diff --git a/CHANGELOG b/CHANGELOG index aed27e63d..04e5581a9 100644 --- a/CHANGELOG +++ b/CHANGELOG @@ -1,5 +1,14 @@ # Nmap Changelog ($Id$); -*-text-*- +o There is a new OS detection test called SEQ.CI. Like TI and II, CI + classifies the target's IP ID sequence generation algorithm. CI is + based on the responses received to the probes sent to a closed port. + The algorithm for closed ports has been observed to differ from that + for open ports, though for what operating systems this happens is + not yet known. The new test won't have an effect until new + fingerprints containing it are added to nmap-os-db. Dario Ciccarone + suggested this enhancement. [David] + o OS fingerprints now include the SEQ.II test (ICMP IP ID sequence generation) even if there are no other SEQ test results. [David] diff --git a/nmap-os-db b/nmap-os-db index b127882e6..c1497c0e5 100644 --- a/nmap-os-db +++ b/nmap-os-db @@ -32,7 +32,7 @@ # are used when there are no perfect matches to determine which OS # fingerprint matches a target machine most closely. MatchPoints -SEQ(SP=25%GCD=75%ISR=25%TI=100%II=100%SS=80%TS=100) +SEQ(SP=25%GCD=75%ISR=25%TI=100%CI=0%II=100%SS=80%TS=100) OPS(O1=20%O2=20%O3=20%O4=20%O5=20%O6=20) WIN(W1=15%W2=15%W3=15%W4=15%W5=15%W6=15) ECN(R=100%DF=20%T=15%TG=15%W=15%O=15%CC=100%Q=20)