Re: Nmap 2.30BETA20 Released

[Justin <jguyett () andrew cmu edu>]

On Thu, 20 Apr 2000, Andrew Brown wrote:

> there's also a small patch to services.c to ignore a couple of
> protocol types sometimes found in /etc/services that nmap doesn't
> handle (reducing the number of complaints when running it with a few
> -d's).
>
> i'd also like to suggest that you distribute the "massive" services
> file that i've been maintaining for a year or so at
>
>     http://www.graffiti.com/services
>
> as the nmap-services file.

Not necessarily a good or desireable thing.  Even with the not-so-complete
nmap services file, I usually find it reporting on services that aren't
really running, simply because they're above 1023, or because someone
decided to run a non-"standard" service on a privledged port.  In fact,
I'd almost like to see all the services on non-privledged ports be removed
from the services file nmap uses.  At least all except 6660-6670, 8000,
8080, 12345, and other such common or critically important high ports. 
Idealy nmap would have a module to verify each servce it finds, so that
(for example) an open port 443 wouldn't be reported as ssl / http if it
isn't acting like a websserver.

Justin