Nmap Development mailing list archives
matchline for dnsmasq
From: Sven Klemm <sven () c3d2 de>
Date: Wed, 30 Jan 2008 16:52:32 +0100
Hi everyone, nmap service detection incorrectly classifies dnsmasq as 'ISC BIND'. The attached patch adds matchlines for dnsmasq on tcp and udp. Cheers, Sven -- Sven Klemm http://cthulhu.c3d2.de/~sven/
Index: nmap-service-probes =================================================================== --- nmap-service-probes (revision 6760) +++ nmap-service-probes (working copy) @@ -5098,6 +5098,7 @@ Probe UDP DNSVersionBindReq q|\0\x06\x01\0\0\x01\0\0\0\0\0\0\x07version\x04bind\0\0\x10\0\x03| rarity 1 ports 53,1967,2967 +match domain m|\x07version\x04bind.*\x0cdnsmasq-([-\w._ ]+)$|s p/dnsmasq/ v/$1/ # Allow 3-12 character version numbers match domain m|\x07version\x04bind.*[\x03-\x14]([-\w._ ]{3,20})$|s p/ISC BIND/ v/$1/ match domain m|\x07version\x04bind.*[\x03-\x14]BIND ([-\w._]{3,20})$|s p/ISC BIND/ v/$1/ @@ -5143,6 +5144,7 @@ Probe TCP DNSVersionBindReq q|\0\x1E\0\x06\x01\0\0\x01\0\0\0\0\0\0\x07version\x04bind\0\0\x10\0\x03| rarity 3 ports 53,135,512-514,543,544,1029,13783,1521,2068,2105,2967,5323,5520,5530,5555,6543,7000,7008 +match domain m|\x07version\x04bind.*\x0cdnsmasq-([-\w._ ]+)$|s p/dnsmasq/ v/$1/ match domain m|\x07version\x04bind.*[\x03-\x14]([-\w._ ]{3,20})$|s p/ISC BIND/ v/$1/ match domain m|\x07version\x04bind.*[\x03-\x14]BIND ([-\w._]{3,20})$|s p/ISC BIND/ v/$1/ # ISC Bind 9.1.3
Attachment:
signature.asc
Description: OpenPGP digital signature
_______________________________________________ Sent through the nmap-dev mailing list http://cgi.insecure.org/mailman/listinfo/nmap-dev Archived at http://SecLists.Org
Current thread:
- matchline for dnsmasq Sven Klemm (Jan 30)
- Re: matchline for dnsmasq Fyodor (Jan 30)