S++%Flags=AS%Ops=M) @@ -8070,7 +8070,7 @@ PU(Resp=N) # Grandstream BudgeTone101 VoIP phone, firmware 1.0.4.50 Fingerprint Grandstream BT-101 IP phone -Class GrandStream | embedded || VoIP phone +Class Grandstream | embedded || VoIP phone TSeq(Class=C%Val=75DFD55D%IPID=I%TS=U) T1(Resp=N) T2(Resp=Y%DF=Y%W=400|C00%ACK=S++%Flags=AR%Ops=) @@ -8082,8 +8082,8 @@ T7(DF=Y%W=800|400|C00%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # GrandStream BT-101 with firmware 1.0.5.22 -Fingerprint GrandStream BT-101 IP phone -Class GrandStream | embedded || VoIP phone +Fingerprint Grandstream BT-101 IP phone +Class Grandstream | embedded || VoIP phone TSeq(Class=C%Val=5CE04AC5%IPID=I%TS=U) T1(DF=Y%W=109%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=Y%W=C00|800%ACK=S++%Flags=AR%Ops=) @@ -8095,7 +8095,7 @@ T7(DF=Y%W=800|400%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Grandstream BudgeTone 101 IP Phone -Class GrandStream | embedded || VoIP phone +Class Grandstream | embedded || VoIP phone TSeq(Class=C%IPID=I%TS=U) T1(Resp=N) T2(Resp=Y%DF=Y%W=800|1000|C00%ACK=S++%Flags=AR%Ops=) @@ -8107,7 +8107,7 @@ T7(DF=Y%W=C00|800|1000%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Grandstream IP Phone -Class GrandStream | embedded || VoIP phone +Class Grandstream | embedded || VoIP phone TSeq(Class=C%IPID=I%TS=U) T1(Resp=N) T2(Resp=Y%DF=Y%W=1000%ACK=S++%Flags=AR%Ops=) @@ -8120,8 +8120,8 @@ PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # GrandStream BudgeTone-100 VoIP phone # GrandStream BudgeTone-100 1.0.5.16 -Fingerprint GrandStream VoIP Phone (BudgeTone-100) -Class GrandStream | embedded || VoIP phone +Fingerprint Grandstream VoIP Phone (BudgeTone-100) +Class Grandstream | embedded || VoIP phone TSeq(Class=C%Val=4D86DFEA|F66461C1%IPID=I%TS=U) T1(DF=Y%W=109%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=Y%W=1000|400%ACK=S++%Flags=AR%Ops=) @@ -8134,7 +8134,7 @@ PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Grandstream Budge Tone 101 VoIP phone, firmware 1.0.5.16 Fingerprint Grandstream VoIP Phone (BudgeTone-101) -Class GrandStream | embedded || VoIP phone +Class Grandstream | embedded || VoIP phone TSeq(Class=C%Val=4F4264AA%IPID=I%TS=U) T1(DF=Y%W=109%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=Y%W=400|800%ACK=S++%Flags=AR%Ops=) @@ -11247,7 +11247,7 @@ T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=F|E%ULEN=134%DAT=E) -# Linux kernel 2.4.4-4GB (X86) from Red hat +# Linux kernel 2.4.4-4GB (x86) from Red hat Fingerprint Linux 2.4.4 Class Linux | Linux | 2.2.X | general purpose TSeq(Class=RI%gcd=<6%SI=19E%IPID=Z%TS=U) @@ -11583,7 +11583,7 @@ T6(DF=N%W=0%ACK=O%Flags=RF%Ops=) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) -# Linux kernel 2.4.19C13_V (X86) Sun Cobalt RaQ550 +# Linux kernel 2.4.19C13_V (x86) Sun Cobalt RaQ550 Fingerprint Linux 2.4.19 Class Linux | Linux | 2.4.X | general purpose TSeq(Class=RI%gcd=<6%SI=<20DD6C4&>54211%IPID=Z%TS=100HZ) @@ -11597,7 +11597,7 @@ T7(DF=N%W=1000|400%ACK=S++%Flags=AR%Ops=WNMETL) PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Mandrake 9.1 SMP 2.4.19-16mdksmp #1 SMP Fri Sep 20 16:08:37 CEST 2002 i686 unknown unknown GNU/Linux -Fingerprint Linux 2.4.19 (Mandrake, X86) +Fingerprint Linux 2.4.19 (Mandrake, x86) Class Linux | Linux | 2.4.X | general purpose TSeq(Class=RI%gcd=<6%SI=<263CFAC&>55266%IPID=Z%TS=U) T1(DF=Y%W=16D0%ACK=S++|O%Flags=AS%Ops=M) @@ -11648,7 +11648,7 @@ T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) -# Linux kernel 2.4.20-4GB (X86) +# Linux kernel 2.4.20-4GB (x86) Fingerprint Linux 2.4.20 Class Linux | Linux | 2.4.X | general purpose TSeq(Class=RI%gcd=<8%SI=<1540758&>1B32B%IPID=I%TS=100HZ) @@ -11752,7 +11752,7 @@ T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Linux localhost 2.4.20-30.9 #1 Wed Feb 4 20:44:26 EST 2004 i686 i686 i386 GNU/Linux -Fingerprint Linux 2.4.20 (X86, Redhat 7.3) +Fingerprint Linux 2.4.20 (x86, Redhat 7.3) Class Linux | Linux | 2.4.X | general purpose TSeq(Class=RI%gcd=<6%SI=<3A23C96&>949CB%IPID=Z%TS=100HZ) T1(DF=Y%W=1630|16D4%ACK=S++%Flags=AS%Ops=MNNTNW) @@ -11794,7 +11794,7 @@ T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0|C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E) -# Linux kernel 2.4.20-wolk4.17s (X86) +# Linux kernel 2.4.20-wolk4.17s (x86) # Linux demeter 2.4.20-wolk4.17s #1 i686 unknown # "Devil Linux 1.2.2" 2.4.27-grsec #1 SMP i686 AuthenticAMD unknown+GNU/Linux # Gentoo 2.4.28-hardened-r5 (Up to date with Gentoo Hardened Patches) on a Proliant 1600R @@ -11903,7 +11903,7 @@ T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0|C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # SuSE Linux 8.1 (i386) 2.4.21 #4 SMP -Fingerprint Linux 2.4.21 (Suse, X86) +Fingerprint Linux 2.4.21 (Suse, x86) Class Linux | Linux | 2.4.X | general purpose TSeq(Class=RI%gcd=<6%SI=<2634758&>55644%IPID=Z%TS=100HZ) T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) @@ -12043,7 +12043,7 @@ PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Linux 2.6.7-hardened-r16 #1 x86_64 AMD Athlon(tm) 64 Processor 3000+ AuthenticAMD GNU/Linux # Slackware 10 kernel 2.6.7 # Fedora Core 2 With Kernel 2.6.8-1 -# Kernel 2.6.3 (X86); Gentoo Distro +# Kernel 2.6.3 (x86); Gentoo Distro # Gentoo Base System version 1.4.16 Linux linuxbox 2.6.9 #2 SMP+Pentium III (Coppermine) GenuineIntel GNU/Linux # Linux kernel 2.6.10-1.760_FC3 from Fedora Core 3 Fingerprint Linux 2.4.22 or 2.6.3 - 2.6.10 @@ -12148,7 +12148,7 @@ T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) -# Adamantix GNU/Linux with Linux 2.4.25-grsec (X86) +# Adamantix GNU/Linux with Linux 2.4.25-grsec (x86) Fingerprint Linux 2.4.25 w/grsec (x86) Class Linux | Linux | 2.4.X | general purpose TSeq(Class=TR%gcd=<6%IPID=RD%TS=100HZ) @@ -12512,7 +12512,7 @@ T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=14|30%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) -# Linux kernel 2.6.8-1-k7-smp (X86) Debian GNU/Linux 3.1 (Sarge - testing) +# Linux kernel 2.6.8-1-k7-smp (x86) Debian GNU/Linux 3.1 (Sarge - testing) # Linux 2.6.11-gentoo-r2-ck1 # Linux 2.6.11-gentoo-r4 #1 i686 P4CPU+2.40GHz GenuineIntel GNU/Linux Gentoo Base System version 1.4.16 # Linux 2.6.11-gentoo-r9-nymph #1i686 Pentium III (Coppermine) GenuineIntel GNU/Linux @@ -12619,7 +12619,7 @@ T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) -# Linux kernel 2.6.10 X86 Slackware 10.0 +# Linux kernel 2.6.10 x86 Slackware 10.0 Fingerprint Linux 2.6.10 Class Linux | Linux | 2.6.X | general purpose TSeq(Class=RI%gcd=<6%SI=<1FB5BDE&>51299%IPID=Z%TS=1000HZ) @@ -12699,9 +12699,9 @@ T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) -# Linux Kernel 2.6.3 (X86) +# Linux Kernel 2.6.3 (x86) # Linux 2.6.7 #3 Sat Jul 17 13:25:29 EEST 2004 i486 -Fingerprint Linux 2.6.3 - 2.6.7 (X86) +Fingerprint Linux 2.6.3 - 2.6.7 (x86) Class Linux | Linux | 2.6.X | general purpose TSeq(Class=RI%gcd=<6%SI=<205C682&>528B7%IPID=Z%TS=1000HZ) T1(DF=Y%W=4000%ACK=S++%Flags=AS%Ops=MNNTNW) @@ -12742,7 +12742,7 @@ PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) # Slackware current kernel 2.6.9 # Fedora Core 3 Linux Kernel 2.6.9 x86 (i386) -# Linux kernel 2.6.4-52 from (X86) SuSE Linux 9.1 +# Linux kernel 2.6.4-52 from (x86) SuSE Linux 9.1 # Debian Sarge Linux 2.6.6-1, i686 (x86) Fingerprint Linux 2.6.4 - 2.6.9 Class Linux | Linux | 2.6.X | general purpose @@ -12781,7 +12781,7 @@ PU(Resp=N) # Linux 2.6.8-24.11-default #1 Fri Jan 14 13:01:26 UTC 2005 i686 i686 i386 GNU/Linux # Linux 2.6.5-7.155.29-default #1 Thu Jun 2 12:07:05 UTC 2005 i686 i686 i386 GNU/Linux (SuSE+9.2 ) # Linux Debian Sarge 2.6.11.7 -# Linux kernel 2.6.10-4GB (X86) with Debian GNU/Linux 3.1 +# Linux kernel 2.6.10-4GB (x86) with Debian GNU/Linux 3.1 # Linux Kernel 2.6.7-1-686-smp from backports.org Debian Woody Fingerprint Linux 2.6.5 - 2.6.11 Class Linux | Linux | 2.6.X | general purpose @@ -12824,8 +12824,8 @@ T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) -# Linux kernel 2.6.6-1-k7 (X86) from Debian Testing -Fingerprint Linux 2.6.6-1-k7 (X86) +# Linux kernel 2.6.6-1-k7 (x86) from Debian Testing +Fingerprint Linux 2.6.6-1-k7 (x86) Class Linux | Linux | 2.6.X | general purpose TSeq(Class=RI%gcd=<6%SI=<235C288&>5A817%IPID=Z%TS=1000HZ) T1(DF=N%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) @@ -12877,8 +12877,8 @@ T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) -# Linux kernel 2.6.7 (X86) from Mepis -Fingerprint Linux 2.6.7 (X86) +# Linux kernel 2.6.7 (x86) from Mepis +Fingerprint Linux 2.6.7 (x86) Class Linux | Linux | 2.6.X | general purpose TSeq(Class=RI%gcd=<6%SI=<14E7284&>35813%IPID=Z%TS=U) T1(DF=Y%W=1800%ACK=S++%Flags=AS%Ops=MNW) @@ -12892,7 +12892,7 @@ PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Linux kernel 2.6.8 on PLD Linux # Linux kernel 2.6.8.1-10mdk (x86) from Mandrake 10.1 Community -# Linux kernel 2.6.8.1-10mdk (X86) from Mandrake 10.1 community +# Linux kernel 2.6.8.1-10mdk (x86) from Mandrake 10.1 community # Linux kernel 2.6.7-SMP from Knoppix 3.6 # Linux 2.6.8.1-4-k7 i686 GNU/Linux Fingerprint Linux 2.6.7 - 2.6.8 @@ -13257,7 +13257,7 @@ T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) # Bart's Network Boot Disk 2.7 http://www.nu2.nu/bootdisk/network/ i386 -Fingerprint Bart's Network Boot Disk 2.7 (X86) MS-DOS +Fingerprint Bart's Network Boot Disk 2.7 (x86) MS-DOS Class Microsoft | DOS || general purpose TSeq(Class=TD%gcd=<6%SI=<1E%IPID=I%TS=U) T1(DF=N%W=5AA%ACK=S++%Flags=AS%Ops=M) @@ -13810,7 +13810,7 @@ T6(DF=N%W=0%ACK=S++%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) -# Microsoft Windows 98 X86 No Service Pack +# Microsoft Windows 98 x86 No Service Pack # Microsoft Windows 98 4.10.1998 Fingerprint Microsoft Windows 98 4.10.1998 Class Microsoft | Windows | 95/98/ME | general purpose @@ -14762,7 +14762,7 @@ T6(Resp=N) T7(Resp=N) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) -# Windows 2000 Version 5.0 Build 2195 SP 4 X86 +# Windows 2000 Version 5.0 Build 2195 SP 4 x86 Fingerprint Microsoft Windows 2000 SP4 Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=TR%gcd=<6%IPID=I) @@ -16686,7 +16686,7 @@ PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # 1262 # NetBSD 1.6.2 (GENERIC) #0: Wed Feb 11 08:05:11 UTC 2004 sparc -Fingerprint NetBSD 1.6.2 (X86) +Fingerprint NetBSD 1.6.2 (x86) Class NetBSD | NetBSD || general purpose T1(DF=N%W=4000|FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) @@ -16697,7 +16697,7 @@ T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) -# NetBSD 1.6.2 on X86 +# NetBSD 1.6.2 on x86 # Avocent Switchview net KVM switch - this is a embedded device that makes a regular KVM accessible over IP. # NetBSD 2.0_BETA i386 Fingerprint NetBSD 1.6.2 - 2.0_BETA or Avocent Switchview net KVM switch @@ -16988,7 +16988,7 @@ PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Netopia R3100-I DSL Router Firmware version v4.7.2 # Netopia 7100-C with firmware v4.6.3 -Fingerprint Netopia DSL Router +Fingerprint Netopia DSL router Class Netopia | embedded || broadband router TSeq(Class=TD%gcd=eMule (\d[-.\w]+) match http m|^HTTP/1\.1 \d\d\d .*\r\nServer: eMule\r\n.*eMule Plus (\d[-.\w]+) |s p/eMule Plus P2P/ v/$1/ match http m|^HTTP/1\.1 \d\d\d .*\r\nServer: aMule\r\n.*<title>aMule (\d[-.\w]+) - Web Control Panel|s p/aMule P2P/ v/$1/ match http m|^HTTP/1\.1 \d\d\d .*\r\nServer: aMule\r\n| p/aMule P2P/ +match http m|^HTTP/1\.0 200 OK\r\nServer: Agent-ListenServer-HttpSvr/1\.0\r\n.*([-.\w]+)([\d\.]+)|s p/Network Associates ePolicy Orchestrator/ i/Computername: $1 Version: $2/ # Network Associates EPO 3.0 match http m|^HTTP/1\.0 200 OK\r\nServer: Agent-ListenServer-HttpSvr/1\.0\r\n.*([-.\w]+)|s p/Network Associates ePolicy Orchestrator/ i/Computername: $1/ match http m|^HTTP/1\.0 403 Forbidden\r\nServer: Agent-ListenServer-HttpSvr/1\.0\r\n| p/Network Associates ePolicy Orchestrator/ @@ -5528,8 +5529,14 @@ rarity 5 ports 5060 # Some VoIP phones take longer to respond totalwaitms 7500 + +# SIP Proxy Servers # OpenSER SIP Server -match sip m|Server: OpenS[Ee][Rr] \((.*?) \((.*?)\)\)| p/OpenSER SIP Server/ v/$1/ i/$2/ +match sip m|Server: OpenS[Ee][Rr] \(([\w\d\.-]+) \(([\d\w/]+)\)\)| p/OpenSER SIP Server/ v/$1/ i/$2/ +# SIP Express Router +match sip m|Server: Sip EXpress router \(([\w\d\.-]+) \(([\d\w/]+)\)\)| p/SIP Express Router/ v/$1/ i/$2/ + +# SIP User Agents # Polycom SoundPoint match sip m|User-Agent: PolycomSoundPointIP-SPIP_(\d+)-UA/([\d\.]+)| p/Polycom SoundPoint/ v/$1/ i/firmware $2/ d/VoIP phone/