diff --git a/CHANGELOG b/CHANGELOG
index bc82eb55a..0555dcfc1 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -138,6 +138,10 @@ o The NSE C modules in nselib-bin are now linked explicitly against
   Because RPM builds are static this fixes NSE C modules in
   RPMs. [David]
 
+o A new attribute has been added to XML output, scanflags, which lists
+  all user specified --scanflags for the scan. The XML output version
+  and DTD have been modified to account for this. [Michael]
+
 Nmap 4.68 [2008-6-28]
 
 o Doug integrated all of your version detection submissions and
diff --git a/docs/nmap.dtd b/docs/nmap.dtd
index f8af11a19..c0501a09c 100644
--- a/docs/nmap.dtd
+++ b/docs/nmap.dtd
@@ -79,16 +79,17 @@
 			start		%attr_numeric;	#IMPLIED
 			startstr	CDATA	        #IMPLIED
 			version		CDATA		#REQUIRED
-			xmloutputversion (1.02)		#REQUIRED
+			xmloutputversion (1.03)		#REQUIRED
 >
 
 <!-- this element is written in output.c:doscaninfo() -->
 <!ELEMENT scaninfo	EMPTY >
 <!ATTLIST scaninfo
-			type		%scan_types;	#REQUIRED
+			type		%scan_types;	 #REQUIRED
+			scanflags	CDATA		 #IMPLIED
 			protocol	%port_protocols; #REQUIRED
-			numservices	%attr_numeric;	#REQUIRED
-			services	CDATA		#REQUIRED
+			numservices	%attr_numeric;	 #REQUIRED
+			services	CDATA		 #REQUIRED
 >
 
 <!-- these elements are written in nmap.c:nmap_main() -->
diff --git a/nmap.cc b/nmap.cc
index 98fb9717b..0f078dc7a 100644
--- a/nmap.cc
+++ b/nmap.cc
@@ -1499,7 +1499,7 @@ int nmap_main(int argc, char *argv[]) {
   for(i=0; i < argc; i++) 
     log_write(LOG_XML, (i == argc-1)? "%s\" " : "%s ", fakeargv[i]);
 
-  log_write(LOG_XML, "start=\"%lu\" startstr=\"%s\" version=\"%s\" xmloutputversion=\"1.02\">\n",
+  log_write(LOG_XML, "start=\"%lu\" startstr=\"%s\" version=\"%s\" xmloutputversion=\"1.03\">\n",
 	    (unsigned long) timep, mytime, NMAP_VERSION);
 
   output_xml_scaninfo_records(&ports);
diff --git a/output.cc b/output.cc
index b19a53186..e85e987b7 100644
--- a/output.cc
+++ b/output.cc
@@ -1228,10 +1228,35 @@ void output_ports_to_machine_parseable_output(struct scan_lists *ports,
  log_flush_all();
 }
 
+//A simple helper function for doscaninfo handles the c14n of o.scanflags
+static void doscanflags(){
+    struct {
+      unsigned char flag;
+      const char *name;
+    } flags[] = {
+      { TH_FIN, "FIN" }, { TH_SYN, "SYN" }, { TH_RST, "RST" },
+      { TH_PUSH, "PSH" }, { TH_ACK, "ACK" }, { TH_URG, "URG" },
+      { TH_ECE, "ECE" }, { TH_CWR, "CWR" }
+    };
+    if(o.scanflags!=-1){
+      log_write(LOG_XML, "scanflags=\"");
+      for(unsigned int i=0;i<sizeof(flags) / sizeof(flags[0]);i++){
+        if(o.scanflags & flags[i].flag){
+          log_write(LOG_XML, "%s",flags[i].name);
+        }
+      }
+      log_write(LOG_XML, "\"");
+    }
+}
+
 /* Simple helper function for output_xml_scaninfo_records */
 static void doscaninfo(const char *type, const char *proto, unsigned short *ports, 
 		  int numports) {
-  log_write(LOG_XML, "<scaninfo type=\"%s\" protocol=\"%s\" numservices=\"%d\" services=\"", type, proto, numports);
+  log_write(LOG_XML, "<scaninfo type=\"%s\" ", type);
+  if(strncmp(proto,"tcp",3)==0){
+	doscanflags();
+  }
+  log_write(LOG_XML, " protocol=\"%s\" numservices=\"%d\" services=\"", proto, numports);
   output_rangelist_given_ports(LOG_XML, ports, numports);
   log_write(LOG_XML, "\" />\n");
 }