Because of previous merging, some fingerprints had grown to encompass
others. Other fingerprints for the same or similar devices were close
enough that they could be merged. This was a manual review of 614
fingerprints that were identified as differing from some other
fingerprint by only the SEQ line (256 unique non-SEQ fingerprints).
The result: 44 fingerprints were merged into others, or were deleted
because they were a proper subset of some other fingerprint (e.g. Linux
2.6.17 that is not distinguishable from a broader Linux 2.6.11-2.6.32
fingerprint). A couple of these appeared to be identical copy-and-paste
errors in the past. I was very conservative in what I chose to merge,
choosing only the most-obvious fingerprint pairs that did not lose
information (e.g. not merging unrelated specialized devices, even if
their fingerprints were very close).
d33tah noticed that the # in "Fingerprint OpenBSD 5.0 GENERIC#43 i386"
was being interpreted as a comment, resulting in matches for "OpenBSD
5.0 GENERIC". Looking at this, it appears that no other OS fingerprints
put the build number in the Fingerprint line, and this fingerprint
closely matches another OpenBSD 5.0 fingerprint. Changed to drop
everything after GENERIC.
http://seclists.org/nmap-dev/2013/q4/68
Confirmed with David that an over-simple string substitution likely
caused this. Manually changed these back to conforming fingerprints.
Keys only changed, values were not affected.
